I looked a bit into dkr, and indeed, it seems pretty confusing to hack.
Here what could work :
scan from 0x020cfde0 to ???, step every 0xc, and check that [address+ 5] = 0x08.
If it's true, check that 32bits at [address] <> 0
If it's true, load [address] to offset, add 0x38 to it, and you'll be at the items address.
For exemple, for the TT code handler only (ie. the following codes won't work on an AR), it means :
Code:
94000130 FDFF0000 // press L
C5000000 000F000F // it's to avoid the codes being executed too often (else it freezes the game)
D3000000 020CFDE4 // offset = 0x020CFDE4 (= 0x020CFDE0+4)
C0000000 00000100 // repeat until...
90000000 00FF0800 // if1 (0x020CFDE5= 0x08)
DC000000 FFFFFFFC // offset = 0x020CFDE0
60000000 00000000 // if2 [offset]<>0
B0000000 00000000 // load pointer address
DC000000 00000038 // adds 0x38 to it
00000000 00000001 // write item
00000004 00000001 // write item
D0000000 00000000 // endif2
C0000000 00000000 // end repeat (repeat = 0) (credits to Y.S. for that idea)
D0000000 00000000 // endif1
DC000000 0000000C // offset = offset + 0x0c
D2000000 00000000 // end repeat
(tested a bit on the 4 first single player courses. It won't work on the adventure mode (seems to crash the game) ).
(edit : actually the first course of the adv mode crashes when you put items. maybe it'll work on other courses...).
(edit2: the codes indeed worked in the first adv mode 'real' race, behind the door).
(edit3: oh well, it seem to work well for the first player only (pipsy). Maybe the '0x08' that I check in the code if that player internal number... Tiptup seems to be '0x07', Diddy seems to be '0x0C'... )
This is just a demo code, to show how it could work.
One should replace the 'write item' codes value with other values, or make a code (using C4?) do change them during the game.
And I guess, to port this to the AR, one might have to use some custom asm routine...