Kodewerx

Our culture has advanced beyond all that you could possibly comprehend with one hundred percent of your brain.
It is currently Mon May 13, 2024 5:16 pm

All times are UTC - 8 hours [ DST ]




Post new topic Reply to topic  [ 14 posts ] 
Author Message
PostPosted: Sat Mar 17, 2007 9:41 pm 
Offline
Kommunist
Kommunist
User avatar

Joined: Sat Oct 14, 2006 5:41 pm
Posts: 99
Location: 38.90N 77.03W
I am attempting to make an always have Item code for DKR and am running into problems with pointers. The address values seem to vary across courses and vehicles. Here are the ones I am working with:

Code:
Pirate Lagoon (HC): 0x023443b4
Ancient Lake (CAR): 0x02374a64
Ancient Lake (PLANE): 0x0237fca4
Jungle Falls (CAR): 0x023936d0
Jungle Falls (PLANE): 0x0239e534
EDIT:
Hot Top Volcano (HC): 0x02368f3c
Hot Top Volcano (PLANE): 0x0237e388


Kenobi's tool was able to give me a pointer when I fed it the two ancient lake values and ram dumps but that pointer failed beyond ancient lake. When I gave it the two Jungle Falls values it gave me nothing. Any ideas besides creating a code for every course in every vehicle with every item?


Last edited by dexter0 on Sat Mar 17, 2007 11:09 pm, edited 1 time in total.

Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Sat Mar 17, 2007 9:59 pm 
Offline
Kommunist
Kommunist

Joined: Mon Jan 29, 2007 2:23 pm
Posts: 313
sounds like you may need to try to search that pointer in jungle falls again. You may have messed something up.


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Sat Mar 17, 2007 11:07 pm 
Offline
Kommunist
Kommunist
User avatar

Joined: Sat Oct 14, 2006 5:41 pm
Posts: 99
Location: 38.90N 77.03W
Hmm. I did it again and double checked the addresses and it still turned up nothing. I tried Hot Top Volcano and it worked fine. :(


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Sat Mar 17, 2007 11:19 pm 
Offline
Kommunist
Kommunist

Joined: Mon Jan 29, 2007 2:23 pm
Posts: 313
if i can get this to run on an emulator i may look into it later


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Sat Mar 17, 2007 11:26 pm 
Offline
Krew (Admin)
Krew (Admin)
User avatar

Joined: Sun Oct 01, 2006 9:26 pm
Posts: 3768
Title: All in a day's work.
Do it as a pointer-to-a-pointer. The pointers given to you by kenobi's tool... search for those as well. For example, locate the pointer for Ancient Lake and Jungle Falls separately -- you will have two different pointers. Now locate a pointer that points to those using the same method. So it goes Root Pointer -> Level Pointer -> Item Per Vehicle.

To make the final code (once you have this root pointer) just fill in the blanks in this code:
Code:
BXXXXXXX 00000000 ; Place the root pointer address here
BYYYYYYY 00000000 ; Place the root pointer's 'offset' here
0ZZZZZZZ ???????? ; Place the final offset here (Z's) and data (?'s) can also use '1' or '2' code type
D2000000 00000000

_________________
I have to return some video tapes.

Feed me a stray cat.


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Sun Mar 18, 2007 5:25 am 
Offline
Kommunist
Kommunist

Joined: Mon Jan 29, 2007 2:23 pm
Posts: 313
^ I thought about that at first, but he said he couldn't find any pointer for jungle falls, and he never said that the pointers changed. I guess a double pointer would be the best though because it will create a shorter code.

EDIT: haha...."point" me in the right direction para....


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Sun Mar 18, 2007 12:08 pm 
Offline
Kommunist
Kommunist
User avatar

Joined: Sat Oct 14, 2006 5:41 pm
Posts: 99
Location: 38.90N 77.03W
Originally, I was thinking that this was a pointer to a pointer as Parasyte pointed out however, I have run into another problem. From my understanding the pointer to pointer concept relies on the fact that the offset from the Level Pointer to the address is the same for every level but for this game it is not.

For example, Kenobi's tool came up with these pointers for Ancient Lake:
Code:
020CFEC4:0237DA28
020CFED0:0237EE60
020CFEDC:0237FC68
020CFEE8:0237F514

I am using the first one which creates an offset of 227C to the Ancient Lake addresses. For Fossil Canyon it came up with:
Code:
020CFE7C:023A3DA8

This creates an offset of 35F8 to the Fossil Canyon addresses.

EDIT: I decided to run the ram dumps and addresses for Jungle Falls in the Car and HC through the pointer tool (before I was using Car & Plane) and it came up with a lot of values:
Code:
020AD908:0237E2F0
020AD90C:0237E6F0
020AD910:0237EAFC
020AD914:0237EEFC
020AD918:0237E2F0
020AD91C:0237E6F0
020AD920:0237EAFC
020AD924:0237EEFC
020B1660:0237C76C
020B1670:0237C994
020B1680:0237CA3C
020CFEDC:0238908C
020CFEE8:02388938
020CFFCC:0237FF00
020D25CC:02382448
020D2EE4:0237FF34
02147BCC:0237C560

I tried each one but they only worked between the Car and HC although I noted two of them (maybe more) worked for the Plane but only during the intro sequence for the race. Once the race started the pointer changed values and they stopped working.
Code:
0x020cfedc
0x020cfee8


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Sun Mar 18, 2007 1:42 pm 
Offline
Krew (Admin)
Krew (Admin)
User avatar

Joined: Sun Oct 01, 2006 9:26 pm
Posts: 3768
Title: All in a day's work.
My question is: Are those addresses the same every time the level loads, or might the variables move around entirely at random? This is a very important aspect have hacking pointers.

_________________
I have to return some video tapes.

Feed me a stray cat.


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Sun Mar 18, 2007 6:38 pm 
Offline
Kommunist
Kommunist
User avatar

Joined: Sat Oct 14, 2006 5:41 pm
Posts: 99
Location: 38.90N 77.03W
The address that controls items does not move around each race.

As for the pointers, the 0x020cfedc pointer seems to vary with some correlation between wether or not the pre-race intro is skipped as seen by this sampling. The one ambiguous case may explained by the time that the skip button was pressed perhaps:
Quote:
0239e4f8 (No skip)
0239e4f8 (No skip)
0239e4f8 (No skip)
0239e4f8 (skip)
0239e4f8 -> 023a0ff0 -> 023a7ef8 (skip)
0239e4f8 -> 023a0ff8 -> 023a68d0 (skip)
0239e4f8 (no skip)
0239e4f8 -> 023a0fe0 -> 023a1734 (skip)

(The pointer should be at 0239e4f8 to work to work with the offset)
It is also worth noting that when the pointer is not 0239e4f8 some strange graphical errors can occur.

The other pointer showed the same symptoms:
Quote:
0239dda4 (No skip)
0239dda4 -> 023984c4 (skip)
0239dda4 -> 023a1008 (skip)
0239dda4 (No skip)
0239dda4 (No skip)

(Should be at 0239dda4 to work)


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Mon Mar 19, 2007 6:53 am 
Offline
Kommunist
Kommunist

Joined: Fri Nov 10, 2006 12:42 am
Posts: 63
Pointers are the reason I failed C++.


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Mon Mar 19, 2007 10:20 am 
Offline
Krew (Admin)
Krew (Admin)
User avatar

Joined: Sun Oct 01, 2006 9:46 pm
Posts: 2331
Location: *poof*
Title: The Mad Hacker
tolos wrote:
Pointers are the reason I failed C++.
Pointers are the reason I got hired to help students with C++. lol

_________________
Image


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Mon Mar 19, 2007 6:27 pm 
Offline
Kommunist
Kommunist
User avatar

Joined: Sat Oct 14, 2006 5:41 pm
Posts: 99
Location: 38.90N 77.03W
Pointers, are the reason it seems next to impossible to make codes for this game :(


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Tue Mar 20, 2007 2:25 pm 
Offline
Kommunist
Kommunist

Joined: Tue Oct 10, 2006 9:32 am
Posts: 445
I looked a bit into dkr, and indeed, it seems pretty confusing to hack.

Here what could work :
scan from 0x020cfde0 to ???, step every 0xc, and check that [address+ 5] = 0x08.
If it's true, check that 32bits at [address] <> 0
If it's true, load [address] to offset, add 0x38 to it, and you'll be at the items address.

For exemple, for the TT code handler only (ie. the following codes won't work on an AR), it means :

Code:
94000130 FDFF0000 // press L
C5000000 000F000F // it's to avoid the codes being executed too often (else it freezes the game)
D3000000 020CFDE4 // offset = 0x020CFDE4 (= 0x020CFDE0+4)
C0000000 00000100 // repeat until...
90000000 00FF0800 // if1 (0x020CFDE5= 0x08)
DC000000 FFFFFFFC // offset = 0x020CFDE0
60000000 00000000 // if2 [offset]<>0
B0000000 00000000 // load pointer address
DC000000 00000038 // adds 0x38 to it
00000000 00000001 // write item
00000004 00000001 // write item
D0000000 00000000 // endif2
C0000000 00000000 // end repeat (repeat = 0) (credits to Y.S. for that idea)
D0000000 00000000 // endif1
DC000000 0000000C // offset = offset + 0x0c
D2000000 00000000 // end repeat


(tested a bit on the 4 first single player courses. It won't work on the adventure mode (seems to crash the game) ).
(edit : actually the first course of the adv mode crashes when you put items. maybe it'll work on other courses...).
(edit2: the codes indeed worked in the first adv mode 'real' race, behind the door).
(edit3: oh well, it seem to work well for the first player only (pipsy). Maybe the '0x08' that I check in the code if that player internal number... Tiptup seems to be '0x07', Diddy seems to be '0x0C'... )

This is just a demo code, to show how it could work.
One should replace the 'write item' codes value with other values, or make a code (using C4?) do change them during the game.
And I guess, to port this to the AR, one might have to use some custom asm routine...


Last edited by kenobi on Tue Mar 20, 2007 10:06 pm, edited 1 time in total.

Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Tue Mar 20, 2007 6:56 pm 
Offline
Krew (Admin)
Krew (Admin)
User avatar

Joined: Sun Oct 01, 2006 9:26 pm
Posts: 3768
Title: All in a day's work.
If I get Kwurdi working again (I broke it by updating devkitpro and ndslib), this will be one of the games I'll look into. Meh, we'll see what happens.

_________________
I have to return some video tapes.

Feed me a stray cat.


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 14 posts ] 

All times are UTC - 8 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 24 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group