Welcome, Guest
You have to register before you can post on our site.

Username
  

Password
  





Search Forums

(Advanced Search)

Forum Statistics
» Members: 78
» Latest member: Zoot231
» Forum threads: 1,033
» Forum posts: 1,757

Full Statistics

Online Users
There are currently 37 online users.
» 0 Member(s) | 35 Guest(s)
Bing, Google

Latest Threads
Graphical SpeedBar
Forum: Cheat Codes
Last Post: Cameron_MKW
4 hours ago
» Replies: 3
» Views: 119
Graphical Speed/MTC/Air/B...
Forum: Cheat Codes
Last Post: zak
03-23-2019, 02:14 PM
» Replies: 0
» Views: 96
Graphical Speed-O-Meter
Forum: Cheat Codes
Last Post: zak
03-23-2019, 02:11 PM
» Replies: 0
» Views: 119
Universal Meter
Forum: Cheat Codes
Last Post: FancyWheelies
03-23-2019, 09:55 AM
» Replies: 4
» Views: 480
Mini Turbo Charge Meter
Forum: Cheat Codes
Last Post: zak
03-21-2019, 11:06 PM
» Replies: 0
» Views: 52
Using Mem81 to Auto-Clear...
Forum: Hacking General
Last Post: zak
03-18-2019, 02:45 AM
» Replies: 0
» Views: 63
Using the Exception Vecto...
Forum: Hacking General
Last Post: zak
03-18-2019, 02:31 AM
» Replies: 0
» Views: 79
Distance Meter; DBZ BT3
Forum: DBZ BT3
Last Post: zak
03-16-2019, 01:41 AM
» Replies: 0
» Views: 93
DWC_Authdata Spoofer; DBZ...
Forum: DBZ BT3
Last Post: zak
03-14-2019, 10:23 PM
» Replies: 0
» Views: 65
MAC Address Spoofer; DBZ ...
Forum: DBZ BT3
Last Post: zak
03-14-2019, 07:42 PM
» Replies: 0
» Views: 56

 
  Graphical SpeedBar
Posted by: zak - 03-23-2019, 02:16 PM - Forum: Cheat Codes - Replies (3)

Graphical SpeedBar

Shout outs to Star & RiiDefi for Draw Text To Screen Code!

This code will output your vehicle speed view a graphical image depicting an interactive bar. The bar length will vary depending on your vehicle speed. The bar works in an exponential manner, NOT linear. The higher the speeds, the more the bar will change depending on differences at the higher speeds.

NOTE: This code makes use of the following memory addresses...
0x80001660 thru 0x80001689
0x815F0000 thru 0x815F0003

Make sure no other codes in your GCT/Cheat-Manager are using those addresses!

NTSC-U
06001670 00000010
25336420 6B6D2F68
0A000000 00000000
C200A3F0 00000007
9421FF80 BC610008
806DA358 80630044
80630000 3D808002
618C23E0 7D8803A6
4E800021 B8610008
38210080 80010014
60000000 00000000
C2009640 00000016
3D80815F 818C0000
2C0C0000 4182009C
9421FF80 BC610008
3D808000 816C1660
C1AB0024 FDA06A10
FDA0681C D9AC1664
806C1668 7C671B78
7C6319D6 38800370
7C6323D6 3BA00000
2C030000 41820020
39E0007C 61901678
9DF00001 3463FFFF
4082FFF8 9BB00001
48000008 9BAC1679
38600009 388000D0
38A00001 61861670
3D808002 618C1DF0
7D8803A6 4E800021
3D808002 618C1DD0
7D8803A6 4E800021
B8610008 38210080
81830000 00000000
C27E4C9C 00000007
3D80809C 818CD110
818C0020 1D600004
7D8C5A14 818C0000
818C0010 818C0010
3D608000 918B1660
3D80815F 93EC0000
807FEE20 00000000

PAL
06001670 00000010
25336420 6B6D2F68
0A000000 00000000
C200A430 00000007
9421FF80 BC610008
806DA360 80630044
80630000 3D808002
618C2480 7D8803A6
4E800021 B8610008
38210080 80010014
60000000 00000000
C2009680 00000016
3D80815F 818C0000
2C0C0000 4182009C
9421FF80 BC610008
3D808000 816C1660
C1AB0024 FDA06A10
FDA0681C D9AC1664
806C1668 7C671B78
7C6319D6 38800370
7C6323D6 3BA00000
2C030000 41820020
39E0007C 61901678
9DF00001 3463FFFF
4082FFF8 9BB00001
48000008 9BAC1679
38600009 388000D0
38A00001 61861670
3D808002 618C1E90
7D8803A6 4E800021
3D808002 618C1E70
7D8803A6 4E800021
B8610008 38210080
81830000 00000000
C27EEFAC 00000007
3D80809C 818C18F8
818C0020 1D600004
7D8C5A14 818C0000
818C0010 818C0010
3D608000 918B1660
3D80815F 93EC0000
807F3618 00000000

NTSC-J
06001670 00000010
25336420 6B6D2F68
0A000000 00000000
C200A38C 00000007
9421FF80 BC610008
806DA360 80630044
80630000 3D808002
618C23A0 7D8803A6
4E800021 B8610008
38210080 80010014
60000000 00000000
C20095DC 00000016
3D80815F 818C0000
2C0C0000 4182009C
9421FF80 BC610008
3D808000 816C1660
C1AB0024 FDA06A10
FDA0681C D9AC1664
806C1668 7C671B78
7C6319D6 38800370
7C6323D6 3BA00000
2C030000 41820020
39E0007C 61901678
9DF00001 3463FFFF
4082FFF8 9BB00001
48000008 9BAC1679
38600009 388000D0
38A00001 61861670
3D808002 618C1DB0
7D8803A6 4E800021
3D808002 618C1D90
7D8803A6 4E800021
B8610008 38210080
81830000 00000000
C27EE618 00000007
3D80809C 818C0958
818C0020 1D600004
7D8C5A14 818C0000
818C0010 818C0010
3D608000 918B1660
3D80815F 93EC0000
807F2678 00000000

NTSC-K
06001670 00000010
25336420 6B6D2F68
0A000000 00000000
C200A538 00000007
9421FF80 BC610008
806DA380 80630044
80630000 3D808002
618C24E0 7D8803A6
4E800021 B8610008
38210080 80010014
60000000 00000000
C2009788 00000016
3D80815F 818C0000
2C0C0000 4182009C
9421FF80 BC610008
3D808000 816C1660
C1AB0024 FDA06A10
FDA0681C D9AC1664
806C1668 7C671B78
7C6319D6 38800370
7C6323D6 3BA00000
2C030000 41820020
39E0007C 61901678
9DF00001 3463FFFF
4082FFF8 9BB00001
48000008 9BAC1679
38600009 388000D0
38A00001 61861670
3D808002 618C1EF0
7D8803A6 4E800021
3D808002 618C1ED0
7D8803A6 4E800021
B8610008 38210080
81830000 00000000
C27DD36C 00000007
3D80809B 818CFF38
818C0020 1D600004
7D8C5A14 818C0000
818C0010 818C0010
3D608000 918B1660
3D80815F 93EC0000
807F1C58 00000000



List of Sources:
1st ASM (When Game loads StaticR.rel, Get Render Mode & Call Direct Print Setup Frame Buffer)

#~~~~~~~~~~~~~~~~#
# START ASSEMBLY #
#~~~~~~~~~~~~~~~~#

#

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Register Notes: #
# No need to backup r0 or LR #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~#
# Macros & Statements #
#~~~~~~~~~~~~~~~~~~~~~#

.macro push_stack
stwu r1, -0x80 (r1)
stmw r3, 0x8 (r1)
.endm

.macro pop_stack
lmw r3, 0x8 (r1)
addi r1, r1, 0x80
.endm

.macro call_link address
lis r12, \address@h
ori r12, r12, \address@l
mtlr r12
blrl
.endm

.macro default_instruction
lwz r0, 0x0014 (r1)
.endm

.set region, '' #Must set region value, or else source will not compile

.if (region == 'E' || region == 'e') # RMCE
.set nw4r_db_DirectPrint_SetupFB, 0x800223E0
.elseif (region == 'P' || region == 'p') # RMCP
.set nw4r_db_DirectPrint_SetupFB, 0x80022480
.elseif (region == 'J' || region == 'j') # RMCJ
.set nw4r_db_DirectPrint_SetupFB, 0x800223A0
.elseif (region == 'K' || region == 'k') # RMCK
.set nw4r_db_DirectPrint_SetupFB, 0x800224E0
.else # Invalid Region
.abort
.endif

#~~~~~~~~~~~~~~~~~~~~~~~#
# Start Register Safety #
#~~~~~~~~~~~~~~~~~~~~~~~#

push_stack

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Get Render Mode (RKSystem->mpVideo()->pRenderMode) #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

.if (region == 'E' || region == 'e') # RMCE
lwz r3, -0x5CA8(r13)
.elseif (region == 'P' || region == 'p') # RMCP
lwz r3, -0x5CA0(r13)
.elseif (region == 'J' || region == 'j') # RMCJ
lwz r3, -0x5CA0(r13)
.elseif (region == 'K' || region == 'k') # RMCK
lwz r3, -0x5C80(r13)
.endif

lwz r3, 0x0044(r3)
lwz r3, 0x0 (r3)

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Call nw4r::db: DirectPrint_SetupFB #
# r3 = Render Mode #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

call_link nw4r_db_DirectPrint_SetupFB

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# End Register Safety; Default Instruction #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

pop_stack
default_instruction

#

#~~~~~~~~~~~~~~#
# END ASSEMBLY #
#~~~~~~~~~~~~~~#

==========

2nd ASM (Convert Speed Float, Calc Bar Length, Write Bar Amtn to Gecko ASCii String, Draw it to Screen)

#~~~~~~~~~~~~~~~~#
# START ASSEMBLY #
#~~~~~~~~~~~~~~~~#

#

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Register Notes: #
# No need to backup r0 or LR #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Mem Address Notes: #
# 0x80001660 Speed Float Word #
# 0x80001664 Converted Hex 1st Word of Double Word Float #
# 0x80001668 Converted Hex 2nd Word of Double Word Float (Speed in Hex) #
# 0x80001670 Gecko String ASCii, r6 Arg for Direct Print #
# 0x80001678= 0x0A ASCii byte for Entering into new Line for Speed Bar #
# 0x80001679 = Start of Bar #
# 0x80001688 = Last Bar byte at its highest amount possible #
# 0x80001689 = Last Null of Bar byte string at its highest amount possible #
# 0x815F0000 "Status Word" If not zero, Draw Code will execute, auto clears after every race #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~#
# Macros & Statements #
#~~~~~~~~~~~~~~~~~~~~~#

.macro push_stack
stwu r1, -0x80 (r1)
stmw r3, 0x8 (r1)
.endm

.macro pop_stack
lmw r3, 0x8 (r1)
addi r1, r1, 0x80
.endm

.macro call_link address
lis r12, \address@h
ori r12, r12, \address@l
mtlr r12
blrl
.endm

.macro default_instruction
lwz r12, 0x0 (r3)
.endm

.set region, '' #Must set region value, or else source will not compile

.if (region == 'E' || region == 'e') # RMCE
.set nw4r_db_DirectPrint_Printf, 0x80021DF0
.set nw4r_db_DirectPrint_StoreCache, 0x80021DD0
.elseif (region == 'P' || region == 'p') # RMCP
.set nw4r_db_DirectPrint_Printf, 0x80021E90
.set nw4r_db_DirectPrint_StoreCache, 0x80021E70
.elseif (region == 'J' || region == 'j') # RMCJ
.set nw4r_db_DirectPrint_Printf, 0x80021DB0
.set nw4r_db_DirectPrint_StoreCache, 0x80021D90
.elseif (region == 'K' || region == 'k') # RMCK
.set nw4r_db_DirectPrint_Printf, 0x80021EF0
.set nw4r_db_DirectPrint_StoreCache, 0x80021ED0
.else # Invalid Region
.abort
.endif

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Check to See if a Race is Active: #
# Load Status Word from Mem 81 #
# If not zero, we know to execute the Draw Code #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

lis r12, 0x815F
lwz r12, 0x0 (r12)
cmpwi r12, 0x0
beq- dont_execute

#~~~~~~~~~~~~~~~~~~~~~~~#
# Start Register Safety #
#~~~~~~~~~~~~~~~~~~~~~~~#

push_stack

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Pointer Load, Float Load, Conversion, Storage #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

lis r12, 0x8000 #Set 1st Half Address of Exception Vector Area
lwz r11, 0x1660 (r12) #Load Pointer
lfs f13, 0x0024 (r11) #Load the Speed Float from the Pointer
fabs f13, f13 #Convert Float to handle negative values approriately; aka fix Reverse Speed reading
fctiw f13, f13 #Convert Float to Word Integer, use Standard Rounding; aka fix Funky Kong 96/97 issue
stfd f13, 0x1664 (r12) #Store the whole converted float to 0x80001664 (using this instead of a li then stfiwx will save us one instruction total)

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Calculate Bar Amount to Write to Memory #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

lwz r3, 0x1668 (r12) #Load Vehicle Hex Speed Amnt into r3

mr r7, r3 #Copy hex value to r7 for DirectPrintf's 1st format Arg

mullw r3, r3, r3 #Raise Vehicle Hex Speed to the Power of 2

li r4, 0x370 #Load 0x370 into r4 for upcoming divw instruction
divw r3, r3, r4 #Divide Vehicle Hex Speed by 0x370

li r29, 0x0 #Clear out r29 for Bar End or else Bar will never decrease when speed decreases

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Check if Bar Amnt is Zero. If so, we don't need to Write the Bar, skip upcoming Loop #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

cmpwi r3, 0x0
beq- skip_loop

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Set ASCii Symbol (divider), Setup Loop Store Address #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

li r15, 0x7C
ori r16, r12, 0x1678

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Loop #
# Write Approriate Bar Amount Based on finalized Hex Speed Amnt #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

the_loop:
stbu r15, 0x1 (r16)
subic. r3, r3, 1
bne+ the_loop

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Store NULL (Bar End) after last Byte of Bar #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

stb r29, 0x1 (r16)
b draw_toscreen

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Store NULL to what would be first Bar Byte #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

skip_loop:
stb r29, 0x1679 (r12)

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# DirectPrint Printf & Store Cache #
# Purpose: Draw on Screen #
# r3 = X coordinate (starts far left) #
# r4 = Y coordinate (starts at very top) #
# r5 = 0 No Wrap; 1 Wrap #
# r6 = Address Pointer to String that will be Drawn on Screen #
# r7 thru r10 printf format args #
# f1 thru f13 printf float format args #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

draw_toscreen:
li r3, 0x9
li r4, 0xD0
li r5, 0x1
ori r6, r12, 0x1670 #Gecko String Write Address

call_link nw4r_db_DirectPrint_Printf #r7 already set from earlier
call_link nw4r_db_DirectPrint_StoreCache

#~~~~~~~~~~~~~~~~~~~~~#
# End Register Safety #
#~~~~~~~~~~~~~~~~~~~~~#

no_go:
pop_stack

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# dont_execute label; Default Instruction #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

dont_execute:
default_instruction

#

#~~~~~~~~~~~~~~#
# END ASSEMBLY #
#~~~~~~~~~~~~~~#

==========

3rd ASM (Store Memory Pointer)
#~~~~~~~~~~~~~~~~#
# START ASSEMBLY #
#~~~~~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~#
# Macros & Statements #
#~~~~~~~~~~~~~~~~~~~~~#

.set region, '' #Must set region value, or else source will not compile

.if (region == 'E' || region == 'e') # RMCE
.macro default_instruction
lwz r3, -0x11E0 (r31)
.endm
.macro set_playerbase
lis r12, 0x809C
lwz r12, 0xFFFFD110 (r12)
.endm
.elseif (region == 'P' || region == 'p') # RMCP
.macro default_instruction
lwz r3, 0x3618 (r31)
.endm
.macro set_playerbase
lis r12, 0x809C
lwz r12, 0x18F8 (f12)
.endm
.elseif (region == 'J' || region == 'j') # RMCJ
.macro default_instruction
lwz r3, 0x2678 (r31)
.endm
.macro set_playerbase
lis r12, 0x809C
lwz r12, 0x0958 (r12)
.endm
.elseif (region == 'K' || region == 'k') # RMCK
.macro default_instruction
lwz r3, 0x1C58 (r31)
.endm
.macro set_playerbase
lis r12, 0x809B
lwz r12, 0xFFFFFF38 (r12)
.endm
.else # Invalid Region
.abort
.endif

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Set Region-Specific Player-Base #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

set_playerbase

#~~~~~~~~~~~~~~~~~~~~~~~#
# Pointer Level Loading #
#~~~~~~~~~~~~~~~~~~~~~~~#

lwz r12, 0x0020 (r12) #Load Word from 1st Level Pointer

mulli r11, r0, 0x4 #Multiply r0 by 0x4, store result in r11
add r12, r12, r11 #Add r11 and r12 together, result back into r12

lwz r12, 0 (r12) #Load into 2nd Level Pointer
lwz r12, 0x0010(r12) #Load into 3rd Level Pointer
lwz r12, 0x0010(r12) #Load into 4th Level Pointer

#~~~~~~~~~~~~~~~~~~~~~#
# Store Final Pointer #
#~~~~~~~~~~~~~~~~~~~~~#

lis r11, 0x8000 #Set up 1st Half Address of Exception Vector Area
stw r12, 0x1660 (r11) #Store Pointer Address to 0x80001660

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Set Status Word in Mem81 for Draw Text ASM #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

lis r12, 0x815F #Set up 1st Half Address of dynmaic Mem81
stw r31, 0x0 (r12) #Store r31 to 0x815F0000, we simply need a value not zero to be stored here. This will make the Speed Bar ASM only trigger during races.

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Default Instruction; Region-Specific #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

default_instruction

#

#~~~~~~~~~~~~~~#
# END ASSEMBLY #
#~~~~~~~~~~~~~~#



Code creator: zak
Code credits: Star & RiiDefi (Draw Text To Screen Code); SwareJonge (Speed-O-Meter); Chadderz (source fixes to Mdmwii's OG Speed source), Mdmwii (original Speed-O-Meter)

Print this item

  Graphical Speed/MTC/Air/Boost Meter
Posted by: zak - 03-23-2019, 02:14 PM - Forum: Cheat Codes - No Replies

Graphical Speed/MTC/Air/Boost Meter

Shout outs to Star & RiiDefi for Draw Text To Screen Code!

This code will display your vehicle speed, air time, mini turbo charge, and shroom/zipper boost as its own graphical image at the bottom of your screen only during the race/battle. The image will not appear if you are not in a race/battle. Works everywhere.

NOTE: This code makes use of the following memory addresses...
0x80001660 thru 0x80001693
0x815F0000 thru 0x815F0003

Make sure no other codes in your GCT/Cheat-Manager are using those addresses.

NTSC-U
C200A3F0 00000007
9421FF80 BC610008
806DA358 80630044
80630000 3D808002
618C23E0 7D8803A6
4E800021 B8610008
38210080 80010014
60000000 00000000
C2009640 00000017
3D80815F 818C0000
2C0C0000 418200A4
9421FF70 D8210008
BC610010 3D808000
816C1660 C02B0024
FC200A10 4CC63242
A10B021A A12B0110
A0EB0100 2C070000
40820008 A0EB00FE
4800002D 25332E30
66206B6D 2F682C20
25336420 4D54432C
20253364 20416972
2C202533 64204273
74000000 7CC802A6
38600009 388000DC
38A00001 3D808002
618C1DF0 7D8803A6
4E800021 3D808002
618C1DD0 7D8803A6
4E800021 B8610010
C8210008 38210090
81830000 00000000
C27E4C9C 00000007
3D80809C 818CD110
818C0020 1D600004
7D8C5A14 818C0000
818C0010 818C0010
3D608000 918B1660
3D80815F 93EC0000
807FEE20 00000000

PAL
C200A430 00000007
9421FF80 BC610008
806DA360 80630044
80630000 3D808002
618C2480 7D8803A6
4E800021 B8610008
38210080 80010014
60000000 00000000
C2009680 00000017
3D80815F 818C0000
2C0C0000 418200A4
9421FF70 D8210008
BC610010 3D808000
816C1660 C02B0024
FC200A10 4CC63242
A10B021A A12B0110
A0EB0100 2C070000
40820008 A0EB00FE
4800002D 25332E30
66206B6D 2F682C20
25336420 4D54432C
20253364 20416972
2C202533 64204273
74000000 7CC802A6
38600009 388000DC
38A00001 3D808002
618C1E90 7D8803A6
4E800021 3D808002
618C1E70 7D8803A6
4E800021 B8610010
C8210008 38210090
81830000 00000000
C27EEFAC 00000007
3D80809C 818C18F8
818C0020 1D600004
7D8C5A14 818C0000
818C0010 818C0010
3D608000 918B1660
3D80815F 93EC0000
807F3618 00000000

NTSC-J
C200A38C 00000007
9421FF80 BC610008
806DA360 80630044
80630000 3D808002
618C23A0 7D8803A6
4E800021 B8610008
38210080 80010014
60000000 00000000
C20095DC 00000017
3D80815F 818C0000
2C0C0000 418200A4
9421FF70 D8210008
BC610010 3D808000
816C1660 C02B0024
FC200A10 4CC63242
A10B021A A12B0110
A0EB0100 2C070000
40820008 A0EB00FE
4800002D 25332E30
66206B6D 2F682C20
25336420 4D54432C
20253364 20416972
2C202533 64204273
74000000 7CC802A6
38600009 388000DC
38A00001 3D808002
618C1DB0 7D8803A6
4E800021 3D808002
618C1D90 7D8803A6
4E800021 B8610010
C8210008 38210090
81830000 00000000
C27EE618 00000007
3D80809C 818C0958
818C0020 1D600004
7D8C5A14 818C0000
818C0010 818C0010
3D608000 918B1660
3D80815F 93EC0000
807F2678 00000000

NTSC-K
C200A538 00000007
9421FF80 BC610008
806DA380 80630044
80630000 3D808002
618C24E0 7D8803A6
4E800021 B8610008
38210080 80010014
60000000 00000000
C2009788 00000017
3D80815F 818C0000
2C0C0000 418200A4
9421FF70 D8210008
BC610010 3D808000
816C1660 C02B0024
FC200A10 4CC63242
A10B021A A12B0110
A0EB0100 2C070000
40820008 A0EB00FE
4800002D 25332E30
66206B6D 2F682C20
25336420 4D54432C
20253364 20416972
2C202533 64204273
74000000 7CC802A6
38600009 388000DC
38A00001 3D808002
618C1EF0 7D8803A6
4E800021 3D808002
618C1ED0 7D8803A6
4E800021 B8610010
C8210008 38210090
81830000 00000000
C27DD36C 00000007
3D80809B 818CFF38
818C0020 1D600004
7D8C5A14 818C0000
818C0010 818C0010
3D608000 918B1660
3D80815F 93EC0000
807F1C58 00000000



List of Sources:
1st ASM (When Game loads StaticR.rel, Get Render Mode & Call Direct Print Setup Frame Buffer)

#~~~~~~~~~~~~~~~~#
# START ASSEMBLY #
#~~~~~~~~~~~~~~~~#

#

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
#       Register Notes:      #
# No need to backup r0 or LR #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~#
# Macros & Statements #
#~~~~~~~~~~~~~~~~~~~~~#

.macro push_stack
stwu r1, -0x80 (r1)
stmw r3, 0x8 (r1)
.endm

.macro pop_stack
lmw r3, 0x8 (r1)
addi r1, r1, 0x80
.endm

.macro call_link address
lis r12, \address@h
ori r12, r12, \address@l
mtlr r12
blrl
.endm

.macro default_instruction
lwz r0, 0x0014 (r1)
.endm

.set region, '' #Must set region value, or else source will not compile

.if (region == 'E' || region == 'e') # RMCE
.set nw4r_db_DirectPrint_SetupFB, 0x800223E0
.elseif (region == 'P' || region == 'p') # RMCP
.set nw4r_db_DirectPrint_SetupFB, 0x80022480
.elseif (region == 'J' || region == 'j') # RMCJ
.set nw4r_db_DirectPrint_SetupFB, 0x800223A0
.elseif (region == 'K' || region == 'k') # RMCK
.set nw4r_db_DirectPrint_SetupFB, 0x800224E0
.else # Invalid Region
.abort
.endif

#~~~~~~~~~~~~~~~~~~~~~~~#
# Start Register Safety #
#~~~~~~~~~~~~~~~~~~~~~~~#

push_stack

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Get Render Mode (RKSystem->mpVideo()->pRenderMode) #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

.if (region == 'E' || region == 'e') # RMCE
lwz r3, -0x5CA8(r13)
.elseif (region == 'P' || region == 'p') # RMCP
lwz r3, -0x5CA0(r13)
.elseif (region == 'J' || region == 'j') # RMCJ
lwz r3, -0x5CA0(r13)
.elseif (region == 'K' || region == 'k') # RMCK
lwz r3, -0x5C80(r13)
.endif

lwz r3, 0x0044(r3)
lwz r3, 0x0 (r3)

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Call nw4r::db: DirectPrint_SetupFB #
#         r3 = Render Mode           #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

call_link nw4r_db_DirectPrint_SetupFB

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# End Register Safety; Default Instruction #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

pop_stack
default_instruction

#

#~~~~~~~~~~~~~~#
# END ASSEMBLY #
#~~~~~~~~~~~~~~#

==========

2nd ASM (Take Float Speed, Convert It, Draw it to Screen)

#~~~~~~~~~~~~~~~~#
# START ASSEMBLY #
#~~~~~~~~~~~~~~~~#

#

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
#       Register Notes:      #
# No need to backup r0 or LR #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
#                                  Mem Address Notes:                                        #
#                             0x80001660 Speed Float Word                                    #
# 0x815F0000 "Status Word" If not zero, Draw Code will execute, auto clears after every race #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~#
# Macros & Statements #
#~~~~~~~~~~~~~~~~~~~~~#

.macro push_stack
stwu r1, -0x90 (r1)
stfd f1, 0x8 (r1)
stmw r3, 0x10 (r1)
.endm

.macro pop_stack
lmw r3, 0x10 (r1)
lfd f1, 0x8 (r1)
addi r1, r1, 0x90
.endm

.macro call_link address
lis r12, \address@h
ori r12, r12, \address@l
mtlr r12
blrl
.endm

.macro default_instruction
lwz r12, 0x0 (r3)
.endm

.set region, '' #Must set region value, or else source will not compile

.if (region == 'E' || region == 'e') # RMCE
.set nw4r_db_DirectPrint_Printf, 0x80021DF0
.set nw4r_db_DirectPrint_StoreCache, 0x80021DD0
.elseif (region == 'P' || region == 'p') # RMCP
.set nw4r_db_DirectPrint_Printf, 0x80021E90
.set nw4r_db_DirectPrint_StoreCache, 0x80021E70
.elseif (region == 'J' || region == 'j') # RMCJ
.set nw4r_db_DirectPrint_Printf, 0x80021DB0
.set nw4r_db_DirectPrint_StoreCache, 0x80021D90
.elseif (region == 'K' || region == 'k') # RMCK
.set nw4r_db_DirectPrint_Printf, 0x80021EF0
.set nw4r_db_DirectPrint_StoreCache, 0x80021ED0
.else # Invalid Region
.abort
.endif

.set _speed, 0x24 #Speed Float
.set _mtc, 0xFE #MT Charge
.set _omtc, 0x100 #Kart Only Orange MT Charge
.set _mushb, 0x110 #Mushroom Boost
.set _air, 0x21A #Air Time

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
#       Check to See if a Race is Active:       #
#         Load Status Word from Mem 81          #
# If not zero, we know to execute the Draw Code #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

lis r12, 0x815F
lwz r12, 0x0 (r12)
cmpwi r12, 0x0
beq- dont_execute

#~~~~~~~~~~~~~~~~~~~~~~~#
# Start Register Safety #
#~~~~~~~~~~~~~~~~~~~~~~~#

push_stack

#~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Load Pointer, Load Float #
#~~~~~~~~~~~~~~~~~~~~~~~~~~#

lis r12, 0x8000 #Set 1st half address of Exception Vector Area
lwz r11, 0x1660 (r12) #Load the Pointer
lfs f1, _speed (r11) #Load the Single Float into FPR 1 for first float format arg of DirectPrint Printf
fabs f1, f1 #Handle negative values
crset 4*cr1+eq #Set the Condition Register before the Float Arg is used in DirectPrint Printf

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Load MTC, Air, MTB into appropriate DirectPrintf registers #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

lhz r8, _air (r11) #Set 2nd GPR format arg
lhz r9, _mushb (r11) #Set 3rd GPR format arg

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Load MT, do Orange MT Check Calc #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

lhz r7, _omtc (r11) #First Load the Orange MT value
cmpwi r7, 0x0
bne- skip_blue #If not zero, we don't need to read Blue MT, follow skip_blue branch

lhz r7, _mtc (r11) #If zero, read Blue MT instead of Orange MT

skip_blue: #1st GPR format arg is set

#~~~~~~~~~~~~~~~~~~~~~#
# Create ASCii String #
#~~~~~~~~~~~~~~~~~~~~~#

bl the_string #Create the C++ string

.llong 0x25332E3066206B6D #Hex for "%3.0f km/h, %3d MTC, %3d Air, %3d Bst"
.llong 0x2F682C2025336420
.llong 0x4D54432C20253364
.llong 0x204169722C202533
.llong 0x6420427374000000

the_string:
mflr r6 #Move C++ string's address location to r4, r5 thru r8 arguments already set

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
#              DirectPrint Printf & Store Cache               #
#                 Purpose: Draw on Screen                     #
#             r3 = X coordinate (starts far left)             #
#           r4 = Y coordinate (starts at very top)            #
#                 r5 = 0 No Wrap; 1 Wrap                      #
# r6 = Address Pointer to String that will be Drawn on Screen #
#               r7 thru r10 printf format args                #
#            f1 thru f13 printf float format args             #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

li r3, 0x9
li r4, 0xDC
li r5, 0x1

call_link nw4r_db_DirectPrint_Printf
call_link nw4r_db_DirectPrint_StoreCache

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# no_go label; End Register Safety #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

no_go:
pop_stack

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# dont_execute label; Default Instruction #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

dont_execute:
default_instruction

#

#~~~~~~~~~~~~~~#
# END ASSEMBLY #
#~~~~~~~~~~~~~~#

==========

3rd ASM (Store Memory Pointer)
#~~~~~~~~~~~~~~~~#
# START ASSEMBLY #
#~~~~~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~#
# Macros & Statements #
#~~~~~~~~~~~~~~~~~~~~~#

.set region, '' #Must set region value, or else source will not compile

.if (region == 'E' || region == 'e') # RMCE
.macro default_instruction
lwz r3, -0x11E0 (r31)
.endm
.macro set_playerbase
lis r12, 0x809C
lwz r12, 0xFFFFD110 (r12)
.endm
.elseif (region == 'P' || region == 'p') # RMCP
.macro default_instruction
lwz r3, 0x3618 (r31)
.endm
.macro set_playerbase
lis r12, 0x809C
lwz r12, 0x18F8 (f12)
.endm
.elseif (region == 'J' || region == 'j') # RMCJ
.macro default_instruction
lwz r3, 0x2678 (r31)
.endm
.macro set_playerbase
lis r12, 0x809C
lwz r12, 0x0958 (r12)
.endm
.elseif (region == 'K' || region == 'k') # RMCK
.macro default_instruction
lwz r3, 0x1C58 (r31)
.endm
.macro set_playerbase
lis r12, 0x809B
lwz r12, 0xFFFFFF38 (r12)
.endm
.else # Invalid Region
.abort
.endif

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Set Region-Specific Player-Base #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

set_playerbase

#~~~~~~~~~~~~~~~~~~~~~~~#
# Pointer Level Loading #
#~~~~~~~~~~~~~~~~~~~~~~~#

lwz r12, 0x0020 (r12) #Load Word from 1st Level Pointer

mulli r11, r0, 0x4 #Multiply r0 by 0x4, store result in r11
add r12, r12, r11 #Add r11 and r12 together, result back into r12

lwz r12, 0 (r12) #Load into 2nd Level Pointer
lwz r12, 0x0010(r12) #Load into 3rd Level Pointer
lwz r12, 0x0010(r12) #Load into 4th Level Pointer

#~~~~~~~~~~~~~~~~~~~~~#
# Store Final Pointer #
#~~~~~~~~~~~~~~~~~~~~~#

lis r11, 0x8000 #Set up 1st Half Address of Exception Vector Area
stw r12, 0x1660 (r11) #Store Pointer Address to 0x80001660

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Set Status Word in Mem81 for Draw Text ASM #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

lis r12, 0x815F #Set up 1st Half Address of dynmaic Mem81
stw r31, 0x0 (r12) #Store r31 to 0x815F0000, we simply need a value not zero to be stored here. This will make the Speed Bar ASM only trigger during races.

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Default Instruction; Region-Specific #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

default_instruction

#

#~~~~~~~~~~~~~~#
# END ASSEMBLY #
#~~~~~~~~~~~~~~#



Code creator: zak
Code credits: Star & RiiDefi (Draw Text To Screen Code); SwareJonge (Speed-O-Meter); Chadderz (source fixes to Mdmwii's OG Speed source); Mdmwii (original Speed-O-Meter)

Print this item

  Graphical Speed-O-Meter
Posted by: zak - 03-23-2019, 02:11 PM - Forum: Cheat Codes - No Replies

Graphical Speed-O-Meter

Shout outs to Star & RiiDefi for Draw Text To Screen Code!

This code will display your vehicle speed as its own graphical image on the bottom left of your screen only during the race/battle. The image will not appear if you are not in a race/battle. Works everywhere.

NOTE: This code makes use of the following memory addresses...
0x80001660 thru 0x8000167C
0x815F0000 thru 0x815F0003

Make sure no other codes in your GCT/Cheat-Manager are using those addresses.

NTSC-U
C200A3F0 00000007
9421FF80 BC610008
806DA358 80630044
80630000 3D808002
618C23E0 7D8803A6
4E800021 B8610008
38210080 80010014
60000000 00000000
C2009640 00000011
3D80815F 818C0000
2C0C0000 41820070
9421FF70 D8210008
BC610010 3D808000
816C1660 C02B0024
FC200A10 4CC63242
48000011 25332E30
66206B6D 2F680000
7CC802A6 38600009
388000DC 38A00001
3D808002 618C1DF0
7D8803A6 4E800021
3D808002 618C1DD0
7D8803A6 4E800021
B8610010 C8210008
38210090 81830000
60000000 00000000
C27E4C9C 00000007
3D80809C 818CD110
818C0020 1D600004
7D8C5A14 818C0000
818C0010 818C0010
3D608000 918B1660
3D80815F 93EC0000
807FEE20 00000000

PAL
C200A430 00000007
9421FF80 BC610008
806DA360 80630044
80630000 3D808002
618C2480 7D8803A6
4E800021 B8610008
38210080 80010014
60000000 00000000
C2009680 00000011
3D80815F 818C0000
2C0C0000 41820070
9421FF70 D8210008
BC610010 3D808000
816C1660 C02B0024
FC200A10 4CC63242
48000011 25332E30
66206B6D 2F680000
7CC802A6 38600009
388000DC 38A00001
3D808002 618C1E90
7D8803A6 4E800021
3D808002 618C1E70
7D8803A6 4E800021
B8610010 C8210008
38210090 81830000
60000000 00000000
C27EEFAC 00000007
3D80809C 818C18F8
818C0020 1D600004
7D8C5A14 818C0000
818C0010 818C0010
3D608000 918B1660
3D80815F 93EC0000
807F3618 00000000

NTSC-J
C200A38C 00000007
9421FF80 BC610008
806DA360 80630044
80630000 3D808002
618C23A0 7D8803A6
4E800021 B8610008
38210080 80010014
60000000 00000000
C20095DC 00000011
3D80815F 818C0000
2C0C0000 41820070
9421FF70 D8210008
BC610010 3D808000
816C1660 C02B0024
FC200A10 4CC63242
48000011 25332E30
66206B6D 2F680000
7CC802A6 38600009
388000DC 38A00001
3D808002 618C1DB0
7D8803A6 4E800021
3D808002 618C1D90
7D8803A6 4E800021
B8610010 C8210008
38210090 81830000
60000000 00000000
C27EE618 00000007
3D80809C 818C0958
818C0020 1D600004
7D8C5A14 818C0000
818C0010 818C0010
3D608000 918B1660
3D80815F 93EC0000
807F2678 00000000

NTSC-K
C200A538 00000007
9421FF80 BC610008
806DA380 80630044
80630000 3D808002
618C24E0 7D8803A6
4E800021 B8610008
38210080 80010014
60000000 00000000
C2009788 00000011
3D80815F 818C0000
2C0C0000 41820070
9421FF70 D8210008
BC610010 3D808000
816C1660 C02B0024
FC200A10 4CC63242
48000011 25332E30
66206B6D 2F680000
7CC802A6 38600009
388000DC 38A00001
3D808002 618C1EF0
7D8803A6 4E800021
3D808002 618C1ED0
7D8803A6 4E800021
B8610010 C8210008
38210090 81830000
60000000 00000000
C27DD36C 00000007
3D80809B 818CFF38
818C0020 1D600004
7D8C5A14 818C0000
818C0010 818C0010
3D608000 918B1660
3D80815F 93EC0000
807F1C58 00000000



List of Sources:
1st ASM (When Game loads StaticR.rel, Get Render Mode & Call Direct Print Setup Frame Buffer)

#~~~~~~~~~~~~~~~~#
# START ASSEMBLY #
#~~~~~~~~~~~~~~~~#

#

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Register Notes: #
# No need to backup r0 or LR #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~#
# Macros & Statements #
#~~~~~~~~~~~~~~~~~~~~~#

.macro push_stack
stwu r1, -0x80 (r1)
stmw r3, 0x8 (r1)
.endm

.macro pop_stack
lmw r3, 0x8 (r1)
addi r1, r1, 0x80
.endm

.macro call_link address
lis r12, \address@h
ori r12, r12, \address@l
mtlr r12
blrl
.endm

.macro default_instruction
lwz r0, 0x0014 (r1)
.endm

.set region, '' #Must set region value, or else source will not compile

.if (region == 'E' || region == 'e') # RMCE
.set nw4r_db_DirectPrint_SetupFB, 0x800223E0
.elseif (region == 'P' || region == 'p') # RMCP
.set nw4r_db_DirectPrint_SetupFB, 0x80022480
.elseif (region == 'J' || region == 'j') # RMCJ
.set nw4r_db_DirectPrint_SetupFB, 0x800223A0
.elseif (region == 'K' || region == 'k') # RMCK
.set nw4r_db_DirectPrint_SetupFB, 0x800224E0
.else # Invalid Region
.abort
.endif

#~~~~~~~~~~~~~~~~~~~~~~~#
# Start Register Safety #
#~~~~~~~~~~~~~~~~~~~~~~~#

push_stack

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Get Render Mode (RKSystem->mpVideo()->pRenderMode) #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

.if (region == 'E' || region == 'e') # RMCE
lwz r3, -0x5CA8(r13)
.elseif (region == 'P' || region == 'p') # RMCP
lwz r3, -0x5CA0(r13)
.elseif (region == 'J' || region == 'j') # RMCJ
lwz r3, -0x5CA0(r13)
.elseif (region == 'K' || region == 'k') # RMCK
lwz r3, -0x5C80(r13)
.endif

lwz r3, 0x0044(r3)
lwz r3, 0x0 (r3)

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Call nw4r::db: DirectPrint_SetupFB #
# r3 = Render Mode #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

call_link nw4r_db_DirectPrint_SetupFB

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# End Register Safety; Default Instruction #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

pop_stack
default_instruction

#

#~~~~~~~~~~~~~~#
# END ASSEMBLY #
#~~~~~~~~~~~~~~#

==========

2nd ASM (Take Float Speed, Convert It, Draw it to Screen)

#~~~~~~~~~~~~~~~~#
# START ASSEMBLY #
#~~~~~~~~~~~~~~~~#

#

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Register Notes: #
# No need to backup r0, or LR #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Mem Address Notes: #
# 0x80001660 Speed Float Word #
# 0x815F0000 "Status Word" If not zero, Draw Code will execute, auto clears after every race #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~#
# Macros & Statements #
#~~~~~~~~~~~~~~~~~~~~~#

.macro push_stack
stwu r1, -0x90 (r1)
stfd f1, 0x8 (r1)
stmw r3, 0x10 (r1)
.endm

.macro pop_stack
lmw r3, 0x10 (r1)
lfd f1, 0x8 (r1)
addi r1, r1, 0x90
.endm

.macro call_link address
lis r12, \address@h
ori r12, r12, \address@l
mtlr r12
blrl
.endm

.macro default_instruction
lwz r12, 0x0 (r3)
.endm

.set region, '' #Must set region value, or else source will not compile

.if (region == 'E' || region == 'e') # RMCE
.set nw4r_db_DirectPrint_Printf, 0x80021DF0
.set nw4r_db_DirectPrint_StoreCache, 0x80021DD0
.elseif (region == 'P' || region == 'p') # RMCP
.set nw4r_db_DirectPrint_Printf, 0x80021E90
.set nw4r_db_DirectPrint_StoreCache, 0x80021E70
.elseif (region == 'J' || region == 'j') # RMCJ
.set nw4r_db_DirectPrint_Printf, 0x80021DB0
.set nw4r_db_DirectPrint_StoreCache, 0x80021D90
.elseif (region == 'K' || region == 'k') # RMCK
.set nw4r_db_DirectPrint_Printf, 0x80021EF0
.set nw4r_db_DirectPrint_StoreCache, 0x80021ED0
.else # Invalid Region
.abort
.endif

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Check to See if a Race is Active: #
# Load Status Word from Mem 81 #
# If not zero, we know to execute the Draw Code #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

lis r12, 0x815F
lwz r12, 0x0 (r12)
cmpwi r12, 0x0
beq- dont_execute

#~~~~~~~~~~~~~~~~~~~~~~~#
# Start Register Safety #
#~~~~~~~~~~~~~~~~~~~~~~~#

push_stack

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Pointer Load; Float Load, Conversion, Storage #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

lis r12, 0x8000 #Set 1st Half Address of Exception Vector Area
lwz r11, 0x1660 (r12) #Load Pointer into r11
lfs f1, 0x0024 (r11) #Load the Speed Float from Pointer into Float Register 13
fabs f1, f1, #Handle negative values
crset 4*cr1+eq #Set the Condition Register before the Float Arg is used in DirectPrint Printf

#~~~~~~~~~~~~~~~~~~~~~#
# Create ASCII String #
#~~~~~~~~~~~~~~~~~~~~~#

bl the_string #Create the C++ string

.llong 0x25332E3066206B6D #Hex for "%3.0f km/h"
.long 0x2F680000

the_string:
mflr r6 #Set 4th Arg of DirectPrint Printf

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# DirectPrint Printf & Store Cache #
# Purpose: Draw on Screen #
# r3 = X coordinate (starts far left) #
# r4 = Y coordinate (starts at very top) #
# r5 = 0 No Wrap; 1 Wrap #
# r6 = Address Pointer to String that will be Drawn on Screen #
# r7 thru r10 printf format args #
# f1 thru f13 printf float format args #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

li r3, 0x9
li r4, 0xDC
li r5, 0x1

call_link nw4r_db_DirectPrint_Printf
call_link nw4r_db_DirectPrint_StoreCache

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# no_go label; End Register Safety #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

no_go:
pop_stack

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# dont_execute label; Default Instruction #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

dont_execute:
default_instruction

#

#~~~~~~~~~~~~~~#
# END ASSEMBLY #
#~~~~~~~~~~~~~~#

==========

3rd ASM (Store Memory Pointer)
#~~~~~~~~~~~~~~~~#
# START ASSEMBLY #
#~~~~~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~#
# Macros & Statements #
#~~~~~~~~~~~~~~~~~~~~~#

.set region, '' #Must set region value, or else source will not compile

.if (region == 'E' || region == 'e') # RMCE
.macro default_instruction
lwz r3, -0x11E0 (r31)
.endm
.macro set_playerbase
lis r12, 0x809C
lwz r12, 0xFFFFD110 (r12)
.endm
.elseif (region == 'P' || region == 'p') # RMCP
.macro default_instruction
lwz r3, 0x3618 (r31)
.endm
.macro set_playerbase
lis r12, 0x809C
lwz r12, 0x18F8 (f12)
.endm
.elseif (region == 'J' || region == 'j') # RMCJ
.macro default_instruction
lwz r3, 0x2678 (r31)
.endm
.macro set_playerbase
lis r12, 0x809C
lwz r12, 0x0958 (r12)
.endm
.elseif (region == 'K' || region == 'k') # RMCK
.macro default_instruction
lwz r3, 0x1C58 (r31)
.endm
.macro set_playerbase
lis r12, 0x809B
lwz r12, 0xFFFFFF38 (r12)
.endm
.else # Invalid Region
.abort
.endif

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Set Region-Specific Player-Base #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

set_playerbase

#~~~~~~~~~~~~~~~~~~~~~~~#
# Pointer Level Loading #
#~~~~~~~~~~~~~~~~~~~~~~~#

lwz r12, 0x0020 (r12) #Load Word from 1st Level Pointer

mulli r11, r0, 0x4 #Multiply r0 by 0x4, store result in r11
add r12, r12, r11 #Add r11 and r12 together, result back into r12

lwz r12, 0 (r12) #Load into 2nd Level Pointer
lwz r12, 0x0010(r12) #Load into 3rd Level Pointer
lwz r12, 0x0010(r12) #Load into 4th Level Pointer

#~~~~~~~~~~~~~~~~~~~~~#
# Store Final Pointer #
#~~~~~~~~~~~~~~~~~~~~~#

lis r11, 0x8000 #Set up 1st Half Address of Exception Vector Area
stw r12, 0x1660 (r11) #Store Pointer Address to 0x80001660

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Set Status Word in Mem81 for Draw Text ASM #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

lis r12, 0x815F #Set up 1st Half Address of dynmaic Mem81
stw r31, 0x0 (r12) #Store r31 to 0x815F0000, we simply need a value not zero to be stored here. This will make the Speed Bar ASM only trigger during races.

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Default Instruction; Region-Specific #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

default_instruction

#

#~~~~~~~~~~~~~~#
# END ASSEMBLY #
#~~~~~~~~~~~~~~#



Code creator: zak
Code credits: Star & RiiDefi (Draw Text To Screen Code); SwareJonge (Speed-O-Meter); Chadderz (source fixes to Mdmwii's OG Speed source); Mdmwii (original Speed-O-Meter)

Print this item

  Mini Turbo Charge Meter
Posted by: zak - 03-21-2019, 11:06 PM - Forum: Cheat Codes - No Replies

Mini Turbo Charge Meter 

Works everywhere except Battle.

This code will read the output value of your MT charge (including Orange MT for Karts) on the millisecond section of your timer. Works for all vehicles.

For Bike Usage: A reading of '270' indicates MT is fully charged ready for boost.
For Kart Usage: Once the first/initial reading reaches 270 (blue MT is fully charged), the milliseconds recycle. Then a reading of '300' indicates the Orange MT is fully charged ready for boost.

NOTE: This code makes use of memory addresses 0x80001660 thru 0x80001663. Make sure no other codes in your GCT/Cheat-Manager are using those addresses.

NTSC-U
C25310A0 00000004
3D808000 818C1660
A0AC0100 2C050000
40820008 A0AC00FE
60000000 00000000
C27E4C9C 00000006
3D80809C 818CD110
818C0020 1D600004
7D8C5A14 818C0000
818C0010 818C0010
3D608000 918B1660
807FEE20 00000000

PAL
C2535BE8 00000004
3D808000 818C1660
A0AC0100 2C050000
40820008 A0AC00FE
60000000 00000000
C27EEFAC 00000006
3D80809C 818C18F8
818C0020 1D600004
7D8C5A14 818C0000
818C0010 818C0010
3D608000 918B1660
807F3618 00000000

NTSC-J
C2535568 00000004
3D808000 818C1660
A0AC0100 2C050000
40820008 A0AC00FE
60000000 00000000
C27EE618 00000006
3D80809C 818C0958
818C0020 1D600004
7D8C5A14 818C0000
818C0010 818C0010
3D608000 918B1660
807F2678 00000000

NTSC-K
C2523C40 00000004
3D808000 818C1660
A0AC0100 2C050000
40820008 A0AC00FE
60000000 00000000
C27DD36C 00000006
3D80809B 818CFF38
818C0020 1D600004
7D8C5A14 818C0000
818C0010 818C0010
3D608000 918B1660
807F1C58 00000000



List of Sources:

(First ASM; Millisecond Modifier):

.set _mtc , 0xFE #MT Charge
.set _omtc, 0x100 #Kart Only Orange MT Charge
.set _mtb, 0x102 #Boost from MT Release
.set _ssmtb, 0x10C #Boost from both Stand Still Charge & MT's
.set _mushb, 0x110 #Mushroom/Zipper Boost
.set _trikb, 0x114 #Trick Boost
.set _ssc, 0x14C #Stand Still Charge
.set _air, 0x21A #Air Time

lis r12, 0x8000 #Set first half address of r12 to 0x8000 to load dynamic memory address location
lwz r12, 0x1660 (r12) #Load the pointer from 0x80001660
lhz r5, _omtc (r12) #Load the current Orange MT charge value into r11

cmpwi r5, 0x0 #Compare value of Orange MT charge value to 0x0
bne- skip_blue #If not equal to 0x0, we need to display the Orange MT charge, NOT the blue MT. This branch is LESS likely to occur, hence the minus symbol

lhz r5, _mtc (r12) #If equal to 0x0, we need to display the Blue MT charge, NOT the Orange MT. Load Blue MT value into r11

skip_blue: #Label placed purely for branch offset auto-calculation by compiler

2nd ASM (Dynamic Memory Pointer Storage):

#~~~~~~~~~~~~~~~~#
# START ASSEMBLY #
#~~~~~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~#
# Macros & Statements #
#~~~~~~~~~~~~~~~~~~~~~#

.set region, ''

.if (region == 'E' || region == 'e') # RMCE
.macro default_instruction
lwz r3, -0x11E0 (r31)
.endm
.macro set_playerbase
lis r12, 0x809C
lwz r12, 0xFFFFD110 (r12)
.endm
.elseif (region == 'P' || region == 'p') # RMCP
.macro default_instruction
lwz r3, 0x3618 (r31)
.endm
.macro set_playerbase
lis r12, 0x809C
lwz r12, 0x18F8 (f12)
.endm
.elseif (region == 'J' || region == 'j') # RMCJ
.macro default_instruction
lwz r3, 0x2678 (r31)
.endm
.macro set_playerbase
lis r12, 0x809C
lwz r12, 0x0958 (r12)
.endm
.elseif (region == 'K' || region == 'k') # RMCK
.macro default_instruction
lwz r3, 0x1C58 (r31)
.endm
.macro set_playerbase
lis r12, 0x809B
lwz r12, 0xFFFFFF38 (r12)
.endm
.else # Invalid Region
.abort
.endif

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Set Region-Specific Player-Base #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

set_playerbase

#~~~~~~~~~~~~~~~~~~~~~~~#
# Pointer Level Loading #
#~~~~~~~~~~~~~~~~~~~~~~~#

lwz r12, 0x0020 (r12) #Load Word from 1st Level Pointer

mulli r11, r0, 0x4 #Multiply r0 by 0x4, store result in r11
add r12, r12, r11 #Add r11 and r12 together, result back into r12

lwz r12, 0 (r12) #Load into 2nd Level Pointer
lwz r12, 0x0010(r12) #Load into 3rd Level Pointer
lwz r12, 0x0010(r12) #Load into 4th Level Pointer

#~~~~~~~~~~~~~~~~~~~~~#
# Store Final Pointer #
#~~~~~~~~~~~~~~~~~~~~~#

lis r11, 0x8000 #Set up 1st Half Address of Exception Vector Area
stw r12, 0x1660 (r11) #Store Pointer Address to 0x80001660

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Default Instruction; Region-Specific #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

default_instruction

#

#~~~~~~~~~~~~~~#
# END ASSEMBLY #
#~~~~~~~~~~~~~~#



Code creator: zak
Code contributor(s): SwareJonge (universal meter code), Chadderz (fixes to mdmwii's OG source), mdmwii (original Online Speed-O-Meter)

Print this item

  Using Mem81 to Auto-Clear Data for ASM Codes
Posted by: zak - 03-18-2019, 02:45 AM - Forum: Hacking General - No Replies

Using Mem81 to Auto-Clear Data for ASM Codes

NOTE: For intermediate level code creators that have already been utilizing the crash handler in previous codes.

Let's say you have an ASM code that originally stores data/values to the crash handler. You wanted these values to clear after every race. So you write another ASM code (that occurs only in between races) to zero/null out all the values.

Seems pretty silly to write another whole ASM code just to clear values. Instead of storing your data/values to the crash handler. You store them to Mem81. Mem81 auto-clears after every race/battle. The only time is doesn't auto clear is pressing restart in TT mode. I don't know the entire exact allowable region of Mem81 but here is a LARGE chunk used many various codes over time and I have seen no issues with any of those codes' functionality.

0x81400000 thru 0x81701000

As you can see this is a very large region of memory to have at your expense. And there you go, a great place to store values that need to be cleared per race. Happy coding!

Print this item

  Using the Exception Vector Area in ASM Codes
Posted by: zak - 03-18-2019, 02:31 AM - Forum: Hacking General - No Replies

Using the Exception Vector Area in ASM Codes

If you have started making ASM Codes recently and they are becoming less basic, you will eventually hit a point where you need to store values during one ASM code, to later utilize said values in another ASM Code. The simplest method to achieve that is to store the necessary data/values to what is known as the Exception Vector Area.

The Exception Vector Area is universal (same location within memory) for every Wii Game. Here are the address ranges:

0x80001490 thru 0x800016FF
0x80001798 thru 0x800017FF

This area is safe to store data/values to. Keep in mind that many many ASM codes utilize the Exception Vectors Area.

I would say that the most used region within this area is from High 0x800015XX to Mid 0x800016XX Range. So you might want to use the second portion (0x80001798 thru 0x800017FF) instead. Many users (noobs) of the game will use multiple ASM codes together in a GCT and not think twice to check them to see if a code happens to use the same Exception Vector region as another code. Thus causing both codes to malfunction and the 'noob' thinking there is something wrong with the code(s).

Now onto a demo code of how to utilize the Exception Vector Area. We have this code here...

https://mkwii.org/showthread.php?tid=889 (take a moment to thoroughly read thru the source)

The first ASM code has a register that holds the value of the in-race room size. We want to use this value for the next ASM Code (shared item code) to help determine whether or not the code should execute. The shared item code address has NO registers that hold the in-race room size value. 

So what the 1st instruction of the 1st ASM code does is establish the 1st half address of the Vector Area (lis r12, 0x8000). The next instruction stores the in-race room size value (byte) to the designated spot in the Vector Area at 0x8000164F. Now this allows the second ASM to load this byte value for use.

As you can see, pretty simple to do. Happy coding!

Print this item

  Distance Meter; DBZ BT3
Posted by: zak - 03-16-2019, 01:41 AM - Forum: DBZ BT3 - No Replies

DBZ BT3 Distance Meter

This code will display the current measured lateral distance between you and P2/COM via the match timer. The closer the opponent is to you, the more the number will decrease. The farther away the opponent is from you, the more the number will increase. The value 999 is the max, so if the distance measurement exceeds 999, the reading will still be 999. The actual timer of the match will still continue as normal. The distance values in this code only effect the display value of the match timer.

NTSC-U
C207B7A4 00000002
3D808000 D00C1600
D01E0044 00000000
C2122678 00000004
3D808000 C16C1600
FD60581C D96C1604
806C1608 9068000C
60000000 00000000



List of Sources

1st ASM (Store Distance Float):
lis r12, 0x8000 #Set 1st half address of Crash Handler
stfs f0, 0x1600 (r12) #Store Distance Float to 0x80001600
stfs f0, 0x0044 (r30) #Default Instruction

2nd ASM (Convert Float to Hex, place value in Register for Timer's default instruction)
lis r12, 0x8000 #Set 1st half address of Crash Handler
lfs f11, 0x1600 (r12) #Load Distance Float into f11
fctiw f11, f11 #Convert float to decimal, use standard rounding
stfd f11, 0x1604 (r12) #Store the double float (second word is our hex value) to 0x80001604
lwz r3, 0x1608 (r12) #Load converted hex value from 0x80001608 into r3
stw r3, 0x000C (r8) #Default Instruction; store hex value so Timer will then display it as a decimal value



Code creator: zak

Print this item

  DWC_Authdata Spoofer; DBZ BT3
Posted by: zak - 03-14-2019, 10:23 PM - Forum: DBZ BT3 - No Replies

DBZ BT3 DWC_Authdata Spoofer

Also known as User ID Spoofer. This code allows a user to have a fully spoofed DWC_Authdata/User ID. Do not exceed the value of 000009184E729FFF (9999999999999 in decimal). Legit authdatas cannot exceed that limit. If you exceed that limit, a server mod/admin will instantly know you are using spoofing codes. Thus, if you follow this rule, your XXXX value will always be 0000.

Another thing to know, is that you this code on an existing Wifi Profile, you will get EC 60000. You will need to reset/initialize your Wifi Profile. When you make a Wifi Profile and get a new FC while using this code, you will need this code every time (with the same authdata value) to get on Wifi again on the same profile, or you will get EC 60000.

NTSC-U
C22D6190 00000004
3CE0WWWW 60E7XXXX
90E601B0 3CE0YYYY
60E7ZZZZ 90E601B4
80E601B0 00000000

WWWWXXXXYYYYZZZZ = Your desired DWC_Authdata in HEX



Source:
lis r7, 0xWWWW #Load the WWWW value into the upper 16 bits of Register 7, clear the lower 16 bits
ori r7, r7, 0xXXXX #Load the XXXX value into the lower 16 bits of Register 7
stw r7, 0x01B0 (r6) #Store the word (WWWWXXXX) of Register 7 at the address of Register 6 plus offset of 0x01B0
lis r7, 0xYYYY #Load the YYYY value into the upper 16 bits of Register 7, clear the lower 16 bits
ori r7, r7, 0xZZZZ #Load the ZZZZ value into the lower 16 bits of Register 7
stw r7, 0x01B4 (r6) #Store the word (YYYYZZZZ) of Register 7 at the address of Register 6 plus offset of 0x01B4
lwz r7, 0x01B0 (r6) #Load the word at address of Register 6 plus offset 0x01B0 into Register 7; Default Instruction



Code creator: zak

Print this item

  MAC Address Spoofer; DBZ BT3
Posted by: zak - 03-14-2019, 07:42 PM - Forum: DBZ BT3 - No Replies

DBZ BT3 MAC Address Spoofer

MAC Address = YY-YY-YY-ZZ-ZZ-ZZ

It is recommended you put the YY values that matches a prefix owned by Nintendo. A list of all Nintendo YY-YY-YY values are listed below. You can put any YY Values you want, but if you're using this to bypass a ban, stick with the list of Nintendo YY values.

The ZZ values can be anything in hex (A-F, 0-9).

NTSC-U
C22B0AA4 00000004
3D80YYYY 618CYYZZ
91840000 3D80ZZZZ
558C843E B1840004
38A00006 00000000

List of YY-YY-YY MAC Prefixes owned by Nintendo:
0009BF Nintendo Co., Ltd.
001656 Nintendo Co., Ltd.
0017AB Nintendo Co., Ltd.
00191D Nintendo Co., Ltd.
0019FD Nintendo Co., Ltd.
001AE9 Nintendo Co., Ltd.
001B7A Nintendo Co., Ltd.
001BEA Nintendo Co., Ltd.
001CBE Nintendo Co., Ltd.
001DBC Nintendo Co., Ltd.
001E35 Nintendo Co., Ltd.
001EA9 Nintendo Co., Ltd.
001F32 Nintendo Co., Ltd.
001FC5 Nintendo Co., Ltd.
002147 Nintendo Co., Ltd.
0021BD Nintendo Co., Ltd.
00224C Nintendo Co., Ltd.
0022AA Nintendo Co., Ltd.
0022D7 Nintendo Co., Ltd.
002331 Nintendo Co., Ltd.
0023CC Nintendo Co., Ltd.
00241E Nintendo Co., Ltd.
002444 Nintendo Co., Ltd.
0024F3 Nintendo Co., Ltd.
0025A0 Nintendo Co., Ltd.
002659 Nintendo Co., Ltd.
002709 Nintendo Co., Ltd.
182A7B Nintendo Co., Ltd.
2C10C1 Nintendo Co., Ltd.
34AF2C Nintendo Co., Ltd.
40F407 Nintendo Co., Ltd.
58BDA3 Nintendo Co., Ltd.
78A2A0 Nintendo Co., Ltd.
8C56C5 Nintendo Co., Ltd.
8CCDE8 Nintendo Co., Ltd.
9CE635 Nintendo Co., Ltd.
A45C27 Nintendo Co., Ltd.
A4C0E1 Nintendo Co., Ltd.
B8AE6E Nintendo Co., Ltd.
CC9E00 Nintendo Co., Ltd.
D86BF7 Nintendo Co., Ltd.
E00C7F Nintendo Co., Ltd.
E0E751 Nintendo Co., Ltd.
E84ECE Nintendo Co., Ltd.

Source:
lis r12, 0x0YYYY
ori r12, r12, 0xZZZZ
stw r12, 0 (r4)
lis r12, 0xZZZZ
srwi r12, r12, 16
sth r12, 0x4 (r4)
li r5, 6 #Default instruction

Code creator: NinArm
Code credits: mdmwii (mkw version source creator)

Print this item

  Serial Number Spoofer; DBZ BT3
Posted by: zak - 03-14-2019, 04:35 AM - Forum: DBZ BT3 - No Replies

DBZ BT3 Serial Number Spoofer

This code will allow you to spoof both parts of your serial number. Those are the Product Code and the 'SerNo'. The Product Code is the two or three digit letter code that comes right before your 9 digit number 'SerNo' that is on the outside sticker of the Wii. For example, on older American Wiis, this product Code is LU. On newer American Wiis (family model wiis, no GCN ports), the product code is KU. Another example is that some older European Wiis have the product code of LEH.

This code makes use of memory addresses 0x80001670 thru 0x80001673. Make sure no other codes in your GCT file are using those memory addresses.

NOTES (read this if you are intending to use this to bypass a ban):
Nintendo uses a certain order/range when applying serial numbers depending on when the Console was built. You simply can't put any Product Code + SerNo combination/setup you would like. Because if a server mod (who knows these certain orders/ranges like I do) sees an impossible Product Code + SerNo combo, then he/she knows you are using spoofer codes and you will get banned. View the Guide listed below to ensure your spoofed values are a legit 'combination' and within the legit range.

Guide:
List of legit Product Code (GGHHKK) values, then proper SerNo value range accordingly:
4C4546 = LEF (European); Serno must start with the values 3130, or 3230
4C4548 = LEH (European); Serno must start with the values 3130
4C454D = LEM (European); SerNo starting values unknown (maybe someone can get those...)
4C5500 = LU (American); SerNo must start with the value 31, 33, or 35
4B5500 = KU (American); SerNo must start with the values 3130, or 3430
4C4A46 = LJF (Japanese); SerNo must start with the value 3130
4C4A48 = LJH (Japanese); SerNo must start with the values 3132
4C4A4D = LJM (Japanese); SerNo must start with the values 3130
4C4148 = LAH (Australian); SerNo must start with the values 3130, 3131, or 3132
4C5446 = LTF (Taiwanese); SerNo must start with the values 3130, or 3230
4C5448 = LTH (Taiwanese); SerNo starting values unknown (maybe someone can get those...)
4C4B48 = LKH (Korean); SerNo starting values unknown (maybe someone can get those...)
4C4B4D = LKM (Korean; SerNo must start with the values 3130

SerNo (NNPPRRTTUUVVXXYYZZ) Values:
30 = 0
31 = 1
32 = 2
33 = 3
34 = 4
35 = 5
36 = 6
37 = 7
38 = 8
39 = 9

NTSC-U
C2256394 00000007
3D80GGHH 618CKK00
91960000 3D80NNPP
618CRRTT 9184FFF6
3D80UUVV 618CXXYY
9184FFFA 398000ZZ
9984FFFE 2C030000
60000000 00000000



Source:

#~~~~~~~~~~~~~~~~#
# START ASSEMBLY #
#~~~~~~~~~~~~~~~~#

#

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
#                                    Summary:                                   #
# The code's address is the first instruction after the function SCGetProductSN #
#     is completed. Thus certain registers hold key memory addresses that we    #
#     can use to edit the Product Code and SerNo before the Server reads it.    #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
#                    Register Notes:                   #
# r4 minus 0xA = Address that points to Start of SerNo #
#         r22 holds the Product Code Address           #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Set & Store Product Code (LEH used as example) #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

lis r12, 0x4C45
ori r12, r12, 0x4800
stw r12, 0 (r22)

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#
# Set & Store SerNo (123456789 used as example) #
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~#

lis r12, 0x3132
ori r12, r12, 0x3334
stw r12, -0xA (r4)
lis r12, 0x3536
ori r12, r12, 0x3738
stw r12, -0x6 (r4)
li r12, 0x39
stb r12, -0x2 (r4)

#~~~~~~~~~~~~~~~~~~~~~#
# Default Instruction #
#~~~~~~~~~~~~~~~~~~~~~#

cmpwi r3, 0

#

#~~~~~~~~~~~~~~#
# END ASSEMBLY #
#~~~~~~~~~~~~~~#



Code creator: zak

Print this item