Mario Kart Wii Gecko Codes, Cheats, & Hacks › Cheat Codes › Offline; Item v
Activate Bullet Bill at Anytime [Vega]

Threaded Mode
Activate Bullet Bill at Anytime [Vega]
Vega Offline
bl the_admin
*
Posts: 4,292
Threads: 901
Joined: Feb 2018
Reputation: 98
#1
08-08-2021, 12:44 PM (This post was last modified: 08-27-2021, 08:22 PM by Vega.)
Activate Bullet Bill at Anytime [Vega]

This code will allow you to press your desired button(s) on your controller to activate the Bullet Bill whenever you want. There is offline version and online version of the code. The online version is untested, can somebody test please? =p.
  • Q (PAL only) 5 for GCN; 4 for Non-GCN
  • S (Offline version of code only) = Slot (0 for yourself)
  • XXXX = Controller Address
  • ZZZZ = Button to Activate (use Wavebird ZZZZ values if using GCN!!)

Link to thread of XXXX and ZZZZ values - https://mkwii.com/showthread.php?tid=44

FINAL NOTE: Regarding the offline version, if you want everybody to all be in a Bill at once, replace "2C1B000S" with "48000008", this gets rid of the Player Slot check.

Video demo - https://www.youtube.com/watch?v=ijF5DqakGdI

Code creator: Vega
Code credits: Stebler (player.h)

Offline version~

NTSC-U
C278EEF8 00000015
4800004D 8078EEFC
8078895C 80788964
8078898C 807889BC
807889C4 2C000014
7C0320AE 83C60014
83A60018 7FACEB78
7D8903A6 48000084
38000001 3BC00000
3FA0807D 63BD68BC
7FA903A6 7D6802A6
3D808034 A18CXXXX
718CZZZZ 41A20014
2C1B000S 40A2000C
394B002C 48000008
394B0014 396BFFFC
39200006 7D2903A6
852A0004 850B0004
91280000 7C00406C
7C0004AC 7C0047AC
4C00012C 4200FFE4
801D008C 00000000

PAL
C2797F04 00000015
4800004D 80797F08
80791968 80791970
80791998 807919C8
807919D0 2C000014
7C0320AE 83C60014
83A60018 7FACEB78
7D8903A6 48000084
38000001 3BC00000
3FA0807A 63BD9AFC
7FA903A6 7D6802A6
3D80803Q A18CXXXX
718CZZZZ 41A20014
2C1B000S 40A2000C
394B002C 48000008
394B0014 396BFFFC
39200006 7D2903A6
852A0004 850B0004
91280000 7C00406C
7C0004AC 7C0047AC
4C00012C 4200FFE4
801D008C 00000000

NTSC-J
C2797570 00000015
4800004D 80797574
80790FD4 80790FDC
80791004 80791034
8079103C 2C000014
7C0320AE 83C60014
83A60018 7FACEB78
7D8903A6 48000084
38000001 3BC00000
3FA0807A 63BD9168
7FA903A6 7D6802A6
3D808034 A18CXXXX
718CZZZZ 41A20014
2C1B000S 40A2000C
394B002C 48000008
394B0014 396BFFFC
39200006 7D2903A6
852A0004 850B0004
91280000 7C00406C
7C0004AC 7C0047AC
4C00012C 4200FFE4
801D008C 00000000

NTSC-K
C27862C4 00000015
4800004D 807862C8
8077FD28 8077FD30
8077FD58 8077FD88
8077FD90 2C000014
7C0320AE 83C60014
83A60018 7FACEB78
7D8903A6 48000084
38000001 3BC00000
3FA08079 63BD7EBC
7FA903A6 7D6802A6
3D808033 A18CXXXX
718CZZZZ 41A20014
2C1B000S 40A2000C
394B002C 48000008
394B0014 396BFFFC
39200006 7D2903A6
852A0004 850B0004
91280000 7C00406C
7C0004AC 7C0047AC
4C00012C 4200FFE4
801D008C 00000000


Online version (untested)~

NTSC-U
C278EEF8 00000017
4800004D 8078EEFC
8078895C 80788964
8078898C 807889BC
807889C4 2C000014
7C0320AE 83C60014
83A60018 7FACEB78
7D8903A6 48000084
38000001 3BC00000
3FA0807D 63BD68BC
7FA903A6 7D6802A6
3D808034 A18CXXXX
718CZZZZ 41A20020
3D40809C 814A8F68
894A0B84 7C0AD800
40A2000C 394B002C
48000008 394B0014
396BFFFC 39200006
7D2903A6 852A0004
850B0004 91280000
7C00406C 7C0004AC
7C0047AC 4C00012C
4200FFE4 801D008C
60000000 00000000

PAL
C2797F04 00000017
4800004D 80797F08
80791968 80791970
80791998 807919C8
807919D0 2C000014
7C0320AE 83C60014
83A60018 7FACEB78
7D8903A6 48000084
38000001 3BC00000
3FA0807A 63BD9AFC
7FA903A6 7D6802A6
3D80803Q A18CXXXX
718CZZZZ 41A20020
3D40809C 814AD728
894A0B84 7C0AD800
40A2000C 394B002C
48000008 394B0014
396BFFFC 39200006
7D2903A6 852A0004
850B0004 91280000
7C00406C 7C0004AC
7C0047AC 4C00012C
4200FFE4 801D008C
60000000 00000000

NTSC-J
C2797570 00000017
4800004D 80797574
80790FD4 80790FDC
80791004 80791034
8079103C 2C000014
7C0320AE 83C60014
83A60018 7FACEB78
7D8903A6 48000084
38000001 3BC00000
3FA0807A 63BD9168
7FA903A6 7D6802A6
3D808034 A18CXXXX
718CZZZZ 41A20020
3D40809C 814AC788
894A0B84 7C0AD800
40A2000C 394B002C
48000008 394B0014
396BFFFC 39200006
7D2903A6 852A0004
850B0004 91280000
7C00406C 7C0004AC
7C0047AC 4C00012C
4200FFE4 801D008C
60000000 00000000

NTSC-K
C27862C4 00000017
4800004D 807862C8
8077FD28 8077FD30
8077FD58 8077FD88
8077FD90 2C000014
7C0320AE 83C60014
83A60018 7FACEB78
7D8903A6 48000084
38000001 3BC00000
3FA08079 63BD7EBC
7FA903A6 7D6802A6
3D808033 A18CXXXX
718CZZZZ 41A20020
3D40809B 814ABD68
894A0B84 7C0AD800
40A2000C 394B002C
48000008 394B0014
396BFFFC 39200006
7D2903A6 852A0004
850B0004 91280000
7C00406C 7C0004AC
7C0047AC 4C00012C
4200FFE4 801D008C
60000000 00000000


List of Sources:

Offline version~
Code:
#START ASSEMBLY

#Address Ports
#NTSC-U = 8078EEF8
#PAL = 80797F04
#NTSC-J = 80797570
#NTSC-K = 807862C4

.set region, ''

.if (region == 'E')
        .set address1, 0x8078EEFC
        .set address2, 0x8078895C
        .set address3, 0x80788964
        .set address4, 0x8078898C
        .set address5, 0x807889BC
        .set address6, 0x807889C4
        .set regdepinstruction1, 0x3FA0807D
        .set regdepinstruction2, 0x63BD68BC
.elseif (region == 'P')
        .set address1, 0x80797F08
        .set address2, 0x80791968
        .set address3, 0x80791970
        .set address4, 0x80791998
        .set address5, 0x807919c8
        .set address6, 0x807919d0
        .set regdepinstruction1, 0x3FA0807A
        .set regdepinstruction2, 0x63BD9AFC
.elseif (region == 'J')
        .set address1, 0x80797574
        .set address2, 0x80790FD4
        .set address3, 0x80790FDC
        .set address4, 0x80791004
        .set address5, 0x80791034
        .set address6, 0x8079103C
        .set regdepinstruction1, 0x3FA0807A
        .set regdepinstruction2, 0x63BD9168
.elseif (region == 'K')
        .set address1, 0x807862C8
        .set address2, 0x8077FD28
        .set address3, 0x8077FD30
        .set address4, 0x8077FD58
        .set address5, 0x8077FD88
        .set address6, 0x8077FD90
        .set regdepinstruction1, 0x3FA08079
        .set regdepinstruction2, 0x63BD7EBC
.else
        .err
.endif

#Setup Lookup Table
bl table
.long address1
.long address2
.long address3
.long address4
.long address5
.long address6
.long 0x2C000014 #Default Instructions
.long 0x7c0320ae
.long 0x83c60014
.long 0x83a60018
.long 0x7faceb78
.long 0x7d8903a6
.long 0x48000084 #New Instructions
.long 0x38000001
.long 0x3BC00000
.long regdepinstruction1 #Region dependent instruction for setting the address in the CTR to bl to
.long regdepinstruction2
.long 0x7FA903A6
table:
mflr r11

#Check Controller
lis r12, 0x8035 #PAL GCN Y Button used for compilation, adjust this for your needs
lhz r12, 0xFFFF8200 (r12)
andi. r12, r12, 0x0800
beq+ deactivate_code

#Check Slot
cmpwi r27, 0 #Slot 0 (yourself) used for compilation, adjust this for your needs; #change to b 0x8 to skip slot check and make everybody use a Bill
bne+ deactivate_code #1 out of 12 possible, hence most likely branch

#Activate Code!
addi r10, r11, 0x2C #Point to -0x4 before 1st new instruction
b write_instructions

#Deactivate Code
deactivate_code:
addi r10, r11, 0x14 #Point to -0x4 before 1st Default Instruction

#Write Instructions; setup Loop
write_instructions:
addi r11, r11, -4 #Point to a word before the table for upcoming updating loop
li r9, 6 #6 for 6 instructions to write
mtctr r9

#Loop
loop:
lwzu r9, 0x4 (r10) #Load instruction
lwzu r8, 0x4 (r11) #Load instruction's address
stw r9, 0 (r8) #Write it!

#Clear cache so instructions update instantly
dcbst 0, r8
sync
icbi 0, r8
isync

#Decrement Loop
bdnz+ loop

#Default Instruction
lwz r0, 0x008C (r29)

#END ASSEMBLY


Online version~
Code:
#START ASSEMBLY

#Address Ports
#NTSC-U = 8078EEF8
#PAL = 80797F04
#NTSC-J = 80797570
#NTSC-K = 807862C4

.set region, ''

.if (region == 'E')
        .set ptr_raceData, 0x809b8f68
        .set address1, 0x8078EEFC
        .set address2, 0x8078895C
        .set address3, 0x80788964
        .set address4, 0x8078898C
        .set address5, 0x807889BC
        .set address6, 0x807889C4
        .set regdepinstruction1, 0x3FA0807D
        .set regdepinstruction2, 0x63BD68BC
.elseif (region == 'P')
        .set ptr_raceData, 0x809bd728
        .set address1, 0x80797F08
        .set address2, 0x80791968
        .set address3, 0x80791970
        .set address4, 0x80791998
        .set address5, 0x807919c8
        .set address6, 0x807919d0
        .set regdepinstruction1, 0x3FA0807A
        .set regdepinstruction2, 0x63BD9AFC
.elseif (region == 'J')
        .set ptr_raceData, 0x809bc788
        .set address1, 0x80797574
        .set address2, 0x80790FD4
        .set address3, 0x80790FDC
        .set address4, 0x80791004
        .set address5, 0x80791034
        .set address6, 0x8079103C
        .set regdepinstruction1, 0x3FA0807A
        .set regdepinstruction2, 0x63BD9168
.elseif (region == 'K')
        .set ptr_raceData, 0x809abd68
        .set address1, 0x807862C8
        .set address2, 0x8077FD28
        .set address3, 0x8077FD30
        .set address4, 0x8077FD58
        .set address5, 0x8077FD88
        .set address6, 0x8077FD90
        .set regdepinstruction1, 0x3FA08079
        .set regdepinstruction2, 0x63BD7EBC
.else
        .err
.endif

#Setup Lookup Table
bl table
.long address1
.long address2
.long address3
.long address4
.long address5
.long address6
.long 0x2C000014 #Default Instructions
.long 0x7c0320ae
.long 0x83c60014
.long 0x83a60018
.long 0x7faceb78
.long 0x7d8903a6
.long 0x48000084 #New Instructions
.long 0x38000001
.long 0x3BC00000
.long regdepinstruction1 #Region dependent instruction for setting the address in the CTR to bl to
.long regdepinstruction2
.long 0x7FA903A6
table:
mflr r11

#Check Controller
lis r12, 0x8035 #PAL GCN Y Button used for compilation, adjust this for your needs
lhz r12, 0xFFFF8200 (r12)
andi. r12, r12, 0x0800
beq+ deactivate_code

#Make sure your slot is the one being executed
lis r10, ptr_raceData@ha
lwz r10, ptr_raceData@l (r10)
lbz r10, 0x0B84 (r10)
cmpw r10, r27
bne+ deactivate_code #1 out of 12 possible, hence most likely branch

#Activate Code!
addi r10, r11, 0x2C #Point to -0x4 before 1st new instruction
b write_instructions

#Deactivate Code
deactivate_code:
addi r10, r11, 0x14 #Point to -0x4 before 1st Default Instruction

#Write Instructions; setup Loop
write_instructions:
addi r11, r11, -4 #Point to a word before the table for upcoming updating loop
li r9, 6 #6 for 6 instructions to write
mtctr r9

#Loop
loop:
lwzu r9, 0x4 (r10) #Load instruction
lwzu r8, 0x4 (r11) #Load instruction's address
stw r9, 0 (r8) #Write it!

#Clear cache so instructions update instantly
dcbst 0, r8
sync
icbi 0, r8
isync

#Decrement Loop
bdnz+ loop

#Default Instruction
lwz r0, 0x008C (r29)

#END ASSEMBLY
Find
Reply
Unnamed Offline
Coder / Dev
*
Posts: 169
Threads: 35
Joined: Jan 2020
Reputation: 16
#2
08-27-2021, 10:48 AM
Regarding offline NTSC-J and NTSC-K versions: aren't the "lis" instructions regarding controller adresses wrong? (3D808033 on NTSC-J and 3D808035 on NTSC-K just stands there)


I will try the codes today I think.
Find
Reply
Vega Offline
bl the_admin
*
Posts: 4,292
Threads: 901
Joined: Feb 2018
Reputation: 98
#3
08-27-2021, 07:19 PM (This post was last modified: 08-27-2021, 10:59 PM by Vega.)
Oops. Thank you! Silly error on my part.

There's actually an instruction the lookup table I forgot to port. Got that fixed, I can test later today.

EDIT: Tested and all ports working. Apologies for not catching that when i was writing up the source for this code initially.
Find
Reply


Forum Jump:


Users browsing this thread: 2 Guest(s)