So obviously it varies from title to title, but here's an example from a recent hack, Rygar. I'll add some comments for good places to do some code insertions. This is specifically the USA version, EUR is different again.
Code:
801B7374 lwz r6, 0x000C (r3) read_kpad_acc ; this is what i use for complex games
801B7378 addi r4, r30, 12 read_kpad_acc
801B737C lwz r5, 0x0010 (r3) read_kpad_acc
801B7380 lwz r0, 0x0014 (r3) read_kpad_acc
801B7384 stfs f4, 0x04AC (r3) read_kpad_acc ; the Z axis gets written here
801B7388 mr r3, r30 read_kpad_acc
801B738C lfs f1, 0x04A4 (r30) read_kpad_acc ; this reads in the X axis
801B7390 stw r6, 0x0014 (sp) read_kpad_acc
801B7394 stw r5, 0x0018 (sp) read_kpad_acc
801B7398 stw r0, 0x001C (sp) read_kpad_acc
801B739C bl ->0x801B6EA8 --> calc_acc
801B73A0 lfs f1, 0x04A8 (r30) read_kpad_acc ; this reads in the Y axis (good for simple games)
801B73A4 mr r3, r30 read_kpad_acc
801B73A8 addi r4, r30, 16 read_kpad_acc
801B73AC bl ->0x801B6EA8 --> calc_acc
801B73B0 lfs f1, 0x04AC (r30) read_kpad_acc ; this reads in the Z axis (")
801B73B4 mr r3, r30 read_kpad_acc
801B73B8 addi r4, r30, 20 read_kpad_acc
801B73BC bl ->0x801B6EA8 --> calc_acc
For games with this rough format (probably about 2008 onward?), this gives you a couple of options. I mostly inject at the first instruction because it means I definitely have
r0,
r4,
r5 and
r6 available to do GPR stuff and
f0,
f1,
f2 and
f3 to do FPR stuff.
The value that's currently in
f4 is the Z axis about to be written out (see comment), so you can just load some other value into
f4 to replace the real accelerometer data. To replace the X and Y axes, you'll need to write to
0x???? (r30) (offset varies by SDK version but if you find something like the above, you can see the offsets the game is using). In this case, you need to write to
0x04A4 (r30) for the X axis and
0x04A8 (r30) for the Y axis.
If the game you're looking at only needs you to work with a single axis (in particular Y or Z), you can use the points where the Y and Z axes get read in from
0x04A8 (r30) and
0x04AC (r30). In this case,
r0,
r3 and
r4 are definitely free and
f1 needs to be replaced with fake data.