03-12-2024, 09:13 PM
In response to your 1st post:
The Items are kept in memory. Where they reside at (the exact memory addresses) can vary, because it's in Dynamic memory.
Yes, I set the value that the game recognizes as green shell into r3. Then the original/default instruction of the hook address is next.
In the stw r3, 0x0020 (r23) instruction, the value in r23 (which is a dynamic memory address) is added with 0x0020. The result of this addition (which is known as the effective address) is the exact memory address of where the r3 value is written to.
The issue I think you're having is assuming this r23 + 0x0020 address is some sort of constant. It's not. The address number itself varies. This is why you CANNOT use something such as a 32-bit RAM Write code. You need an ASM code because the address in r23 will always vary. We need that value in r23 to know where to "write" the Item value.
In response to your 2nd post:
That was a clever idea! Good work. You will need some assembly though to get the 3rd goal completed.
----
Here's what I would do.
You will need the the Hook Address of Unnamed Code's. - https://mariokartwii.com/showthread.php?tid=1995
Let's say you use the PAL game. That would be 0x80791958. Simply launch your MKWii game in Dolphin, once you get to the main menu, pause the emulation. Go to the Address 0x80791958 in code view.
You should see this instruction:
lwz r31, 0x008C (r3) # This is loading some value from dynamic memory into r3.
Now let's view Unnamed's source to his code:
li r31, 0xYY ## Load the Item Number in r31
stw r31, 0x90 (r3) ## overwrite Item number in Inventory
li r31, 0xXX ## Load the Item in r31
Notice how he doesn't include the hook address's original instruction. Why? Well the original instruction is loading a value into r31. He doesn't need to "rewrite/restore" the value back to memory. He can simply just modify r31.
You will notice he modifies r31 twice. The first time he's using it as a scrap register to modify the contents of memory at r3 + 0x0090. This is where the Item Number is located at. Then he modifies r31 a second time. This changes the Item Value.
Item Value = what kind of Item
Item Number = how much of the Item
Since the original instruction loads the Item Value from r3 + 0x008C, we can conclude that....
Item Value is located at r3 + 0x008C
Item Number is located at r3 + 0x0090
What his code is doing is this..
1. Use r31 as a scrap register to write new Item Number
2. Write that new Item Number to memory
3. Place in new r31 for Item Value *instead* of loading a value into r31 from memory
---
What we need now is to see if any of the other non-volatile registers (r14 thru r30) are keeping the Slot of the Player. Set an Instruction BP on 0x80791958 and enter a normal Offline VS Race.
Every time you or the CPU uses an item it will trigger the Instruction BP. Every time it gets triggered, take note of r14 thru r30. After a handful of hits, you may see a pattern in one or a few registers. If you see a register that is always 0 when the BP hits for you *and* never 0 (1 thru B) when it the BP hits for the CPU, than that's the slot value. It's possible a register may not be used for a Slot Value. If that's the case, we can still get the Slot Value just by other means/methods.
Try that and let me know how it goes. Hopefully, some of this will make sense. I've just gotten out of the hospital so my mind may not be 100%.
The Items are kept in memory. Where they reside at (the exact memory addresses) can vary, because it's in Dynamic memory.
Yes, I set the value that the game recognizes as green shell into r3. Then the original/default instruction of the hook address is next.
In the stw r3, 0x0020 (r23) instruction, the value in r23 (which is a dynamic memory address) is added with 0x0020. The result of this addition (which is known as the effective address) is the exact memory address of where the r3 value is written to.
The issue I think you're having is assuming this r23 + 0x0020 address is some sort of constant. It's not. The address number itself varies. This is why you CANNOT use something such as a 32-bit RAM Write code. You need an ASM code because the address in r23 will always vary. We need that value in r23 to know where to "write" the Item value.
In response to your 2nd post:
That was a clever idea! Good work. You will need some assembly though to get the 3rd goal completed.
----
Here's what I would do.
You will need the the Hook Address of Unnamed Code's. - https://mariokartwii.com/showthread.php?tid=1995
Let's say you use the PAL game. That would be 0x80791958. Simply launch your MKWii game in Dolphin, once you get to the main menu, pause the emulation. Go to the Address 0x80791958 in code view.
You should see this instruction:
lwz r31, 0x008C (r3) # This is loading some value from dynamic memory into r3.
Now let's view Unnamed's source to his code:
li r31, 0xYY ## Load the Item Number in r31
stw r31, 0x90 (r3) ## overwrite Item number in Inventory
li r31, 0xXX ## Load the Item in r31
Notice how he doesn't include the hook address's original instruction. Why? Well the original instruction is loading a value into r31. He doesn't need to "rewrite/restore" the value back to memory. He can simply just modify r31.
You will notice he modifies r31 twice. The first time he's using it as a scrap register to modify the contents of memory at r3 + 0x0090. This is where the Item Number is located at. Then he modifies r31 a second time. This changes the Item Value.
Item Value = what kind of Item
Item Number = how much of the Item
Since the original instruction loads the Item Value from r3 + 0x008C, we can conclude that....
Item Value is located at r3 + 0x008C
Item Number is located at r3 + 0x0090
What his code is doing is this..
1. Use r31 as a scrap register to write new Item Number
2. Write that new Item Number to memory
3. Place in new r31 for Item Value *instead* of loading a value into r31 from memory
---
What we need now is to see if any of the other non-volatile registers (r14 thru r30) are keeping the Slot of the Player. Set an Instruction BP on 0x80791958 and enter a normal Offline VS Race.
Every time you or the CPU uses an item it will trigger the Instruction BP. Every time it gets triggered, take note of r14 thru r30. After a handful of hits, you may see a pattern in one or a few registers. If you see a register that is always 0 when the BP hits for you *and* never 0 (1 thru B) when it the BP hits for the CPU, than that's the slot value. It's possible a register may not be used for a Slot Value. If that's the case, we can still get the Slot Value just by other means/methods.
Try that and let me know how it goes. Hopefully, some of this will make sense. I've just gotten out of the hospital so my mind may not be 100%.