Wii ID NAND Modifier [Vega]

[Vega]

Wii ID NAND Modifier [Vega]

This code will allow you to permanently change your Wii ID to whatever value you want. With this code on, simply boot your game. After a split second, you will return to the Wii Main Menu. Go ahead and check your Wii ID number and you will see the changes. If you are using Dolphin, the return to the Wii Menu function may not work, but the code will still take effect.

WWWWXXXXYYYYZZZZ = Wii ID (in hex)

NTSC-U
C20095F4 00000044
38600400 7C781B78
38800020 80ADA358
80A50024 3D808022
618C9490 7D8803A6
4E800021 7C791B78
3FA08016 48000021
2F736861 72656432
2F776332 342F6E77
6332346D 73672E63
66670000 7C6802A6
7C7A1B78 38800001
63BCADBC 7F8803A6
4E800021 2C030000
418001A4 7C7B1B78
7F24CB78 7F05C378
63BCB15C 7F8803A6
4E800021 7C03C000
40820184 7F63DB78
63BCB2E4 7F8803A6
4E800021 2C030000
4180016C 3FC0WWWW
63DEXXXX 3FE0YYYY
63FFZZZZ BFD90008
3800001F 7F24CB78
38A00000 7C0903A6
80640000 80040004
7CA51A14 80640008
7CA50214 8004000C
7CA51A14 80640010
7CA50214 80040014
7CA51A14 80640018
7CA50214 8004001C
7CA51A14 38840020
7CA50214 4200FFBC
80640000 80040004
7CA51A14 80640008
7CA50214 8004000C
7CA51A14 80640010
7CA50214 80040014
7CA51A14 80640018
7CA50214 7CA51A14
90B903FC 7F43D378
38800002 63BCADBC
7F8803A6 4E800021
2C030000 418000A8
7C7B1B78 7F24CB78
7F05C378 63BCB220
7F8803A6 4E800021
7C03C000 40820088
7F63DB78 63BCB2E4
7F8803A6 4E800021
2C030000 41800070
48000021 2F736861
72656432 2F776332
342F6E77 6332346D
73672E63 626B0000
7C6802A6 38800002
63BCADBC 7F8803A6
4E800021 2C030000
41800034 7C7B1B78
7F24CB78 7F05C378
63BCB220 7F8803A6
4E800021 7C03C000
40820014 7F63DB78
63BCB2E4 7F8803A6
4E800021 3D80801A
618C87B8 7D8803A6
4E800020 00000000

PAL
C2009634 00000044
38600400 7C781B78
38800020 80ADA360
80A50024 3D808022
618C9814 7D8803A6
4E800021 7C791B78
3FA08016 48000021
2F736861 72656432
2F776332 342F6E77
6332346D 73672E63
66670000 7C6802A6
7C7A1B78 38800001
63BCAE5C 7F8803A6
4E800021 2C030000
418001A4 7C7B1B78
7F24CB78 7F05C378
63BCB1FC 7F8803A6
4E800021 7C03C000
40820184 7F63DB78
63BCB384 7F8803A6
4E800021 2C030000
4180016C 3FC0WWWW
63DEXXXX 3FE0YYYY
63FFZZZZ BFD90008
3800001F 7F24CB78
38A00000 7C0903A6
80640000 80040004
7CA51A14 80640008
7CA50214 8004000C
7CA51A14 80640010
7CA50214 80040014
7CA51A14 80640018
7CA50214 8004001C
7CA51A14 38840020
7CA50214 4200FFBC
80640000 80040004
7CA51A14 80640008
7CA50214 8004000C
7CA51A14 80640010
7CA50214 80040014
7CA51A14 80640018
7CA50214 7CA51A14
90B903FC 7F43D378
38800002 63BCAE5C
7F8803A6 4E800021
2C030000 418000A8
7C7B1B78 7F24CB78
7F05C378 63BCB2C0
7F8803A6 4E800021
7C03C000 40820088
7F63DB78 63BCB384
7F8803A6 4E800021
2C030000 41800070
48000021 2F736861
72656432 2F776332
342F6E77 6332346D
73672E63 626B0000
7C6802A6 38800002
63BCAE5C 7F8803A6
4E800021 2C030000
41800034 7C7B1B78
7F24CB78 7F05C378
63BCB2C0 7F8803A6
4E800021 7C03C000
40820014 7F63DB78
63BCB384 7F8803A6
4E800021 3D80801A
618C8858 7D8803A6
4E800020 00000000

NTSC-J
C2009590 00000044
38600400 7C781B78
38800020 80ADA360
80A50024 3D808022
618C9734 7D8803A6
4E800021 7C791B78
3FA08016 48000021
2F736861 72656432
2F776332 342F6E77
6332346D 73672E63
66670000 7C6802A6
7C7A1B78 38800001
63BCAD7C 7F8803A6
4E800021 2C030000
418001A4 7C7B1B78
7F24CB78 7F05C378
63BCB11C 7F8803A6
4E800021 7C03C000
40820184 7F63DB78
63BCB2A4 7F8803A6
4E800021 2C030000
4180016C 3FC0WWWW
63DEXXXX 3FE0YYYY
63FFZZZZ BFD90008
3800001F 7F24CB78
38A00000 7C0903A6
80640000 80040004
7CA51A14 80640008
7CA50214 8004000C
7CA51A14 80640010
7CA50214 80040014
7CA51A14 80640018
7CA50214 8004001C
7CA51A14 38840020
7CA50214 4200FFBC
80640000 80040004
7CA51A14 80640008
7CA50214 8004000C
7CA51A14 80640010
7CA50214 80040014
7CA51A14 80640018
7CA50214 7CA51A14
90B903FC 7F43D378
38800002 63BCAD7C
7F8803A6 4E800021
2C030000 418000A8
7C7B1B78 7F24CB78
7F05C378 63BCB1E0
7F8803A6 4E800021
7C03C000 40820088
7F63DB78 63BCB2A4
7F8803A6 4E800021
2C030000 41800070
48000021 2F736861
72656432 2F776332
342F6E77 6332346D
73672E63 626B0000
7C6802A6 38800002
63BCAD7C 7F8803A6
4E800021 2C030000
41800034 7C7B1B78
7F24CB78 7F05C378
63BCB1E0 7F8803A6
4E800021 7C03C000
40820014 7F63DB78
63BCB2A4 7F8803A6
4E800021 3D80801A
618C8778 7D8803A6
4E800020 00000000

NTSC-K
C200973C 00000044
38600400 7C781B78
38800020 80ADA380
80A50024 3D808022
618C9B88 7D8803A6
4E800021 7C791B78
3FA08016 48000021
2F736861 72656432
2F776332 342F6E77
6332346D 73672E63
66670000 7C6802A6
7C7A1B78 38800001
63BCAEF8 7F8803A6
4E800021 2C030000
418001A4 7C7B1B78
7F24CB78 7F05C378
63BCB298 7F8803A6
4E800021 7C03C000
40820184 7F63DB78
63BCB420 7F8803A6
4E800021 2C030000
4180016C 3FC0WWWW
63DEXXXX 3FE0YYYY
63FFZZZZ BFD90008
3800001F 7F24CB78
38A00000 7C0903A6
80640000 80040004
7CA51A14 80640008
7CA50214 8004000C
7CA51A14 80640010
7CA50214 80040014
7CA51A14 80640018
7CA50214 8004001C
7CA51A14 38840020
7CA50214 4200FFBC
80640000 80040004
7CA51A14 80640008
7CA50214 8004000C
7CA51A14 80640010
7CA50214 80040014
7CA51A14 80640018
7CA50214 7CA51A14
90B903FC 7F43D378
38800002 63BCAEF8
7F8803A6 4E800021
2C030000 418000A8
7C7B1B78 7F24CB78
7F05C378 63BCB35C
7F8803A6 4E800021
7C03C000 40820088
7F63DB78 63BCB420
7F8803A6 4E800021
2C030000 41800070
48000021 2F736861
72656432 2F776332
342F6E77 6332346D
73672E63 626B0000
7C6802A6 38800002
63BCAEF8 7F8803A6
4E800021 2C030000
41800034 7C7B1B78
7F24CB78 7F05C378
63BCB35C 7F8803A6
4E800021 7C03C000
40820014 7F63DB78
63BCB420 7F8803A6
4E800021 3D80801A
618C8BB4 7D8803A6
4E800020 00000000

---

Code creator: Vega

Code credits: RiiDefi (Egg Alloc Function), Megazig (Return to Wii Menu and ISFS Functions)

---

Source:
#~~~~~~~~~~~~~~~~#
# START ASSEMBLY #
#~~~~~~~~~~~~~~~~#

#

#Address Ports
#NTSC-U = 800095F4
#PAL = 80009634
#NTSC-J = 80009590
#NTSC-K = 8000973C

#~~~~~~~~~~~~~~~~~~~~~~#
# Macros and Variables #
#~~~~~~~~~~~~~~~~~~~~~~#

.macro call_link address
    lis r12, \address@h
    ori r12, r12, \address@l
    mtlr r12
    blrl
.endm

.macro call_isfs address
    ori r28, r29, \address@l
    mtlr r28
    blrl
.endm

.macro call_nolink address
    lis r12, \address@h
    ori r12, r12, \address@l
    mtlr r12
    blr
.endm

.set region, '' #Fill in E, P, J, or K within the quotes for your region when Compiling! Lowercase letters can also be used.

.if    (region == 'E' || region == 'e') # RMCE
    .set ISFS_Open, 0xADBC
    .set ISFS_Read, 0xB15C
    .set ISFS_Write, 0xB220
    .set ISFS_Close, 0xB2E4
    .set Wii_Menu, 0x801A87B8
    .set Egg_Alloc, 0x80229490
.elseif (region == 'P' || region == 'p') # RMCP
    .set ISFS_Open, 0xAE5C
    .set ISFS_Read, 0xB1FC
    .set ISFS_Write, 0xB2C0
    .set ISFS_Close, 0xB384
    .set Wii_Menu, 0x801A8858
    .set Egg_Alloc, 0x80229814
.elseif (region == 'J' || region == 'j') # RMCJ
    .set ISFS_Open, 0xAD7C
    .set ISFS_Read, 0xB11C
    .set ISFS_Write, 0xB1E0
    .set ISFS_Close, 0xB2A4
    .set Wii_Menu, 0x801A8778
    .set Egg_Alloc, 0x80229734
.elseif (region == 'K' || region == 'k') # RMCK
    .set ISFS_Open, 0xAEF8
    .set ISFS_Read, 0xB298
    .set ISFS_Write, 0xB35C
    .set ISFS_Close, 0xB420
    .set Wii_Menu, 0x801A8BB4
    .set Egg_Alloc, 0x80229B88
.else # Invalid Region
    .abort
.endif

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
#          Register Notes        #
#  r31 = Wii ID Upper 32 bits  #
#  r30 = Wii ID Lower 32 bits  #
# r29 & r28 = Part of ISFS Macro #
#            r27 = fd          #
# r26 = File Path Addr 1st file  #
#  r25  = Heap Address Pointer  #
#  r24 = Size of File (0x400)  #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~~~#
#    EGG::Heap::alloc  #
#  r3 = Size of Heap  #
#    r4 = Alignment    #
# r5 = System Heap Calc #
#~~~~~~~~~~~~~~~~~~~~~~~#

li r3, 0x0400

mr r24, r3 #Backup Size of File for later uses of ISFS_Read & ISFS_Write

li r4, 0x20

.if    (region == 'E' || region == 'e')
        lwz r5, -0x5CA8(r13)
.elseif (region == 'P' || region == 'p')
        lwz r5, -0x5CA0(r13)
.elseif (region == 'J' || region == 'j')
        lwz r5, -0x5CA0(r13)
.elseif (region == 'K' || region == 'k')
        lwz r5, -0x5C80(r13)
.endif

lwz r5, 0x0024 (r5)

call_link Egg_Alloc
mr r25, r3 #Backup Heap Address Pointer

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
#      ISFS_Open  (1st file)    #
#        r3 = File Path        #
# r4 = 0x1 for Read Permissions #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

lis r29, 0x8016 #Set 1st half address for all ISFS Functions

bl open_file1

.string "/shared2/wc24/nwc24msg.cfg\0"

open_file1:
mflr r3
mr r26, r3 #Backup file path address pointer
li r4, 0x1

call_isfs ISFS_Open
cmpwi r3, 0x0 #r3 should return fd value. If negative value, then error occured.
blt- launch_menu

mr r27, r3 #Backup file descriptor

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
#                ISFS_Read                #
#                  r3 = fd                  #
# r4 = Address Pointer to dump read Data to #
#    r5 = Amount of Bytes to read & dump    #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

mr r4, r25 #Move backed up Heap Address Pointer to r4
mr r5, r24 #Move backed up Byte Write Size to r5

call_isfs ISFS_Read
cmpw r3, r24 #r3 should return r5's aka r24's value. If not, then error occured.
bne- launch_menu

#~~~~~~~~~~~~#
# ISFS_Close #
#  r3 = fd  #
#~~~~~~~~~~~~#

mr r3, r27

call_isfs ISFS_Close
cmpwi r3, 0
blt- launch_menu

#~~~~~~~~~~~~~~~~~~#
# Write New Wii ID #
#~~~~~~~~~~~~~~~~~~#

lis r30, 0x0001 #Random Wii ID value used for compilation, use your own value for code
ori r30, r30, 0x2222
lis r31, 0x1111
ori r31, r31, 0x2222

stmw r30, 0x8 (r25) #Write Wii ID

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Custom CRC32 Checksum (copied from Wii's System Menu #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

li r0, 0x1F
mr r4, r25
li r5, 0
mtctr r0

start_loop:
lwz r3, 0 (r4)

lwz r0, 0x4 (r4)
add r5, r5, r3

lwz r3, 0x8 (r4)
add r5, r5, r0

lwz r0, 0xC (r4)
add r5, r5, r3

lwz r3, 0x10 (r4)
add r5, r5, r0

lwz r0, 0x14 (r4)
add r5, r5, r3

lwz r3, 0x18 (r4)
add r5, r5, r0

lwz r0, 0x1C (r4)
add r5, r5, r3

addi r4, r4, 0x20
add r5, r5, r0

bdnz+ start_loop #Loop has to be split cuz we can't load final word of file cuz thats the checksum to check compared to calculated one

lwz r3, 0 (r4)

lwz r0, 0x4 (r4)
add r5, r5, r3

lwz r3, 0x8 (r4)
add r5, r5, r0

lwz r0, 0xC (r4)
add r5, r5, r3

lwz r3, 0x10 (r4)
add r5, r5, r0

lwz r0, 0x14 (r4)
add r5, r5, r3

lwz r3, 0x18 (r4) #This will load the final word right before the checksum that is on file
add r5, r5, r0

add r5, r5, r3 #One more final instruction to calculate checksum

stw r5, 0x03FC (r25) #Store CRC32 Word to spot (which is final word location of entire contents)

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
#      ISFS_Open (1st file)    #
#          r3 = File Path        #
# r4 = 0x2 for Write Permissions #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

mr r3, r26 #Move backed up file path address pointer to r3
li r4, 0x2

call_isfs ISFS_Open
cmpwi r3, 0x0
blt- launch_menu
mr r27, r3 #Backup fd

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
#                          ISFS_Write  (1st file)                            #
#                                  r3 = fd                                    #
# r4 = Address Pointer where String Data that will used for writes is located #
#                    r5 = Amount of Bytes to Write to File                    #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

mr r4, r25 #Move backed up Heap Address Pointer to r4
mr r5, r24 #Move backed up Byte Write Size to r5

call_isfs ISFS_Write
cmpw r3, r24 #r3 should return r5's aka r24's value. If not, then error occured.
bne- launch_menu

#~~~~~~~~~~~~~~~~~~~~~~~#
# ISFS_Close (1st file) #
#      r3 = fd        #
#~~~~~~~~~~~~~~~~~~~~~~~#

mr r3, r27
call_isfs ISFS_Close
cmpwi r3, 0
blt- launch_menu

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
#      ISFS_Open  (2nd file)    #
#          r3 = File Path        #
# r4 = 0x2 for Write Permissions #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

bl open_file2

.string "/shared2/wc24/nwc24msg.cbk\0"

open_file2:
mflr r3
li r4, 0x2

call_isfs ISFS_Open
cmpwi r3, 0x0 #r3 should return fd value. If not, then error occured.
blt- launch_menu

mr r27, r3 #Backup fd

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
#                          ISFS_Write  (2nd file)                            #
#                                  r3 = fd                                    #
# r4 = Address Pointer where String Data that will used for writes is located #
#                    r5 = Amount of Bytes to Write to File                    #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

mr r4, r25 #Move backed up Heap Address Pointer to r4
mr r5, r24 #Move backed up Byte Write Size to r5

call_isfs ISFS_Write
cmpw r3, r24 #r3 should return r5's aka r24's value. If not, then error occured.
bne- launch_menu

#~~~~~~~~~~~~~~~~~~~~~~~#
# ISFS_Close (2nd file) #
#      r3 = fd        #
#~~~~~~~~~~~~~~~~~~~~~~~#

mr r3, r27
call_isfs ISFS_Close #No need for return check of final close as code is ending now

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Writes Successful, Return to Wii Menu. No need to free the Heap. No need to close the Files #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

launch_menu:
call_nolink Wii_Menu

#

#~~~~~~~~~~~~~~#
# END ASSEMBLY #
#~~~~~~~~~~~~~~#

---

[JoshuaMK]

If you could give me a 4.3U System Menu to put in Dolphin I would be glad to help. I just don't have the time and patience to work getting the System Menu from my own Wii right now while I am working on other codes.

[Vega]

I sent you something in PM.

Some ways to attempt to find the function...

- Search for the file paths (in hex converted from ASCII) on the RAM Viewer. set up read BPs when Wii is booting, or when viewing the Wii ID.
- You could run a search for any compiled instructions that use a 16 bit signed VALUE of 03FC. So a branch link occurs to the checksum function, the checksum subroutine is done. At the end r3 holds the checksum word) and then returns back (branch link register). The next instruction would be a stw r3, 0x03FC(rX). This is the instruction that stores the checksum to the file. So once you find that, just look at the branch link above, and the address value that is listed for the branch is the address I need.

Visual example (random addresses used)
80456000 bl - > 0x80563488 (this would point to the start of the checksum function)
80456004 stw r3, 0x03FC (rX) (this instruction takes the r3 return value from the function and stores to the file)

There may be a possibility that there is an extra instruction (before the stw, after the bl) to setup a reference address for rX.

-

Also, you can try (backup your dolphin nand first) reformatting the nand. And set Read BPs on the file path (during beginning of factory setup), cuz the wii will need to create new cfg and cbk files then checksum them.

- Another way...
Copy paste part of the subroutine from MKWii's NETCalc (you will just have to wing it and guess a small portion to use). and see if you can find it in RAM when running the system menu. It could be the System Menu's CRC32 function is just slightly diff than MKWii;s.

- Yet another possible way.
Try to find the exe file for the old school Dolphin Unbanner. In the source code (if you can find that too) there will be something to define macros then do a CRC32 checksum. If you have Ghidra, open the exe file in Ghidra. Hopefully there is some sort of symbol mapping that Ghidra can fine/supply. It will not be in PowerPC ASM, but instructions are similar enough to try to convert a list of them and search for them in RAM when the system menu is running. Hell you could convert the whole subroutine from Arm ASM to Power PC ASM.

[Dorian]

@riidefi give him the money

[Vega]

Welp I did some searching and found the instructions of the sys menu (once you go past the health screen) that checks the newly calculated checksum vs checksum stored on file.

8149eb4c lwz r0, 0x03FC (r6)
add r5, r5, r3
cmplw r0, r5
beq- 0x8149EB64
li r3, -14 #return negative value to show error occur
blr #return from function

Next it loads the byte from the file that keeps track of what wii id you are on (there's 32 per cycle of every wii, byte 0 thru 31)

lwz r0, 0x0010 (r6)
cmplwi r0, 32
blt- 0x8149EB78

li r3, -14 #apply error return value
blr

Getting closer... hopefully

[Vega]

So it appears the CRC subroutine was right above what i just posted.... However, this looks nothing like the CRC32 function that mkwii uses. I doubt this is it... but here it is....

While the instructions might not seem optimized, I'm sure they are. Code warrior (mkw's official compiler) rarely makes optimization mistakes.

---

r3 = doesnt matter
r4 = file path
r5 = 0
r6 = copy of r4


Wii's CRC32

#Very start

li r0, 0x1F
mr r4, r6
li r5, 0
mtctr r0

start_loop:
lwz r3, 0 (r4)

lwz r0, 0x4 (r4)
add r5, r5, r3

lwz r3, 0x8 (r4)
add r5, r5, r0

lwz r0, 0xC (r4)
add r5, r5, r3

lwz r3, 0x10 (r4)
add r5, r5, r0

lwz r0. 0x14 (r4)
add r5, r5, r3

lwz r3, 0x18 (r4)
add r5, r5, r0

lwz r0, 0x1C (r4)
add r5, r5, r3

addi r4, r4, 0x20
add r5, r5, r0

bdnz+ start_loop #Loop has to be split cuz we can't load final word of file cuz thats the checksum to check compared to calculated one

lwz r3, 0 (r4)

lwz r0, 0x4 (r4)
add r5, r5, r3

lwz r3, 0x8 (r4)
add r5, r5, r0

lwz r0, 0xC (r4)
add r5, r5, r3

lwz r3, 0x10 (r4)
add r5, r5, r0

lwz r0, 0x14 (r4)
add r5, r5, r3

lwz r3, 0x18 (r4) #This will load the final word right before the checksum that is on file
add r5, r5, r0

# Load Checksum that is Stored in file #

lwz r0, 0x3FC (r6)

#

add r5, r5, r3 #One more final instruction to calculate checksum, not sure why they didn't have this instruction before loading the current file's checksum

cmplw r0, r5 #No need for logical compare since its a beq for the next instruction, I guess codewarrior likes logical comparsion for all non negative shit...

[JoshuaMK]

So does this mean all is well? Also wth is codewarrior? I know you said it's MKW's official compiler, but I would love clarification.

[Vega]

I'm about to test it. I was expecting to see some logical instructions on this subroutine, but there's not. This doesn't look like a CRC checksum calculator.

NPX is a company that makes compilers. Nintendo contracted them to make their official Wii compiler. It's name is codewarrior. Codewarrior is a good compiler, you will rarely find optimization issues if any at all.

[Vega]

GOT IT WORKING 

[JoshuaMK]

GOT IT WORKING 

Good Job