GCN Getting into GameCube Exploitation?

ChampionLeake

Console Hacker(?) I guess
Member
Joined
Jan 19, 2016
Messages
211
Reaction score
178
Trophies
0
XP
741
Country
United States
A couple of weeks ago I bought a GameCube to just play one of the games I loved when I was little but then I got interested in the exploits FIX94 was making and I wanted to produce my own findings since I did past work with the DS, DSi, and PSP.

If anyone who has experienced in developing GameCube exploits, I would like to know what tools to use, what emulator or program is good to debug crashes. Just the basic stuff I want to know how to get started. Anything would be appreciated.
 
For others reading along at home and that might have missed the GC stuff then https://gbatemp.net/threads/new-gamecube-exploits.420900/

Emulator wise it is basically Dolphin or nothing for now, though you might be able to contrive something with the Wii stuff. Some might go back to older versions if the debugger is broken/nerfed in a given one but that is about it.

There are hardware debuggers in the form of the USB gecko and its clones https://www.gc-forever.com/wiki/index.php?title=USBGecko and http://wiibrew.org/wiki/USB_Gecko The chips to make them got rare though and I have not kept up with current efforts.
There is also a lighter version in the way of the SD gecko ( https://www.gc-forever.com/wiki/index.php?title=SDGecko ) but that will not have nice debugging as much as a way to have homebrew load from it. Said loading probably being of limited use if you want to load save files to corrupt and don't have homebrew (or a GC ports Wii with homebrew which can then speak to SD cards, networks, USB and more) in the first place which is a limiting aspect of GC homebrew*. That said if this is for fun more than practical purposes then this is no great concern and it is more than possible to get a payload onto the GC.

Disassemblers and ISO manipulation are fairly standard fare among said said, ROM hackers and cheat makers. Should be some nice IDA modules out there as well. Not sure what the current hotness is but for something fairly bombproof then https://wit.wiimm.de/ . If you are looking at files then I should also mention yaz0 as a common archive/compression setup ( http://www.amnoid.de/gc/yaz0.txt for a nice listing, there are plenty of tools out there to handle it though and http://wiki.tockdom.com/wiki/U8 might also help here).

Hardware documentation wise then the sites already linked plus http://hitmen.c02.at/files/yagcd/yagcd/frames.html form the thing most use, though you might be able to divine some stuff from libogc part of devkitpro
https://devkitpro.org/

*if you want to do a GC equivalent of

then please do.

I don't know what approach you want to favour -- save files are the main one so any game... essentially with anything is a viable target to look at but most will opt for strings and other things of indeterminant length. You presumably then watch the save handler to see if it does a fixed length read (as opposed to waiting for an end of value, or has a length value in the save) and/or handles unexpected values, whether the data lands/overwrites somewhere useful (or somewhere you can force a jump to) and I guess you know all this. Safe coding practices were not common back then but I imagine some did it by accident if nothing else. If you are good you might be able to force a cheat to put your necessary code in rather than having to reverse engineer the save hash/checksum routine (complexity wise can be a simple bytesum but probably more in line with crc32 though SHA1 type common hashes), otherwise you will have to figure out said routine and code something for it (or maybe hack a game to be able to feed something to its routine and make the game itself an oracle of sorts).
 

Site & Scene News

Popular threads in this forum