Hacking PoC - Boot NeoGamma via Disc Channel!

damysteryman · Feb 18, 2012

UPDATE - r4 has Wii Gamertag support! Supports both Wiinnertag and DUTag! Also, autocheat improved. Also, should have support for new wm+ wiimote models.

Hello gbatemp!

Here I have to show you is a way to boot NeoGamma (or any channel really) via the Disc Channel!

Here is a video of it in action: (VID IS OUT OF DATE)
Volume in video is low, so you may need to increase yours.

WARNING! My voiceover in this video is horrible and absolutely EVIL. (I do not actually sound like that IRL lol) When I watched this video after filming, I almost went insane. Almost went insane while filming towards the end too! Watch this video at your own risk... if you start uncontrollably laughing, get nightmares, or go insane after watching it all then it is your own fault.

This is achieved by using a priiloader hack to tell the disc channel to load... another channel instead of a disc. There are 4 versions I have made, one that loads a specified channel every time, and another that loads a different channel depending on whether you try to boot a Wii or GC disc, one that loads a channel only when a Wii disc is loaded, and one that loads a channel only when a GC disc is loaded.
So far, the hack has only been made for 4.3E ATM, but I will port to 4.3, 4.3U, and 4.3K soon (then to 4.1 and 4.2, and MAYBE 3.xx versions). (But not right now though... after I post this thread, I need to go straight to sleep!)
UPDATE - I have ported the 4 hacks to all regions of 4.1, 4.2 and 4.3!

First version - Single Channel priiloader hack:
4.1:

4.1J:

Code:

[Disc Channel -> NeoGamma! (HNCA)]
version=448
offset=0x816C0408,0x816C040C,0x816C0410,0x816C0414,0x816C0418,0x8137B4D0,0x8137B4D4,0x8137B520,0x8137B524,0x8137B570,0x8137B574,0x8137ADD4,0x8137B4C0
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48345635,0x48344F49

4.1U:

Code:

[Disc Channel -> NeoGamma! (HNCA)]
version=449
offset=0x81690D40,0x81690D44,0x81690D48,0x81690D4C,0x81690D50,0x8137C01C,0x8137C020,0x8137C06C,0x8137C070,0x8137C0BC,0x8137C0C0,0x8137B920,0x8137C00C
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48315421,0x48314D35

4.1E:

Code:

[Disc Channel -> NeoGamma! (HNCA)]
version=450
offset=0x81692BD8,0x81692BDC,0x81692BE0,0x81692BE4,0x81692BE8,0x8137C0C4,0x8137C0C8,0x8137C114,0x8137C118,0x8137C164,0x8137C168,0x8137B9C8,0x8137C0B4
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48317211,0x48316B25

4.1K:

Code:

[Disc Channel -> NeoGamma! (HNCA)]
version=454
offset=0x81665440,0x81665444,0x81665448,0x8166544C,0x81665450,0x8137B3F8,0x8137B3FC,0x8137B448,0x8137B44C,0x8137B498,0x8137B49C,0x8137ACFC,0x8137B3E8
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x482EA745,0x482EA059

4.2:

4.2J:

Code:

[Disc Channel -> NeoGamma! (HNCA)]
version=480
offset=0x816C13A8,0x816C13AC,0x816C13B0,0x816C13B4,0x816C13B8,0x8137B930,0x8137B934,0x8137B980,0x8137B984,0x8137B9D0,0x8137B9D4,0x8137B234,0x8137B920
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48346175,0x48345A89

4.2U:

Code:

[Disc Channel -> NeoGamma! (HNCA)]
version=481
offset=0x81691CA0,0x81691CA4,0x81691CA8,0x81691CAC,0x81691CB0,0x8137C47C,0x8137C480,0x8137C4CC,0x8137C4D0,0x8137C51C,0x8137C520,0x8137BD80,0x8137C46C
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48315F21,0x48315835

4.2E:

Code:

[Disc Channel -> NeoGamma! (HNCA)]
version=482
offset=0x81693B38,0x81693B3C,0x81693B40,0x81693B44,0x81693B48,0x8137C524,0x8137C528,0x8137C574,0x8137C578,0x8137C5C4,0x8137C5C8,0x8137BE28,0x8137C514
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48317D11,0x48317625

4.2K:

Code:

[Disc Channel -> NeoGamma! (HNCA)]
version=486
offset=0x816662E0,0x816662E4,0x816662E8,0x816662EC,0x816662F0,0x8137B810,0x8137B814,0x8137B860,0x8137B864,0x8137B8B0,0x8137B8B4,0x8137B114,0x8137B800
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x482EB1CD,0x482EAAE1

4.3:

4.3J:

Code:

[Disc Channel -> NeoGamma! (HNCA)]
version=512
offset=0x816C2F28,0x816C2F2C,0x816C2F30,0x816C2F34,0x816C2F38,0x8137BAC8,0x8137BACC,0x8137BB18,0x8137BB1C,0x8137BB68,0x8137BB6C,0x8137B3CC,0x8137BAB8
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48347B5D,0x48347471

4.3U:

Code:

[Disc Channel -> NeoGamma! (HNCA)]
version=513
offset=0x81693820,0x81693824,0x81693828,0x8169382C,0x81693830,0x8137C614,0x8137C618,0x8137C664,0x8137C668,0x8137C6B4,0x8137C6B8,0x8137BF18,0x8137C604
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48317909,0x4831721D

4.3E:

Code:

[Disc Channel -> NeoGamma! (HNCA)]
version=514
offset=0x816956B8,0x816956BC,0x816956C0,0x816956C4,0x816956C8,0x8137C6BC,0x8137C6C0,0x8137C70C,0x8137C710,0x8137C75C,0x8137C760,0x8137BFC0,0x8137C6AC
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x483196F9,0x4831900D

4.3K:

Code:

[Disc Channel -> NeoGamma! (HNCA)]
version=518
offset=0x81667E80,0x81667E84,0x81667E88,0x81667E8C,0x81667E90,0x8137B9A8,0x8137B9AC,0x8137B9F8,0x8137B9FC,0x8137BA48,0x8137BA4C,0x8137B2AC,0x8137B998
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x482ECBD5,0x482EC4E9

This one makes the disc channel boot a channel instead of the disc. By default, it boots title 00010008-484E4341 [Hidden Channel - TitleID HNCA] ("NeoCORP") via the disc channel every time you try to boot a disc. In the video example, this channel contains an Autoboot NeoGamma app.

Second version - Dual Channel priiloader hack: (too wide for forum post box, so had to split it onto 2 lines... be sure to rejoin them when manually adding to a hacks.ini)
4.1:

4.1J:

Code:

[Disc Channel:  Wii -> HNCA  GC -> HCLA]
version=448
offset=0x816C0408,0x816C040C,0x816C0410,0x816C0414,0x816C0418,0x816C041C,0x816C0420,0x816C0424,0x816C0428,0x816C042C,
0x8137B4D0,0x8137B4D4,0x8137B520,0x8137B524,0x8137B570,0x8137B574,0x8137ADD4,0x8137B4C0
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x3F200001,0x3B390008,0x3F004843,0x3B184C41,0x4E800020,
0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48345635,0x48344F5D

4.1U:

Code:

[Disc Channel:  Wii -> HNCA  GC -> HCLA]
version=449
offset=0x81690D40,0x81690D44,0x81690D48,0x81690D4C,0x81690D50,0x81690D54,0x81690D58,0x81690D5C,0x81690D60,0x81690D64,
0x8137C01C,0x8137C020,0x8137C06C,0x8137C070,0x8137C0BC,0x8137C0C0,0x8137B920,0x8137C00C
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x3F200001,0x3B390008,0x3F004843,0x3B184C41,0x4E800020,
0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48315421,0x48314D49

4.1E:

Code:

[Disc Channel:  Wii -> HNCA  GC -> HCLA]
version=450
offset=0x81692BD8,0x81692BDC,0x81692BE0,0x81692BE4,0x81692BE8,0x81692BEC,0x81692BF0,0x81692BF4,0x81692BF8,0x81692BFC,
0x8137C0C4,0x8137C0C8,0x8137C114,0x8137C118,0x8137C164,0x8137C168,0x8137B9C8,0x8137C0B4
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x3F200001,0x3B390008,0x3F004843,0x3B184C41,0x4E800020,
0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48317211,0x48316B39

4.1K:

Code:

[Disc Channel:  Wii -> HNCA  GC -> HCLA]
version=454
offset=0x81665440,0x81665444,0x81665448,0x8166544C,0x81665450,0x81665454,0x81665458,0x8166545C,0x81665460,0x81665464,
0x8137B3F8,0x8137B3FC,0x8137B448,0x8137B44C,0x8137B498,0x8137B49C,0x8137ACFC,0x8137B3E8
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x3F200001,0x3B390008,0x3F004843,0x3B184C41,0x4E800020,
0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x482EA745,0x482EA06D

4.2:

4.2J:

Code:

[Disc Channel:  Wii -> HNCA  GC -> HCLA]
version=480
offset=0x816C13A8,0x816C13AC,0x816C13B0,0x816C13B4,0x816C13B8,0x816C13BC,0x816C13C0,0x816C13C4,0x816C13C8,0x816C13CC,
0x8137B930,0x8137B934,0x8137B980,0x8137B984,0x8137B9D0,0x8137B9D4,0x8137B234,0x8137B920
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x3F200001,0x3B390008,0x3F004843,0x3B184C41,0x4E800020,
0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48346175,0x48345A9D

4.2U:

Code:

[Disc Channel:  Wii -> HNCA  GC -> HCLA]
version=481
offset=0x81691CA0,0x81691CA4,0x81691CA8,0x81691CAC,0x81691CB0,0x81691CB4,0x81691CB8,0x81691CBC,0x81691CC0,0x81691CC4,
0x8137C47C,0x8137C480,0x8137C4CC,0x8137C4D0,0x8137C51C,0x8137C520,0x8137BD80,0x8137C46C
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x3F200001,0x3B390008,0x3F004843,0x3B184C41,0x4E800020,
0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48315F21,0x48315849

4.2E:

Code:

[Disc Channel:  Wii -> HNCA  GC -> HCLA]
version=482
offset=0x81693B38,0x81693B3C,0x81693B40,0x81693B44,0x81693B48,0x81693B4C,0x81693B50,0x81693B54,0x81693B58,0x81693B5C,
0x8137C524,0x8137C528,0x8137C574,0x8137C578,0x8137C5C4,0x8137C5C8,0x8137BE28,0x8137C514
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x3F200001,0x3B390008,0x3F004843,0x3B184C41,0x4E800020,
0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48317D11,0x48317639

4.2K:

Code:

[Disc Channel:  Wii -> HNCA  GC -> HCLA]
version=486
offset=0x816662E0,0x816662E4,0x816662E8,0x816662EC,0x816662F0,0x816662F4,0x816662F8,0x816662FC,0x81666300,0x81666304,
0x8137B810,0x8137B814,0x8137B860,0x8137B864,0x8137B8B0,0x8137B8B4,0x8137B114,0x8137B800
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x3F200001,0x3B390008,0x3F004843,0x3B184C41,0x4E800020,
0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x482EB1CD,0x482EAAF5

4.3:

4.3J:

Code:

[Disc Channel:  Wii -> HNCA  GC -> HCLA]
version=512
offset=0x816C2F28,0x816C2F2C,0x816C2F30,0x816C2F34,0x816C2F38,0x816C2F3C,0x816C2F40,0x816C2F44,0x816C2F48,0x816C2F4C,
0x8137BAC8,0x8137BACC,0x8137BB18,0x8137BB1C,0x8137BB68,0x8137BB6C,0x8137B3CC,0x8137BAB8
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x3F200001,0x3B390008,0x3F004843,0x3B184C41,0x4E800020,
0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48347B5D,0x48347485

4.3U:

Code:

[Disc Channel:  Wii -> HNCA  GC -> HCLA]
version=513
offset=0x81693820,0x81693824,0x81693828,0x8169382C,0x81693830,0x81693834,0x81693838,0x8169383C,0x81693840,0x81693844,
0x8137C614,0x8137C618,0x8137C664,0x8137C668,0x8137C6B4,0x8137C6B8,0x8137BF18,0x8137C604
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x3F200001,0x3B390008,0x3F004843,0x3B184C41,0x4E800020,
0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48317909,0x48317231

4.3E:

Code:

[Disc Channel:  Wii -> HNCA  GC -> HCLA]
version=514
offset=0x816956B8,0x816956BC,0x816956C0,0x816956C4,0x816956C8,0x816956CC,0x816956D0,0x816956D4,0x816956D8,0x816956DC,
0x8137C6BC,0x8137C6C0,0x8137C70C,0x8137C710,0x8137C75C,0x8137C760,0x8137BFC0,0x8137C6AC
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x3F200001,0x3B390008,0x3F004843,0x3B184C41,0x4E800020,
0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x483196F9,0x48319021

4.3K:

Code:

[Disc Channel:  Wii -> HNCA  GC -> HCLA]
version=518
offset=0x81667E80,0x81667E84,0x81667E88,0x81667E8C,0x81667E90,0x81667E94,0x81667E98,0x81667E9c,0x81667EA0,0x81667EA4,
0x8137B9A8,0x8137B9AC,0x8137B9F8,0x8137B9FC,0x8137BA48,0x8137BA4C,0x8137B2AC,0x8137B998
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x3F200001,0x3B390008,0x3F004843,0x3B184C41,0x4E800020,
0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x482ECBD5,0x482EC4FD

This one can boot 2 channels, one for Wii discs, and one for GC discs. By default, it boots title 00010008-484E4341 [Hidden Channel - TitleID HNCA] ("NeoCORP") when you try to load a Wii disc, and title 00010008-48434C41 [Hidden title - TitleID HCLA] ("CFG Loader") when you try to load a GC disc. In the video example, HNCA contains an AutoBoot NeoGamma, and HCLA contains CFG USB Loader MOD r12. This hack can be useful if you want to boot a different app for GC discs than for Wii discs.

Third version - Single Channel, but Wii discs ONLY:
4.1:

4.1J:

Code:

[Disc Channel -> HNCA (Wii disc ONLY)]
version=448
offset=0x816C0408,0x816C040C,0x816C0410,0x816C0414,0x816C0418,0x8137ADD4
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x48345635

4.1U:

Code:

[Disc Channel -> HNCA (Wii disc ONLY)]
version=449
offset=0x81690D40,0x81690D44,0x81690D48,0x81690D4C,0x81690D50,0x8137B920
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x48315421

4.1E:

Code:

[Disc Channel -> HNCA (Wii disc ONLY)]
version=450
offset=0x81692BD8,0x81692BDC,0x81692BE0,0x81692BE4,0x81692BE8,0x8137B9C8
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x48317211

4.1K:

Code:

[Disc Channel -> HNCA (Wii disc ONLY)]
version=454
offset=0x81665440,0x81665444,0x81665448,0x8166544C,0x81665450,0x8137ACFC
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x482EA745

4.2:

4.2J:

Code:

[Disc Channel -> HNCA (Wii disc ONLY)]
version=480
offset=0x816C13A8,0x816C13AC,0x816C13B0,0x816C13B4,0x816C13B8,0x8137B234
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x48346175

4.2U:

Code:

[Disc Channel -> HNCA (Wii disc ONLY)]
version=481
offset=0x81691CA0,0x81691CA4,0x81691CA8,0x81691CAC,0x81691CB0,0x8137BD80
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x48315F21

4.2E:

Code:

[Disc Channel -> HNCA (Wii disc ONLY)]
version=482
offset=0x81693B38,0x81693B3C,0x81693B40,0x81693B44,0x81693B48,0x8137BE28
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x48317D11

4.2K:

Code:

[Disc Channel -> HNCA (Wii disc ONLY)]
version=486
offset=0x816662E0,0x816662E4,0x816662E8,0x816662EC,0x816662F0,0x8137B114
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x482EB1CD

4.3:

4.3J:

Code:

[Disc Channel -> HNCA (Wii disc ONLY)]
version=512
offset=0x816C2F28,0x816C2F2C,0x816C2F30,0x816C2F34,0x816C2F38,0x8137B3CC
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x48347B5D

4.3U:

Code:

[Disc Channel -> HNCA (Wii disc ONLY)]
version=513
offset=0x81693820,0x81693824,0x81693828,0x8169382C,0x81693830,0x8137BF18
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x48317909

4.3E:

Code:

[Disc Channel -> HNCA (Wii disc ONLY)]
version=514
offset=0x816956B8,0x816956BC,0x816956C0,0x816956C4,0x816956C8,0x8137BFC0
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x483196F9

4.3K:

Code:

[Disc Channel -> HNCA (Wii disc ONLY)]
version=518
offset=0x81667E80,0x81667E84,0x81667E88,0x81667E8C,0x81667E90,0x8137B2AC
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x482ECBD5

This version boots a channel, but ONLY when you try to load a Wii disc. By default, it boots title 00010008-484E4341 [Hidden Channel - TitleID HNCA] ("NeoCORP"). GC discs are unaffected by this version of the hack, and just boot normally.

Fourth version - Single Channel, but GC discs ONLY:
4.1:

4.1J:

Code:

[Disc Channel -> HNCA (GC disc ONLY)]
version=448
offset=0x816C0408,0x816C040C,0x816C0410,0x816C0414,0x816C0418,0x8137B4D0,0x8137B4D4,0x8137B520,0x8137B524,0x8137B570,0x8137B574,0x8137B4C0
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48344F49

4.1U:

Code:

[Disc Channel -> HNCA (GC disc ONLY)]
version=449
offset=0x81690D40,0x81690D44,0x81690D48,0x81690D4C,0x81690D50,0x8137C01C,0x8137C020,0x8137C06C,0x8137C070,0x8137C0BC,0x8137C0C0,0x8137C00C
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48314D35

4.1E:

Code:

[Disc Channel -> HNCA (GC disc ONLY)]
version=450
offset=0x81692BD8,0x81692BDC,0x81692BE0,0x81692BE4,0x81692BE8,0x8137C0C4,0x8137C0C8,0x8137C114,0x8137C118,0x8137C164,0x8137C168,0x8137C0B4
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48316B25

4.1K:

Code:

[Disc Channel -> HNCA (GC disc ONLY)]
version=454
offset=0x81665440,0x81665444,0x81665448,0x8166544C,0x81665450,0x8137B3F8,0x8137B3FC,0x8137B448,0x8137B44C,0x8137B498,0x8137B49C,0x8137B3E8
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x482EA059

4.2:

4.2J:

Code:

[Disc Channel -> HNCA (GC disc ONLY)]
version=480
offset=0x816C13A8,0x816C13AC,0x816C13B0,0x816C13B4,0x816C13B8,0x8137B930,0x8137B934,0x8137B980,0x8137B984,0x8137B9D0,0x8137B9D4,0x8137B920
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48345A89

4.2U:

Code:

[Disc Channel -> HNCA (GC disc ONLY)]
version=481
offset=0x81691CA0,0x81691CA4,0x81691CA8,0x81691CAC,0x81691CB0,0x8137C47C,0x8137C480,0x8137C4CC,0x8137C4D0,0x8137C51C,0x8137C520,0x8137C46C
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48315835

4.2E:

Code:

[Disc Channel -> HNCA (GC disc ONLY)]
version=482
offset=0x81693B38,0x81693B3C,0x81693B40,0x81693B44,0x81693B48,0x8137C524,0x8137C528,0x8137C574,0x8137C578,0x8137C5C4,0x8137C5C8,0x8137C514
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48317625

4.2K:

Code:

[Disc Channel -> HNCA (GC disc ONLY)]
version=486
offset=0x816662E0,0x816662E4,0x816662E8,0x816662EC,0x816662F0,0x8137B810,0x8137B814,0x8137B860,0x8137B864,0x8137B8B0,0x8137B8B4,0x8137B800
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x482EAAE1

4.3:

4.3J:

Code:

[Disc Channel -> HNCA (GC disc ONLY)]
version=512
offset=0x816C2F28,0x816C2F2C,0x816C2F30,0x816C2F34,0x816C2F38,0x8137BAC8,0x8137BACC,0x8137BB18,0x8137BB1C,0x8137BB68,0x8137BB6C,0x8137BAB8
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48347471

4.3U:

Code:

[Disc Channel -> HNCA (GC disc ONLY)]
version=513
offset=0x81693820,0x81693824,0x81693828,0x8169382C,0x81693830,0x8137C614,0x8137C618,0x8137C664,0x8137C668,0x8137C6B4,0x8137C6B8,0x8137C604
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x4831721D

4.3E:

Code:

[Disc Channel -> HNCA (GC disc only)]
version=514
offset=0x816956B8,0x816956BC,0x816956C0,0x816956C4,0x816956C8,0x8137C6BC,0x8137C6C0,0x8137C70C,0x8137C710,0x8137C75C,0x8137C760,0x8137C6AC
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x4831900D

4.3K:

Code:

[Disc Channel -> HNCA (GC disc ONLY)]
version=518
offset=0x81667E80,0x81667E84,0x81667E88,0x81667E8C,0x81667E90,0x8137B9A8,0x8137B9AC,0x8137B9F8,0x8137B9FC,0x8137BA48,0x8137BA4C,0x8137B998
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x482EC4E9

This version boots a channel, but ONLY when you try to load a GC disc. By default, it boots title 00010008-484E4341 [Hidden Channel - TitleID HNCA] ("NeoCORP"). Wii discs are unaffected by this version of the hack, and just boot normally.

Basic hack description:
It works by patching the part where the System Menu checks to see the IOS a disc wants, and then loads that IOS's Title ID. Instead of getting the Title ID for an IOS, the hack gives it a Title ID at it specifies. Normally, the sysmenu only uses 2 ASM commands to get the IOS's ID, but for a full channel Title ID, the hack had to use 4 ASM commands. So instead of just patching over the top of the existing 2 commands, the hack puts the 4 commands (plus a blr to return back) in an empty (value is all "00") part of the dol, then branch to that offset. And then for the GC part, the value had to be patch a few times, so I had to use a few more patches to copy the loaded Title ID over to those few areas too.

So, like I said, by default, those are the 2 channels that the hacks boot, but you can change them to any full Title ID you have installed on your Wii, and the Disc Channel will boot it.

Here is an example pack containing:
- the 2 example hidden channel Wads (both made with HideandSeek v0.9)
- a hacks.ini with the 4 hacks for 4.1, 4.2, and 4.3 (all regions) already put into it (plus the regular hacks for those sysmenus)
- and a modified priiloader 0.8 beta 2 (this version does seems to run stable under IOS249 unlike v0.7 and lower, allowing for backups to be loaded)
NeoGamma via Disc Channel PoC Pack r4 <- LINK UPDATED. Supports Wii Gamertags now. (HCLA wad has also been removed)

Extra links:
A modified hacks.ini by AbdallahTerro - with support for patched System Menu versions v54449 (patched 4.1U) and v54450 (patched 4.1E) for anyone who may need it.
Source for modified apps to comply with GPL:
NeoGamma R9 b56 Autoboot MOD r4 source <- Updated to MOD r4
priiloader v0.8 beta 2 MOD source <- Link has been updated! (fixes a silly bug in the "System Menu Hacks" menu)

Now to get this working on your own Wii.

Required items:
1. System Menu version 4.1, 4.2 or 4.3 installed
2. Ability to run homebrew (HBC installed) from SD card
3. Ability to install fakesigned wads
4. The above PoC pack
5. (optional) cIOS249 to load backups

How to:
1. grab the PoC pack linked to above, and extract it to the root of your SD card.
2. load up your favorite wad managing app, and use it to install the example sd:\wad\HNCA.wad ~~(and optionally HCLA.wad if you want to test out the Dual Channel hack)~~
3. if you have priiloader already, then you can skip this step if you do not want to overwrite the version you currently have. Load up the "priiloader v0.8b2" installer, and use it to install priiloader v0.8 beta 2. The installer should also copy the hacks.ini over to your Wii too.
4. Now boot into priiloader by resetting or switching on the wii, but while holding down RESET button as you boot it up, to access priiloader menu. When in the menu, go to "Settings", and then set "Use Classic hacks.ini" to "on". Save settings. If you are using certain versions of priiloader (v0.6 and v0.7 AFAIK), it might not find the hacks.ini on sd root. To get these versions of priiloader to read it, move it from sd:\hacks.ini to sd:\apps\priiliader\hacks.ini
5. Now go back to priiloader's main menu, and select "System Menu Hacks". Enable hacks you may like (such as region free everything, and block disc updates), then enable ONE of the Disc Channel hacks that you wish to test out. Save settings. NOTE: NEVER enable more than one of these Disc Channel hacks at a time! If you wish to try out another one, you must first disable the currently enabled one.

This will now allow the Disc Channel to load HNCA (NeoGamma autoboot, which I dubbed "NeoCORP"

) when you boot a disc ~~(or HNCA for WIi discs and HCLA (CFG USB Loader MOD with DML support) for GC discs if you are testing out the Dual Channel hack).~~ HCLA wad no longer included.

6. (optional step - Only do this if you are using specifically the above linked priiloader v0.8beta2 MOD! Using any other version priiloader and doing this will make priiloader lock up!)
- Load up priiloader once more, and go to Settings. Change the "Use System Menu IOS" to "off", then change "IOS to use for SM:" to "249". Save settings. This little extra, combined with loading the hidden autoboot NeoGamma HNCA channel, will allow you to load backup discs via the Disc Channel without cIOSCORP/DARKCORP! So it is not just retail games that benefit from this hack, backups can be loaded with this too.
7. (optional step - for use with the Autoboot NeoGamma HNCA channel)
- if you want to use Ocarina cheat codes in games via HNCA channel, just copy your .gct files to sd:\codes\, and then load up a game! Ocarina Cheat Codes Autocheat feature is enabled by holding A button when loading a disc.

Also, if you want, you can "like" this on FaceBook:
http://www.facebook....387949817885756

...OK! I think that explains most of it for you guys.

~~now I am going to get some sleep!~~

And I have a question (more like a request) now:
is anybody interested in maybe adding a few extra modifications to the above linked NeoGamma autoboot source (~~such as Wiinnertag/DUTag support~~ <- DONE.~~, or~~ saving config to NAND instead of relying on a SD card)? I believe these features would be very nice to use via Disc Channel, but I do not know how to add these features myself...

~~Goodnight gbatemp!~~
And as usual... Enjoy!

DJPlace · Feb 18, 2012

i'm going stick to the darkcorps and the only reason why is so i can still play my RB/GH/JD music through my sd card. but this still looks good. if i did have a different wii i would try this.

AbdallahTerro · Feb 18, 2012

can't wait to test this on my 4.1 PAL v54450 Wii
Nice stuff

SifJar · Feb 18, 2012

In case someone else wants to port, and wants to save a little time, here's what I got for the original values at each offset:

Code:

[Disc Channel - NeoGamma (HNCA)]
version=514
offset=0x816956B8,0x816956BC,0x816956C0,0x816956C4,0x816956C8,0x8137C6BC,0x8137C6C0,0x8137C70C,0x8137C710,0x8137C75C,0x8137C760,0x8137BFC0,0x8137C6AC
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x483196F9,0x4831900D

0x816956B8, 0x365BD8

0x816956BC, 0x365BDC

0x816956C0, 0x365BE0

0x816956C4, 0x365BE4

0x816956C8, 0x365BE8 **All 00 bytes above here - 4 commands and return, I assume **

0x8137C6BC, 0x4CBDC  [38 80 01 00 38 60 00 01 38 A0 00 00]

0x8137C6C0, 0x4CBE0  [38 60 00 01 38 A0 00 00 48 24 23 3D]

0x8137C70C, 0x4CC2C  [38 80 01 00 38 60 00 01 48 24 22 F1]

0x8137C710, 0x4CC30  [38 60 00 01 48 24 22 F1 7C 7D 1B 78]

0x8137C75C, 0x4CC7C  [38 80 01 00 38 60 00 01 48 24 1A 51]

0x8137C760, 0x4CC80  [38 60 00 01 48 24 1A 51 7C 7D 1B 78]

0x8137BFC0, 0x4C4E0  [2C 03 00 00 41 82 FF F8 3F 80 80 00]

0x8137C6AC, 0x4CBCC  [38 A0 00 01 4C C6 31 82 4B FF E9 A9]

format: offset in ini, offset - base address (0x8132FAE0) [original value]

Sadly without ASM knowledge I can't do anything more than that, not sure which offset is the branch command or where the BC stuff is overwritten.

Hopefully this is a little use to someone though, if anyone else capable of porting the hacks comes online before damysteryman ports and posts the hack for other SMs/regions.

XFlak · Feb 18, 2012

I found your voiceover as interesting as the hack itself

great job!

damysteryman · Feb 19, 2012

4.3K port:
Single Channel

Code:

[Disc Channel -> NeoGamma! (HNCA)]
version=518
offset=0x81667E80,0x81667E84,0x81667E88,0x81667E8C,0x81667E90,0x8137B9A8,0x8137B9AC,0x8137B9F8,0x8137B9FC,0x8137BA48,0x8137BA4C,0x8137B2AC,0x8137B998
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x482ECBD5,0x482EC4E9

Dual Channel

Code:

[Disc Channel:  Wii -> HNCA  GC -> HCLA]
version=518
offset=0x81667E80,0x81667E84,0x81667E88,0x81667E8C,0x81667E90,0x81667E94,0x81667E98,0x81667E9c,0x81667EA0,0x81667EA4,
0x8137B9A8,0x8137B9AC,0x8137B9F8,0x8137B9FC,0x8137BA48,0x8137BA4C,0x8137B2AC,0x8137B998
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x3F200001,0x3B390008,0x3F004843,0x3B184C41,0x4E800020,
0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x482ECBD5,0x482EC4FD

4.3U port:
Single Channel

Code:

[Disc Channel -> NeoGamma! (HNCA)]
version=513
offset=0x81693820,0x81693824,0x81693828,0x8169382C,0x81693830,0x8137C614,0x8137C618,0x8137C664,0x8137C668,0x8137C6B4,0x8137C6B8,0x8137BF18,0x8137C604
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48317909,0x4831721D

Dual Channel

Code:

[Disc Channel:  Wii -> HNCA  GC -> HCLA]
version=513
offset=0x81693820,0x81693824,0x81693828,0x8169382C,0x81693830,0x81693834,0x81693838,0x8169383C,0x81693840,0x81693844,
0x8137C614,0x8137C618,0x8137C664,0x8137C668,0x8137C6B4,0x8137C6B8,0x8137BF18,0x8137C604
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x3F200001,0x3B390008,0x3F004843,0x3B184C41,0x4E800020,
0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48317909,0x48317231

4.3J port:
Single Channel

Code:

[Disc Channel -> NeoGamma! (HNCA)]
version=512
offset=0x816C2F28,0x816C2F2C,0x816C2F30,0x816C2F34,0x816C2F38,0x8137BAC8,0x8137BACC,0x8137BB18,0x8137BB1C,0x8137BB68,0x8137BB6C,0x8137B3CC,0x8137BAB8
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48347B5D,0x48347471

Dual Channel

Code:

[Disc Channel:  Wii -> HNCA  GC -> HCLA]
version=512
offset=0x816C2F28,0x816C2F2C,0x816C2F30,0x816C2F34,0x816C2F38,0x816C2F3C,0x816C2F40,0x816C2F44,0x816C2F48,0x816C2F4C,
0x8137BAC8,0x8137BACC,0x8137BB18,0x8137BB1C,0x8137BB68,0x8137BB6C,0x8137B3CC,0x8137BAB8
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x3F200001,0x3B390008,0x3F004843,0x3B184C41,0x4E800020,
0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x7F04C378,0x7F23CB78,0x48347B5D,0x48347485

leo.uff · Feb 19, 2012

How can it be ported to hacks_hash.ini file?

damysteryman · Feb 19, 2012

Well, porting it to hacks_hash.ini can be done, but there are some values in the hack which are different for every System Menu, meaning the "One patch fits all" approach that hacks_hash.ini is designed for will not work for it, so there is not real need to port it to hacks_hash.ini at this time. I have also not had much experience with porting to hacks_hash.ini, so I am sticking with classic hacks.ini porting for now... possibly in the future I could try porting it, but no clue when.

Also everyone, first post has been updated with full 4.3 support! (all 4 regions of 4.3 that is)
4.2 support is coming next, then 4.1.

leo.uff · Feb 19, 2012

When I use single channel version It loads neogamma for WII and GC games. There is a way to use neogamma for WII games but disc channel for GC games? I have GC discs that cannot be played.

*sorry for my engish*

damysteryman · Feb 19, 2012

Well, I can edit the hack to do that... when I am finished porting the 2 existing hacks, I will be able to make a Wii only one and a GC only one after that.

Which system menu version are you currently using?

leo.uff · Feb 19, 2012

damysteryman said:
Well, I can edit the hack to do that... when I am finished porting the 2 existing hacks, I will be able to make a Wii only one and a GC only one after that.

Neogamma is unnecessary for GC games, so I think its will be the best option. I would be grateful for this option. You're doing a good job.

damysteryman · Feb 19, 2012

Well not necessarily... playing import GC games may require video mode patching to load, just like Wii games, and ocarina cheat support for GC discs can be useful too.

Also, I edited my previous post for you.

leo.uff · Feb 19, 2012

damysteryman said:
Which system menu version are you currently using?

4.3 U

DJPlace · Feb 19, 2012

i wonder if this will be safer then darkcorp?

leo.uff · Feb 19, 2012

damysteryman said:
Well not necessarily... playing import GC games may require video mode patching to load, just like Wii games, and ocarina cheat support for GC discs can be useful too.

Also, I edited my previous post for you.

I forgot that neogamma can play GC with some special settings. I´m not using the SD card with "neogamma" folder settings, maybe that's why the GC games didn't work.

damysteryman · Feb 19, 2012

DJPlace said:
i wonder if this will be safer then darkcorp?

Yes. Using this, along with using priiloader to load the sysmenu under IOS249 (use the v0.8b2 that I posted to prevent lockups), and you can load backup discs via Disc Channel, without the need for heaps of cIOS.

DJPlace · Feb 19, 2012

damysteryman said:
DJPlace said:

i wonder if this will be safer then darkcorp?

Click to expand...

Yes. Using this, along with using priiloader to load the sysmenu under IOS249 (use the v0.8b2 that I posted to prevent lockups), and you can load backup discs via Disc Channel, without the need for heaps of cIOS.

ok i'm going ask this and i said it earlier in my first post on this topic. is there going be a way to be able to play DLC music through this. like GH/RB/JD or do you think it's not possbile?

damysteryman · Feb 19, 2012

leo.uff said:
damysteryman said:

Which system menu version are you currently using?

Click to expand...

4.3 U

Try this one:

Code:

[Disc Channel -> HNCA (Wii disc ONLY)]
version=513
offset=0x81693820,0x81693824,0x81693828,0x8169382C,0x81693830,0x8137BF18
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x48317909

DJPlace said:
damysteryman said:

DJPlace said:

i wonder if this will be safer then darkcorp?

Click to expand...

Yes. Using this, along with using priiloader to load the sysmenu under IOS249 (use the v0.8b2 that I posted to prevent lockups), and you can load backup discs via Disc Channel, without the need for heaps of cIOS.

Click to expand...

ok i'm going ask this and i said it earlier in my first post on this topic. is there going be a way to be able to play DLC music through this. like GH/RB/JD or do you think it's not possbile?

Is NeoGamma / USB loaders incompatible with those games' DLC?
I would have to find out how that DLC stuff works before I can try to get it working. I believe there was a program floating around somewhere that could reencrypt the music DLC to be compatible with cIOS249 and loaders... but that is all I know about the music DLC stuff ATM...

leo.uff · Feb 19, 2012

damysteryman said:

Try this one:

Code:

[Disc Channel -> HNCA (Wii disc ONLY)]
version=513
offset=0x81693820,0x81693824,0x81693828,0x8169382C,0x81693830,0x8137BF18
value=0x3F200001,0x3B390008,0x3F00484E,0x3B184341,0x4E800020,0x48317909

Worked! Thanks man!

damysteryman · Feb 19, 2012

No problem

And also... everyone... BIG UPDATE!
Hack porting is complete! The first post has been updated with hacks for 4.1, 4.2, and 4.3 for all 4 regions!
2 more hack variations have been added too!
Be sure to redownload the PoC pack with the updated hacks.ini!

Hacking PoC - Boot NeoGamma via Disc Channel!

I am too busy IRL these days...

going hire Ronald McDonald To Gun Down Nintendo.

da KiNG

Not a pirate

Wiitired but still kicking

I am too busy IRL these days...

Active Member

I am too busy IRL these days...

Active Member

I am too busy IRL these days...

Active Member

I am too busy IRL these days...

Active Member

going hire Ronald McDonald To Gun Down Nintendo.

Active Member

I am too busy IRL these days...

going hire Ronald McDonald To Gun Down Nintendo.

I am too busy IRL these days...

Active Member

I am too busy IRL these days...

Similar threads

Popular threads in this forum