Homebrew Injecting roms into VC? With only the web browser? Sure.

[shutterbug2000]

What would I have to do to detect input? As in, something like IFile_Read, but for the buttons.

 

[shutterbug2000]

What would I have to do to detect input? As in, something like IFile_Read, but for the buttons.

Would reading from 0x10000020 work?

http://www.3dbrew.org/wiki/HID_Shared_Memory

(Base addr from ctrulib)

 

[Oak]

I tried injecting Pokemon Yellow into Super Mario Land and got a yellow screen. renamed pokemon yellow.gb to rom.gbc

 

[shutterbug2000]

I tried injecting Pokemon Yellow into Super Mario Land and got a yellow screen. renamed pokemon yellow.gb to rom.gbc

Pokemon yellow is too big for mario land

 

[shutterbug2000]

Ok, question here. Since I can't seem to get input working(feel free to help ) What does everyone want for a file select?

 

[Oak]

Ok, question here. Since I can't seem to get input working(feel free to help ) What does everyone want for a file select?

I would assume Select button would be the best option?

 

[ad2099]

question

Can you not do something to close and open a different rom with a single code.bin?

and yes, is best button select

 

[TUWieZ]

Ok, question here. Since I can't seem to get input working(feel free to help ) What does everyone want for a file select?

Not sure if you checked it out but earlier I posted something from gameyob's source. Dunno if it's filechooser can be interpreted in any way to work with code.bin though (For example a scrollable gb/gbc file select after loading browser exploit, injecting the selected rom followed by the green/yellow/red bottom screen)
https://github.com/Drenn1/GameYob/blob/master/platform/common/filechooser.cpp

 

[duke_srg]

Revamped first post with KazoWAR's code.bin, and a list of goals

Can you also make a note about my build for bookmark-based ROM selection, IMO it will be helpful for the time of GUI is WIP.

 

[KongsNutz]

Pokemon Yellow injected to Zelda Seasons perfect except no Pikachu Voice.
Saves Work..... super.

Results: 2DS - 9.4 FW

Game Rom | Injected Into | Results

Pokemon Yellow | Zelda Oracle Seasons | OKAY
Pokemon Gold | Zelda Oracle Seasons | OKAY
Pokemon Yellow | Pokemon Card Game | OKAY
Pokemon Gold | Pokemon Card Game | OKAY
Metal Gear solid | Zelda Oracles Seasons | OKAY

All work so far.

 

[duke_srg]

Observin Smealum's regionthree stuff gives me a clue how to avoid file writing to SD and patch filename in code.bin in ROP directly. Will try a bit later.

 

[ZOOT]

Given that's the instruction from the original post, what did you name the rom? iirc at first it used rom.nes but if you're using kazo's it needs to be rom.gbc

Also clearing browser cache/history is important. Let us know what color the bottom screen changes to upon browser crash too
Red-Rom not found (Could be named incorrectly)
Yellow-Rom too big for VC
Green-Should be good

It gives pixelated screen in rainbow colors!!!

 

[duke_srg]

OK, everyone may delete VC.bin and VC.rom files from the SD, the updated version works with KazoWAR's code.bin from the topic start and patches rom filename code.bin on the fly. Max length is now 25 characters, which is precompiled in code.bin, subfolders also working. Be warned that this VC.bin is stick to the curent code.bin made 27.01.2015 and 1240 bytes long. If file changes I'll need to fix offset and/or length values which is precomiled in VC.dat

KazoWAR can you additional color indication for rom file not found situation? I'm in the ROP coding now and just have no time to find the reference for file functions offsets.

Spoiler: VC.S

	.arm
	.text

#define SELF_LOC		0x08B88400
#define BUFFER_LOC		0x18410000
#define CODE_SIZE		0x00004000
#define CODE_TARGET		0x19592000
#define CODE_JUMP		0x009D2000
#define ROM_FILE_NAME_OFFSET	0x000003B4
#define ROM_FILE_NAME_SIZE	0x0000003E

	.global	_start
@---------------------------------------------------------------------------------
_start:
	@ mount SD
		.word 0x0010C2FC @ LDMFD   SP!, {R0,PC}
			.word 0x001050B3 @ R0 = "dmc:"
		.word 0x0019CA34 @ FS_MOUNTSDMC(), then LDMFD   SP!, {R3-R5,PC}
			.word 0xDEADBEEF @ R3, dummy
			.word 0xDEADBEEF @ R4, dummy
			.word 0xDEADBEEF @ R5, dummy
		.fill	45, 4, 0x001057C4 @ POP {PC} / nop * 59
	@ open file
		.word 0x001946EB @ POP     {R0-R4,R7,PC}
			.word 0x08F10000 @ R0 = this
			.word SELF_LOC+FileName @ R1 = filename
			.word 0x00000001 @ R2 = permission
			.word 0xDEADBEEF @ R3, dummy
			.word 0xDEADBEEF @ R4, dummy
			.word 0xDEADBEEF @ R7, dummy
		.word 0x0022FE0C @ IFile_Open(), then LDMFD   SP!, {R4-R7,PC}
			.word 0xDEADBEEF @ R4, dummy
			.word 0xDEADBEEF @ R5, dummy
			.word SELF_LOC+_start+0x8C @ R6, dummy init 1
			.word 0xDEADBEEF @ R7, dummy
		.word 0x001057C4 @ POP {PC}
	@ read payload
		.word 0x001946EB @ POP     {R0-R4,R7,PC}
			.word 0x08F10000 @ R0 = this
			.word 0x08F10020 @ R1 = total_read
			.word BUFFER_LOC @ R2 = buffer
			.word CODE_SIZE @ R3 = size
			.word 0xDEADBEEF @ R4, dummy
			.word 0xDEADBEEF @ R7, dummy
		.word 0x001686E0 @ IFile_Read, then LDMFD   SP!, {R4-R9,PC}
			.word 0xDEADBEEF @ R4, dummy
			.word 0xDEADBEEF @ R5, dummy
			.word SELF_LOC+_start @ R6, dummy init 2
			.word 0x001057C4 @ R7, dummy init 3
			.word 0x001057C4 @ R8, dummy init 4
			.word 0xDEADBEEF @ R9, dummy
	@patch rom filename
		.word 0x0010b5b4 @ pop {r0, r1, r2, r3, r4, pc}
			.word BUFFER_LOC+ROM_FILE_NAME_OFFSET @ r0 (dst)
			.word SELF_LOC+FileNameRom @ r1 (src)
			.word ROM_FILE_NAME_SIZE @ r2 (size)
			.word 0xDEADC0DE @ r3 (garbage)
			.word 0xDEADC0DE @ r4 (garbage)
		.word 0x00240B54 @ memcpy (ends in LDMFD   SP!, {R4-R10,LR})
			.word 0xDEADC0DE @ r4 (garbage)
			.word 0x0010C2FC @ r5 (garbage) init 5
			.word SELF_LOC+_start+0x218 @ r6 (garbage) init 6
			.word 0xDEADC0DE @ r7 (garbage)
			.word 0xDEADC0DE @ r8 (garbage)
			.word 0xDEADC0DE @ r9 (garbage)
			.word 0xDEADC0DE @ r10 (garbage)
	@ flush data cache
		.word 0x0010b5b4 @ pop {r0, r1, r2, r3, r4, pc}
			.word 0x003DA72C @ r0 (handle ptr)
			.word 0xFFFF8001 @ r1 (kprocess handle)
			.word BUFFER_LOC  @ r2 (address)
			.word CODE_SIZE @ r3 (size)
			.word 0xDEADC0DE @ r4 (garbage)
		.word 0x0013035C @ pop {lr, pc}
			.word 0x001057c4 @ lr (pop {pc})
		.word 0x0012c1e0 @ GSPGPU_FlushDataCache
	@ send GX command
		.word 0x0010c2fc @ pop {r0, pc}
			.word 0x3D7C40+0x58 @ r0 (nn__gxlow__CTR__detail__GetInterruptReceiver)
		.word 0x00228af4 @ pop {r1, pc}
			.word SELF_LOC+gxCommand @ r1 (cmd addr)
		.word 0x0013035C @ pop {lr, pc}
			.word 0x001057c4 @ lr (pop {pc})
		.word 0x0012BF04 @ nn__gxlow__CTR__CmdReqQueueTx__TryEnqueue
	@ sleep for a bit
		.word 0x0010c2fc @ pop {r0, pc}
			.word 0x3B9ACA00 @ r0 (one second)
		.word 0x00228af4 @ pop {r1, pc}
			.word 0x00000000 @ r1 (nothing)
		.word 0x0013035C @ pop {lr, pc}
			.word 0x001057c4 @ lr (pop {pc})
		.word 0x001041f8 @ svc 0xa | bx lr
	@ jump to code
		.word CODE_JUMP
	.fill	10, 4, 0
Self:
	.word SELF_LOC+Self @ Self 1
	.word 0x001057C4 @ Self 2 POP {PC} 
gxCommand:
	.word 0x00000004 @ command header (SetTextureCopy)
	.word BUFFER_LOC @ source address
	.word CODE_TARGET @ destination address
	.word CODE_SIZE @ size
	.word 0xFFFFFFFF @ dim in
	.word 0xFFFFFFFF @ dim out
	.word 0x00000008 @ flags
	.word 0x00130344 @ unused Self 3
.align	2
FileNameRom:
	.string16 "dmc:/rom.gbc"
	.fill	18, 2, 0
.align	2
FileName:
	.string16 "dmc:/code.bin"

 

[shutterbug2000]

Not sure if you checked it out but earlier I posted something from gameyob's source. Dunno if it's filechooser can be interpreted in any way to work with code.bin though (For example a scrollable gb/gbc file select after loading browser exploit, injecting the selected rom followed by the green/yellow/red bottom screen)
https://github.com/Drenn1/GameYob/blob/master/platform/common/filechooser.cpp

Sure, I'll take a look.

 

[TUWieZ]

It gives pixelated screen in rainbow colors!!!

Sounds like you're using the first working code.bin, I think kazoWAR's was the one that gives a solid color on bottom screen indicating what exactly happened
http://www.mediafire.com/download/0583oa67e42jyqf/GBCRomSwap.rar
Download this one and replace whatever code.bin is on your SD with it, and make sure the rom youre using is named rom.gbc

 

[TUWieZ]

Sure, I'll take a look.

Awesome, keep us posted if you think its possible to implement :>

 

[shutterbug2000]

Awesome, keep us posted if you think its possible to implement :>

Well, progres at least. Implementing button presses seems to be possible . Now, as for the gui: Also possible, but here's the problem: It's going to be complicated/ time-consuming to make. The only way I see is to make it just put the text on a solid background, by using the current color display, but "replacing" pixels as it goes. Does anyone know a simpler way?

 

[TUWieZ]

Well, progres at least. Implementing button presses seems to be possible . Now, as for the gui: Also possible, but here's the problem: It's going to be complicated/ time-consuming to make. The only way I see is to make it just put the text on a solid background, by using the current color display, but "replacing" pixels as it goes. Does anyone know a simpler way?

Great progress :>
I think I know what you're talking about with the replacing pixels issue though. When scrolling through a rom list in Gameyob there's this slightly noticeable frame buffer. Not too sure if that's the same thing but it's possible that drenn had the same issue you're referring to while he was coding gameyob

 

[Gettwobirdsstone]

is there a VC that allows voice effects from Pikachu, I'm using Wario Land 2. just doesn't even play the sound effect.

 

[froggestspirit]

not 100% sure how pikachu's voice works (one of the few things I never looked into in gameboy code-wise) I do think that taz 2 has voiceclips too? I cant remember.
Has anyone tried this with GBA? I'd like to take a look at some of the memory dumps of various non-injected VC, at the point of when the memory get's injected, or just normal gameplay. If it's not encrypted, i might be able to figure out a way to have less restrictions on rom sizes and whatnot. (or atleast tell me a method I could memory dump these, I had GBA VC working on CFW)