The Basics of Wii Cheat Codes & the Gecko Code Handler
NOTE: All cheat code examples provided in this thread are fake/made-up codes.
This thread will teach the beginner about the basics of Wii Cheat Codes that are used via the Gecko Code Handler. If you are complete beginner to code usage on the Wii, or if you are at the very start of your journey of wanting to become a Code creator, it's recommended you read this thread.
Intro
Cheat codes are applied in your Wii game by what is called a code handler. The code handler that is universally used for Wii gaming is called Gecko. The Gecko code handler will make modifications to the game's Random Access Memory (RAM or just called Memory) depending on what cheat codes are being implemented. Your Homebrew Disc/ISO application comes with the Gecko Code Handler. The Handler itself (along with your codes) are injected into memory. Once the game is running, the Code Handler will get executed thus executing your codes.
Cheat Codes reside in a Gecko Code Type file (called GCT). This GCT file resides on the SD/USB device (usually within a folder called 'codes'). A tutorial teaching the user how to create and use GCT files can be found HERE
Regarding Dolphin Emulator, cheat codes are applied via a Cheat Manager (a simple box where you just paste in the cheat codes). The code handler used is still the Gecko code handler but with slight modifications. A tutorial teaching how to apply cheats in the Dolphin Emulator can be found HERE.
Regions
Many Wii games, but not all, come in different regions so they can run on their corresponding region of Wii Console. There are 5 total regions. They are NTSC-U, PAL, NTSC-J, NTSC-K & NTSC-T. Only 8 total Wii games have an NTSC-T version (and MKWii is NOT one of them). Due to the rarity of NTSC-T, there's essentially only 4 total regions. You will notice that on this site, every Code sub-forum (excluding the incomplete/outdated sub-forum) has each region of code for MKWii. MKWii is available is all 4 regions, so this is why you see 4 different regions (or versions) of every cheat code for MKWii (excluding the incomplte/outdated sub-forum). This must be done because the components of memory will slightly differ per region of said game. You cannot take something such as a PAL code and run it on a NTSC-U game.
Overview of the 4 regions of MKWii~
NTSC-U = American MKW (RMCE01)
PAL = European/Australian MKW (RMCP01)
NTSC-J = Japanese MKW (RMCJ01)
NTSC-K = Korean MKW (RMCK01)
RMCE01, RMCP01, RMCJ01, & RMCK01 are all of MKWii's Game ID's.
Memory
All Wii games operate in the following memory ranges...
80000000 thru 817FFFFF
90000000 thru 93FFFFFF
All values for memory are in Hexadecimal (Hex) form. If you don't know what Hex is, you can easily find many quick & simple tutorials via a Google search. You need to have some basic understanding of Hex before continuing further.
Memory can be broken up into 3 categories~
Mem 80 (Any memory address starting with '80')
Mem 81 (Any memory address starting with '81')
Mem 90 (Any memory address starting with '9')
For most Wii games, Mem80 is the region of memory where most of the game's instructions reside at that will be executed by the Wii's CPU. Mem80 is called Static Memory, meaning that the contents (mostly the game's instructions) will be placed in the same spot (address/location) of Mem80 every time the game is booted/played.
Mem81 and Mem90 are called Dynamic Memory, and these regions of memory are mainly used as space to hold data at that the Wii's CPU instructions will read/write to/from. The memory addresses/locations where this data resides at can differ every time the game is booted/played, hence the name Dynamic. There are many exceptions to everything just mentioned, but this is the basic concept of how Wii games use Memory.
View of Memory:
Here is a screenshot of a random place in static memory (NTSC-U Mario Kart Wii) ~
![[Image: staticmem.png]](https://mariokartwii.com/pics/other/staticmem.png)
The Hex values you see are compiled byte code of various instructions to be executed by the Wii's CPU.
Bit Reference
Every compiled instruction is 4 bytes (8 digits) in length. Since every instruction is a 4-byte length and every instruction must be aligned, this means every instruction's memory address (location in memory) is a value divisible by 4. For example, take a look at address 80516074. To navigate to the address correctly, first, go to the row 80516070. Once at that row, go to column '.4'.
80516070 + 4 in hex is 80516074. Thus you are at memory address 80516074.
The 4 bytes starting at that address is 38A00000. This is a compiled instruction.
![[Image: memnav.png]](https://mariokartwii.com/pics/tut/memnav.png)
There are 8 bits in each byte. Since each instruction is 4 bytes long, that means each instruction is 32 bits in length.
32 bits = 8 digits = 4 bytes (Word); each instruction is a Word in length
16 bits = 4 digits = 2 bytes (Halfword)
8 bits = 2 digits = 1 byte (Byte)
It's important to understand the terms Word, Halfword, and Byte and how to navigate thru memory using those terms. For example, go to address 805160BC.
The word at this memory address is 4BAF3AC5. The picture shown below has the word circled in red.
![[Image: memnavword.png]](https://mariokartwii.com/pics/tut/memnavword.png)
The halfword at the same memory address is 4BAF. The picture below has the halfword circled in blue.
![[Image: memnavhalfword.png]](https://mariokartwii.com/pics/tut/memnavhalfword.png)
The byte at that same address is 4B. The picture below has the byte circled in green.
![[Image: memnavbyte.png]](https://mariokartwii.com/pics/tut/memnavbyte.png)
So, if I was to say.. what is the halfword at 80516086? The correct answer is 1B78.
If I was to say.. what is the byte at 8051600E? The correct answer is FF.
Basic RAM Writes
The Gecko Code Handler has various codetypes (formats) that the Code Creator can use to create various codes. Let's go over basic RAM writes. These are formats for cheat codes that will write over certain portions of Memory with new values.
~~~
32 Bit RAM (Word) Write
04XXXXXX YYYYYYYY: The Y Values overwrite the default word value at memory address 80XXXXXX. The 32 Bit RAM Write is by far the most common type of Gecko code that is used. They are mainly used to edit in a new compiled instruction in Static Memory.
Example:
0456A308 38A00001
This code will replace the default word value at address 8056A308 with new value 38A00001.
~~~
Nop
04XXXXXX 60000000: Any 32 bit RAM Write that writes the value 60000000 called a nop. A nop basically cancels out an instruction. Many 'noobies' will abuse this codetype as in randomly placing nops to Memory hoping to 'create' a code.
Example:
0485E300 60000000
This code will replace the default 32 word value of address 8085E300 with the value 60000000.
~~~
16 Bit RAM (Halfword) Write
02XXXXXX 0000YYYY: The Y values overwrite the default halfword value at memory address 80XXXXXX.
Example:
0211D2C2 0000FFFF
This code will replace the default halfword value at address 8011D2C2 with the value FFFF.
~~~
8 Bit RAM (Byte) Write
00XXXXXX 000000YY: The Y values overwrite the default byte value at memory address 80XXXXXX.
Example:
0077AB0F 00000003
This code will replace the default byte value at address 8077AB0F with the value 03.
~~~
16-bit If Equal Statements (Controller Lines)
Format of a 16-bit If Equal Statement
28XXXXXX YYYYZZZZ
The halfword value at memory address 80XXXXXX is compared to the halfword value in ZZZZ. If it is a match, the contents below this gecko codetype line are executed.
Most Wii cheat codes use the 16-bit If Equal Statement to make cheat codes that can be activated/deactivated depending on what button values of a certain controller are being pressed/held-down. When a 16-bit If Equal Statement is used for this purpose, it is called a 'controller line'.
These button values are always displayed as a halfword (16-bits) in memory (hence the usage of ZZZZ). They are usually located somewhere (maybe multiple times) in Static Memory. Since they are in Static Memory, there location will always be the same everytime said Wii game is booted/played.
Each button of each controller has it's own value and if multiple buttons are pressed at once, those values are essientally combined. The ZZZZ button values of a specific controller is the same regardless of what game is being played (i.e. ZZZZ values of Classic Controller is the same in both Mario Kart Wii and Super Smash Bros Brawl).
The location of the ZZZZ values will differ all depending on what Wii game you are on, what region of the game you are using, and what controller you are using. (i.e. ZZZZ value location for Classic Controller on MKWii is NOT the same location for GCN)
YYYY is a mask. Without getting into compilicated technical detail, you would set this value to 0000 if you are checking is a button value is pressed and NOTHING else is being pressed.
If you are checking if a button value is AT LEAST being pressed, you will need to do the following hex equation for YYYY--
YYYY = FFFF - ZZZZ
Use any hex calculator to produce the YYYY result.
You can find almost every contrller line combination for many Wii games, since most past Coders/Devs have already found them in memory and have posted the controller lines on multiple other Wii coding sites/archives.
Regarding Mario Kart Wii...
An entire thread listing all X and Z values can be found HERE. Remember that ZZZZ values are game-universal, they only differ depending on what controller is used.
A more in-depth tutorial on how to fill out the X, Y, and Z values can be found HERE.
Example (NTSC-U Mario Kart Wii, Classic Controller, L button, no Mask):
283414C2 00002000
~~~
Halfway & Final Terminators
When 16-bit If Equal Statements (controller lines) are used, the code needs to end in some sort of 'end-if'. End-if's are also called terminators. There are two types of terminators.
E0000000 00000000: The Halfway Terminator. It is placed after a code to allow a secondary controller line to be added afterwards for deactivation purposes.
E0000000 80008000: The Final Terminator: This is needed at the very end for most codes so multiple codes in a GCT file don't conflict.
Example:
28343E80 F77F0880 <-- Controller Line
040F4B4C 60000000 <-- Word RAM Write (nop)
E0000000 00000000 <-- Halfway Terminator
28343E80 EF7F1080 <-- 2nd Controller Line
040F4B4C 922F0000 <-- Word RAM Write
E0000000 80008000 <-- Final Terminator
A tutorial explaining how to add these terminators (plus controller lines) to make codes activate/deactivate at will can be found HERE.
~~~
Off/On Switch
CC000000 00000000: Off/On switch. It replaces the use of a Halfway Terminator + Second Controller Line to allow the same button to be used to both activate and deactivate a code.
Example:
28341462 FFEF0010
040F4B4C 60000000
CC000000 00000000 <-- Off/On Switch; Halfway Terminator and 2nd Controller line are removed
040F4B4C 922F0000
E0000000 80008000 <-- Final Terminator still needed
~~~
String Write
06XXXXXX 000000YY
ZZZZZZZZ ZZZZZZZZ
...
The XXXXXX is for memory address 80XXXXXX where the string write begins. YY designates how many bytes the string is in length. If the string length is not divisible by 8, then extra 0's are needed tobe added at the end of the string so the last row of the code is completed. However these extra 0's are NOT written to memory. Z values is the string contents.
Example
0600151C 00000018
60000000 380000FF
3B800000 3F808042
639C5BEC 7C630A14
60000000 is written at memory address 8000151C
380000FF is written at memory address 80001520
3B800000 is written at memory address 80001524
3F808042 is written at memory address 80001528
639C5BEC is written at memory address 8000152C
7C630A14 is written at memory address 80001530
~~~
Set Base Address
42000000 XXXXXXXX
...
E0000000 80008000
RAM & String Writes by default have a starting memory address of 80000000. You may run into a situation where you have a value in dynamic memory but it remains in the same spot every time the game is booted/played. Thus,you will need to adjust this starting memory adddress (know as the base address) to something else to be able to write to Dynamic Memory via a RAM or String Write.
The XXXXXXXX is to change the base address to something other than 80000000. At the end of any code using 'Set Base Address', you must end it with a Final Terminator.
Example:
42000000 90000000 <-- Change base address to 90000000
04230C00 60000000 <-- Word Write nop at address 90230C00
E0000000 80008000 <-- Clear/erase the changes to base address (final terminator) fyi: a halfway terminator applies an 'end-if' but doesn't clear/erase the base address.
~~~
Insert ASM
C2XXXXXX 000000YY: 'Insert ASM (Assembly)' code. At memory address 80XXXXXX a certain amount of code (placed underneath the first line) written in Assembly Language will be executed. The amount of lines underneath the 'C2' line designates the YY value (in hex). C2 Codes that have an even number for the YY value will always end with "60000000 00000000"
Example:
C2565088 00000002
38A00010 90BE0020
60000000 00000000
Insert ASM gecko codetype (C2) is by far the most useful codetype to make complex cheat codes, but you will need to learn Assembly to make these. Most Wii code users who want to learn how to become a Code Creator will simply stick to something such as RAM Writes and use the RAM Writes to abuse the application of nops and/or use random (literally random) compiled instructions not knowing at all what these compiled instructions actually do. This results in primitive/hacky codes and you will find many of these codes all over the internet.
If you want to learn how to become an actual Code Creator, read the following tutorials--
How to Make your own Cheat Codes -> https://mkwii.com/showthread.php?tid=830
Assembly Tutorial -> https://mkwii.com/showthread.php?tid=940
It's honestly not much work, just a small amount of time that will reward you will being able to make a much wider range of cheat codes. Good luck!
More examples (Using MKWii specific controller lines)
28348200 00001080 <-- PAL GCN Start button for Activation (if other buttons are not being pressed)
0074CBBF 00000000 <-- Byte RAM Write
E0000000 00000000 <-- Halfway Terminator to allow the use of a second controller line to deactivate
28348200 00000880 <-- PAL GCN Y button for De-Activation (if other buttons are not being pressed)
0074CBBF 00000001 <-- Byte RAM Write
E0000000 80008000 <-- Final Terminator
~~~
28341462 DFFF2000 <-- NTSC-U Minus Button for Activation (other buttons are allowed to also be pressed)
02383AF2 0000270F <-- Halfword RAM Write
CC000000 00000000 <-- Off/On Switch placed here to allow the user to also use the Minus Button for De-Activation
02383AF2 000038A0 <-- Halfword RAM Write
E0000000 80008000 <-- Final Terminator
~~~
28336200 FB7F0480 <-- NTSC-K GCN X button for Activation
C2009604 00000002 <-- Insert ASM code at Address 80009604
3BE01000 B3E00000 <-- Some ASM Contents
60000000 00000000 <-- YY value for ASM code is 02, therefore this line is here
E0000000 00000000 <-- Halfway Terminator
28336200 FF3F00C0 <-- NTSC-K L Button for De-Activation
04009604 B3E00000 <-- Word RAM Write
E0000000 80008000 <-- Final Terminator
So do I just need one line under the Execute ASM to have my C2 code work properly? Just to be sure. 