Hacking Post your WiiU cheat codes here!

[LawnMeower]

Can I expect them to be in a specific memory range?

mainly beneath 11000000 but foats can be found everywhere. if you find a 3d model in memory you can corrupt it

 

[HackingNewbie]

mainly beneath 11000000 but foats can be found everywhere. if you find a 3d model in memory you can corrupt it

So using the F0 codetype with a range of 10000000-11000000 would be a good place to start?

 

[LawnMeower]

So using the F0 codetype with a range of 10000000-11000000 would be a good place to start?

the F0 codetype is currently broken because it overwrites itself which cause the system to freeze since it's the executable range

 

[HackingNewbie]

the F0 codetype is currently broken because it overwrites itself which cause the system to freeze since it's the executable range

Oh ok it's a fairly small range anyway I could just look through the memory viewer. Thanks for the help!

 

[BullyWiiPlaza]

the F0 codetype is currently broken because it overwrites itself which cause the system to freeze since it's the executable range

We need something to search for a template in a range with variable length and load that into pointer

For example:

F2000000 00000008 # Length to search (8)
10000000 40000000 # Address range (0x10000000 - 0x40000000)
13371337 13371337 # What to search (1337133713371337)
00120000 00000004 # Offset for 32-Bit RAM write (4)
13381338 00000000 # Value to write (13381338)
D0000000 DEADCAFE # Terminator

Sometimes finding byte sequences is better than finding a pointer or to make a code region free/compatible with every TCP Gecko Installer layout. For optimization replace something in the code with the found address to avoid scanning every time. For example the length

F2000000 11000000 # Found address now written here (0x11000000)
10000000 40000000 # Address range (0x10000000 - 0x40000000)
13371337 13371337 # What to search (1337133713371337)
00120000 00000004 # Offset for 32-Bit RAM write (4)
13381338 00000000 # Value to write (13381338)
D0000000 DEADCAFE # Terminator

 

[TrixNiiSama]

Also I need some help with that item code, like I swear I'm doing it right, but it won't really do anything. And I am on 4.0. I am using the memory viewer, and I am using this tutorial for changing the values:
pls help

--------------------- MERGED ---------------------------


And I don't think that the milliseconds match up when I divided by 1000.

@BullyWiiPlaza I tried to found the code for the infinite shroom in mk8 but your video worked only on 4.0, im on 4.1. Can you release here the code plz ?

 

[Arck]

@BullyWiiPlaza I tried to found the code for the infinite shroom in mk8 but your video worked only on 4.0, im on 4.1. Can you release here the code plz ?

 

[SuperSayianGod]

Make sure that you do everything correct.
Use PyGecko via Webbrowser, example my hosting website or Loadiine.ovh and enter the ip which you get into the trainer
start hyrule warriors and press connect.
If rupees and other stuff not work, then I cant help you. :/

Thanks for the Reply but if you can't offer any further Help beside the little to none you have already then it don't solve my issue. Like I stated before I tried your Trainer it did not work so I moved on to J Gecko U and was Asking if Someone Knew where to find Codes for the DLC Characters for Level Up to 255.

 

[Ravstor]

MK8 PAL - This is my Cycle items.
These are the only ones I use because of the bug that drop items

Spoiler

09020000 1F604EA0
00000400 00000000
00020000 11000080
00000001 00000000
D0000000 DEADCAFE
09020000 1F604EA0
00000800 00000000
00020000 11000080
00000002 00000000
D0000000 DEADCAFE
09020000 1F604EA0
00000200 00000000
00020000 11000080
00000004 00000000
D0000000 DEADCAFE
09020000 1F604EA0
00000100 00000000
00020000 11000080
00000010 00000000
D0000000 DEADCAFE
09020000 1F604EA0
00000004 00000000
00020000 11000080
00000008 00000000
D0000000 DEADCAFE

I am looking for a instant sparks

 

[HackingNewbie]

I am looking for a instant sparks

If, you can make a cycle items, you can make that easily, right?

 

[Ravstor]

If, you can make a cycle items, you can make that easily, right?

I modified the Cycle Items of @BullyWiiPlaza putting the items you should use until the fix. I'd like to find the instant spark code

 

[HackingNewbie]

I modified the Cycle Items of @BullyWiiPlaza putting the items you should use until the fix. I'd like to find the instant spark code

oh ok

 

[Ravstor]

oh ok

I'll wait him for a response

 

[LawnMeower]

We need something to search for a template in a range with variable length and load that into pointer

For example:

F2000000 00000008 # Length to search (8)
10000000 40000000 # Address range (0x10000000 - 0x40000000)
13371337 13371337 # What to search (1337133713371337)
00120000 00000004 # Offset for 32-Bit RAM write (4)
13381338 00000000 # Value to write (13381338)
D0000000 DEADCAFE # Terminator

Sometimes finding byte sequences is better than finding a pointer or to make a code region free/compatible with every TCP Gecko Installer layout. For optimization replace something in the code with the found address to avoid scanning every time. For example the length

F2000000 11000000 # Found address now written here (0x11000000)
10000000 40000000 # Address range (0x10000000 - 0x40000000)
13371337 13371337 # What to search (1337133713371337)
00120000 00000004 # Offset for 32-Bit RAM write (4)
13381338 00000000 # Value to write (13381338)
D0000000 DEADCAFE # Terminator

thatspossible. but idk if thatd work with a huge range without freezing the system since it always does if the codehandler does not blr for too long :/

 

[HackingNewbie]

thatspossible. but idk if thatd work with a huge range without freezing the system since it always does if the codehandler does not blr for too long :/

Perhaps keeping count of the bytes evaluated and blr when it reaches a certain amount of bytes (maybe 1000 bytes or something? Don't know how frequently the codehandler needs to blr ) would be possible?

 

[DarkFlare69]

We need something to search for a template in a range with variable length and load that into pointer

For example:

F2000000 00000008 # Length to search (8)
10000000 40000000 # Address range (0x10000000 - 0x40000000)
13371337 13371337 # What to search (1337133713371337)
00120000 00000004 # Offset for 32-Bit RAM write (4)
13381338 00000000 # Value to write (13381338)
D0000000 DEADCAFE # Terminator

Sometimes finding byte sequences is better than finding a pointer or to make a code region free/compatible with every TCP Gecko Installer layout. For optimization replace something in the code with the found address to avoid scanning every time. For example the length

F2000000 11000000 # Found address now written here (0x11000000)
10000000 40000000 # Address range (0x10000000 - 0x40000000)
13371337 13371337 # What to search (1337133713371337)
00120000 00000004 # Offset for 32-Bit RAM write (4)
13381338 00000000 # Value to write (13381338)
D0000000 DEADCAFE # Terminator

A good example would be MK8 speed, it says like MaxSpd

 

[BullyWiiPlaza]

thatspossible. but idk if thatd work with a huge range without freezing the system since it always does if the codehandler does not blr for too long :/

You don't have to pick a huge range so it doesn't matter. Mostly the range is quite small obviously so it will be found very quickly

A good example would be MK8 speed, it says like MaxSpd

I also found other examples for MK8 where I would make use of this lol e.g. for No Lakitu online

 

[jbuck1975]

Okay, that's good. Add every pointer you got and go into different levels. It will say if the pointer is invalid, at which case you can be sure the correct pointer is not that one. After you've gotten rid of all the invalid pointers, there might be some that point to the wrong address despite being valid, so you should test for that as well. Tell me the pointer that works and I can explain how it's put into a code. Then you can adapt the tutorial to any pointer

[0x1EC6F72C] - 0x158
I believe this one is it.

 

[HackingNewbie]

[0x1EC6F72C] - 0x158
I believe this one is it.

Okay, so the general scheme is like this: (please note this is not for pointer in pointers)

30000000 LLLLLLLL
RANGE_ST RANGE_EN
31000000 QQQQQQQQ
001S0000 VVVVVVVV
D0000000 DEADCAFE

where L is the address in pointer (in this case, 0x1EC6F72C), the second line denotes the range that the address that the pointer is pointing to should be in (in this case, 10000000-20000000 should be fine), S is the value size (1 = 8-bit, 2 = 16-bit, 3 = 32-bit. You will have to plug this in as I do not know what type of write should be used ), Q is a signed offset denoting the offset after the pointer (-0x158 in this case, which when put into a signed value would be 0xFFFFFEA8) and V is the value to write. So, the code would be:

30000000 1EC6F72C
10000000 20000000
31000000 FFFFFEA8
001S0000 VVVVVVVV
D0000000 DEADCAFE

Please do tell if this doesn't work

 

[Mr.???]

Can someone please tell me how to make a proper moonjump. I'm always hearing that you need to find the y velocity or something like that but I don't even know what that is nor would I know how to find it if I did. Don't ignore this please.