Hacking WiiU VC game injection working on 5.3.2

[fiveighteen]

Creeping through hex data...

Map Mode (0xFFD5 HiROM or 0x7FD5 LoROM):
This byte determines how the mapping should be in the ROM image. It also determines if the ROM is a FastROM or not. Format of the byte: xxAAxxxB. If both A bits are set, FastROM is set. If B is set, the ROM is HiROM. x = Most likely unused.

8 bits in a byte.

Super Mario Kart is 31
Bike Daisuki! Hashiriya Damashii - Rider's Spirits is 31
Lock On is 31
Pilotwings is 20

31 = 00110001, so FastROM is set and they are HiROM
20 = 00100000, so FastROM is not set and it is LoROM

ROM Type (0xFFD6 HiROM or 0x7FD6 LoROM):
For ROMs without an enhancement chip, these are the possible values:
$00: ROM Only
$01: ROM + RAM
$02: ROM + RAM + SRAM

For ROMs with an enhancement chip:
$0*: DSP
$1*: SuperFX
$2*: OBC1
$3*: SA-1
$E*: other
$F*: custom chip

And then:
$*3: ROM + Enhancement Chip
$*4: ROM + Enhancement Chip + RAM
$*5: ROM + Enhancement Chip + RAM + SRAM
$*6: ROM + Enhancement Chip + SRAM.

Combining the two numbers will give you different ROM types. If you want SuperFX with only ROM + chip, you need to input value $13.

Super Mario Kart is 05, so it's ROM + Enhancement Chip + RAM + SRAM
Bike Daisuki! Hashiriya Damashii - Rider's Spirits is 05, so it's ROM + Enhancement Chip + RAM + SRAM
Lock On is 03, so it's ROM + Enhancement Chip
Pilotwings is 03, so it's ROM + Enhancement Chip

Injecting Lock On and Bike Daisuki works, while injecting Pilotwings doesn't. So this can't be the limiting factor.

ROM Size (0xFFD7 HiROM or 0x7FD7 LoROM)
$09: 3-4MBit
$0A: 5-8MBit
$0B: 9-16Mbit
$0C: 17-32MBit
$0D 33-64MBit.
Alternatively, to calculate the size: Amount of bytes = 2048^decimal value

Super Mario Kart is 09, so it's 3-4MBit
Bike Daisuki! Hashiriya Damashii - Rider's Spirits is 09, so it's 3-4MBit
Lock On is 09, so it's 3-4MBit
Pilotwings is 09, so it's 3-4MBit

SRAM Size (0xFFD8 HiROM or 0x7FD8 LoROM)
This byte determines the size of the .srm file (SRAM). To calculate the size: Amount of kilobytes = 2048*2^decimal value

Super Mario Kart is 01
Bike Daisuki! Hashiriya Damashii - Rider's Spirits is 01
Lock On is 00
Pilotwings is 00

Injecting Lock On and Bike Daisuki works, while injecting Pilotwings doesn't. So this can't be the limiting factor.



Potential fixes:
1) Convert Pilotwings to FastROM?
2) Convert Pilotwings to HiROM?

EDIT: After some reading, I think using FastROM over SlowROM would be a bad idea. Let's see about HiROM.

--------------------- MERGED ---------------------------


@the_randomizer,
pedro702 is saying to download Super Mario RPG from the internets, and then hex edit both that and Kirby's Dream Land 3 (which you have on VC). Take Kirby's header and put it on SMRPG. Then inject SMPRG overtop of Kirby.

 

[the_randomizer]

Creeping through hex data...


8 bits in a byte.

Super Mario Kart is 31
Bike Daisuki! Hashiriya Damashii - Rider's Spirits is 31
Lock On is 31
Pilotwings is 20

31 = 00110001, so FastROM is set and they are HiROM
20 = 00100000, so FastROM is not set and it is LoROM


Super Mario Kart is 05, so it's ROM + Enhancement Chip + RAM + SRAM
Bike Daisuki! Hashiriya Damashii - Rider's Spirits is 05, so it's ROM + Enhancement Chip + RAM + SRAM
Lock On is 03, so it's ROM + Enhancement Chip
Pilotwings is 03, so it's ROM + Enhancement Chip

Injecting Lock On and Bike Daisuki works, while injecting Pilotwings doesn't. So this can't be the limiting factor.


Super Mario Kart is 09, so it's 3-4MBit
Bike Daisuki! Hashiriya Damashii - Rider's Spirits is 09, so it's 3-4MBit
Lock On is 09, so it's 3-4MBit
Pilotwings is 09, so it's 3-4MBit


Super Mario Kart is 01
Bike Daisuki! Hashiriya Damashii - Rider's Spirits is 01
Lock On is 00
Pilotwings is 00

Injecting Lock On and Bike Daisuki works, while injecting Pilotwings doesn't. So this can't be the limiting factor.



Potential fixes:
1) Convert Pilotwings to FastROM?
2) Convert Pilotwings to HiROM?

EDIT: After some reading, I think using FastROM over SlowROM would be a bad idea. Let's see about HiROM.

--------------------- MERGED ---------------------------


@the_randomizer,
pedro702 is saying to download Super Mario RPG from the internets, and then hex edit both that and Kirby's Dream Land 3 (which you have on VC). Take Kirby's header and put it on SMRPG. Then inject SMPRG overtop of Kirby.

Interesting find, what will this all mean, from the look of things, it looks like Pilotwings might be able to work if one where to make it from a LoROM to HiROM? And I see your edit, the header in Super Mario RPG goes all the across the first line, but Kirby's Dream Land 3 goes all away across the first and part of the second. What I want to know is if the two lines of hex should be swapped from one to another, if that makes any sense.

Kirby's Dream Land 3 is:

00007FC0 4B 49 52 42 59 27 53 20 44 52 45 41 4D 20 4C 41 KIRBY'S DREAM LA
00007FD0 4E 44 20 33 20 23 35 0C 05 01 33 00 83 DB 7C 24 ND 3 #5...3.ƒÛ|$

(Bytes 4B through 44 on the second line form the title ID itself, the rest of the second line contains "3 #5...3.ƒÛ|$" )

Super Mario RPG on the other hand:

00007FC0 53 55 50 45 52 20 4D 41 52 49 4F 20 52 50 47 20 SUPER MARIO RPG
00007FD0 20 20 20 20 20 23 35 0C 05 00 33 00 8A BA 75 45 #5...3.ŠºuE

(Only bytes 53 through 20 spell the title ID here, should I copy both lines from the Kirby game over this and then try? Sorry I'm asking so many questions.)

 

[fiveighteen]

Interesting find, what will this all mean, from the look of things, it looks like Pilotwings might be able to work if one where to make it from a LoROM to HiROM? And I see your edit, the header in Super Mario RPG goes all the across the first line, but Kirby's Dream Land 3 goes all away across the first and part of the second. What I want to know is if the two lines of hex should be swapped from one to another, if that makes any sense.

Kirby's Dream Land 3 is:

00007FC0 4B 49 52 42 59 27 53 20 44 52 45 41 4D 20 4C 41 KIRBY'S DREAM LA
00007FD0 4E 44 20 33 20 23 35 0C 05 01 33 00 83 DB 7C 24 ND 3 #5...3.ƒÛ|$

(Bytes 4B through 44 on the second line form the title ID itself, the rest of the second line contains "3 #5...3.ƒÛ|$" )

Super Mario RPG on the other hand:

00007FC0 53 55 50 45 52 20 4D 41 52 49 4F 20 52 50 47 20 SUPER MARIO RPG
00007FD0 20 20 20 20 20 23 35 0C 05 00 33 00 8A BA 75 45 #5...3.ŠºuE

(Only bytes 53 through 20 spell the title ID here, should I copy both lines from the Kirby game over this and then try? Sorry I'm asking so many questions.)

Never be sorry to learn something. At least you're putting forth a good effort and not just wanting to be spoon fed instructions

The internal ROM name is 21 bytes, so you want to copy from 7FC0 all the way to 7FD5

COPY:
00007FC0 4B 49 52 42 59 27 53 20 44 52 45 41 4D 20 4C 41 KIRBY'S DREAM LA
00007FD0 4E 44 20 33 20 23 35 0C 05 01 33 00 83 DB 7C 24 ND 3 #5...3.ƒÛ|$

PASTE:
00007FC0 53 55 50 45 52 20 4D 41 52 49 4F 20 52 50 47 20 SUPER MARIO RPG
00007FD0 20 20 20 20 20 23 35 0C 05 00 33 00 8A BA 75 45 #5...3.ŠºuE

But like I said, this is just the internal ROM name... I don't see how this will make a game work? Seems to me like convincing John that his name is actually Joe and then expecting him to start acting like Joe too. I'm not exactly sure what @VinsCool had edited for N64 or what @pedro702 was thinking to do..

To me, a more likely bet is to try copy/pasting from 7FB0 to 7FC0 to change the entire section of ROM Registration Data, or copy/paste 7FC0 all the way to 7FE0 to do the entire section of ROM Specifications. Or try both at the same time.

 

[the_randomizer]

Never be sorry to learn something. At least you're putting forth a good effort and not just wanting to be spoon fed instructions

The internal ROM name is 21 bytes, so you want to copy from 7FC0 all the way to 7FD5

COPY:
00007FC0 4B 49 52 42 59 27 53 20 44 52 45 41 4D 20 4C 41 KIRBY'S DREAM LA
00007FD0 4E 44 20 33 20 23 35 0C 05 01 33 00 83 DB 7C 24 ND 3 #5...3.ƒÛ|$

PASTE:
00007FC0 53 55 50 45 52 20 4D 41 52 49 4F 20 52 50 47 20 SUPER MARIO RPG
00007FD0 20 20 20 20 20 23 35 0C 05 00 33 00 8A BA 75 45 #5...3.ŠºuE

But like I said, this is just the internal ROM name... I don't see how this will make a game work? Seems to me like convincing John that his name is actually Joe and then expecting him to start acting like Joe too. I'm not exactly sure what @VinsCool had edited for N64 or what @pedro702 was thinking to do..

To me, a more likely bet is to try copy/pasting from 7FB0 to 7FC0 to change the entire section of ROM Registration Data, or copy/paste 7FC0 all the way to 7FE0 to do the entire section of ROM Specifications. Or try both at the same time.

So just so I understand you correctly, two possible scenarios would be

Copying the bytes from 7FB0 to 7FC0 into Super Mario RPG's ROM like so

30 31 41 46 4A 45 00 00 00 00 00 00 00 00 00 00
4B 49 52 42 59 27 53 20 44 52 45 41 4D 20 4C 41

Or copying the addresses from 7FC0 to FCE0 like I've did a little while ago?

4B 49 52 42 59 27 53 20 44 52 45 41 4D 20 4C 41 KIRBY'S DREAM LA
4E 44 20 33 20 23 35 0C 05 01 33 00 83 DB 7C 24 ND 3 #5...3.ƒÛ|$

But if 7FB0 to 7FE0 were done, it would look something like this (I think), which
would replace 48 bytes.

30 31 41 46 4A 45 00 00 00 00 00 00 00 00 00 00
4B 49 52 42 59 27 53 20 44 52 45 41 4D 20 4C 41
4E 44 20 33 20 23 35 0C 05 01 33 00 83 DB 7C 24

 

[fiveighteen]

So just so I understand you correctly, two possible scenarios would be

Copying the bytes from 7FB0 to 7FC0 into Super Mario RPG's ROM like so

30 31 41 46 4A 45 00 00 00 00 00 00 00 00 00 00
4B 49 52 42 59 27 53 20 44 52 45 41 4D 20 4C 41

Or copying the addresses from 7FC0 to FCE0 like I've did a little while ago?

4B 49 52 42 59 27 53 20 44 52 45 41 4D 20 4C 41 KIRBY'S DREAM LA
4E 44 20 33 20 23 35 0C 05 01 33 00 83 DB 7C 24 ND 3 #5...3.ƒÛ|$

But if 7FB0 to 7FE0 were done, it would look something like this (I think), which
would replace 48 bytes.

30 31 41 46 4A 45 00 00 00 00 00 00 00 00 00 00
4B 49 52 42 59 27 53 20 44 52 45 41 4D 20 4C 41
4E 44 20 33 20 23 35 0C 05 01 33 00 83 DB 7C 24

Test 1:
From 7FB0 TO (not including) 7FC0.

Copy only: (7FB0 through 7FBF)
30 31 41 46 4A 45 00 00 00 00 00 00 00 00 00 00

Test 2:
Earlier we were talking about only replacing the internal ROM name, which was from 7FC0 through 7FD5. The ROM specs continue all the way from 7FC0 through 7FDF (not including 7FE0). So yes you are right to now try both full lines.

Copy:
4B 49 52 42 59 27 53 20 44 52 45 41 4D 20 4C 41 KIRBY'S DREAM LA
4E 44 20 33 20 23 35 0C 05 01 33 00 83 DB 7C 24 ND 3 #5...3.ƒÛ|$

Test 3:
So to replace the entire thing you are correct.

Copy:
30 31 41 46 4A 45 00 00 00 00 00 00 00 00 00 00
4B 49 52 42 59 27 53 20 44 52 45 41 4D 20 4C 41
4E 44 20 33 20 23 35 0C 05 01 33 00 83 DB 7C 24

 

[the_randomizer]

Test 1:
From 7FB0 TO (not including) 7FC0.

Copy only: (7FB0 through 7FBF)
30 31 41 46 4A 45 00 00 00 00 00 00 00 00 00 00

Test 2:
Earlier we were talking about only replacing the internal ROM name, which was from 7FC0 through 7FD5. The ROM specs continue all the way from 7FC0 through 7FDF (not including 7FE0). So yes you are right to now try both full lines.

Copy:
4B 49 52 42 59 27 53 20 44 52 45 41 4D 20 4C 41 KIRBY'S DREAM LA
4E 44 20 33 20 23 35 0C 05 01 33 00 83 DB 7C 24 ND 3 #5...3.ƒÛ|$

Test 3:
So to replace the entire thing you are correct.

Copy:
30 31 41 46 4A 45 00 00 00 00 00 00 00 00 00 00
4B 49 52 42 59 27 53 20 44 52 45 41 4D 20 4C 41
4E 44 20 33 20 23 35 0C 05 01 33 00 83 DB 7C 24

Alright, made three copies of Super Mario RPG, with the name "_test X" at the name of each ROM with the altered 16, 32, and 48 byte offsets respectively, will test and report back

 

[pedro702]

my idea is if dream land 3 works with sa1 ship the other ones must also but the emulator might be hardcoded for the gameid to only worth with the released roms.

 

[the_randomizer]

my idea is if dream land 3 works with sa1 ship the other ones must also but the emulator might be hardcoded for the gameid to only worth with the released roms.

Which is weird, hence why I'll be testing three different versions of the ROM with edited title ID/header bytes that have been altered in three different ways, because nothing is truly ever unhackable. Very difficult and near-impossible, sure, but there's always a way. At one point, we should be able to look into the wrappers Nintendo programmed. What's weird to me is that Super Metroid works with a lot of games, esp. those never on the eShop, so there's a glimmer of hope yet.

Edit:

Holy crap!!!

Uh, @Summersett Super Mario RPG partially works, now, when I saw partially, it loads fine, however, there are some odd speed issues, which I can't figure out why, but there are slight slowdowns, but it works well otherwise. Dayum

It was the first test we used that did it, as that's the ROM I used.

Edit 2: Not sure why there is slowdown in the audio occasionally, but the theory did work.

Replacing 7FB0 to 7FC0 30 31 41 46 4A 45 00 00 00 00 00 00 00 00 00 00 seems to be the magical offset, will test the other variants of the ROM.

 

[VinsCool]

@summerset my idea is that nintendo's vc may have some hardcoded configurations in their files.
I mean, using japanese header over us roms that didn't work instantly made them working. There has to be a hardcoded serting for specific games made in the executable. otherwise perfect dark and yoshi's story wouldn't have worked.

 

[the_randomizer]

@summerset my idea is that nintendo's vc may have some hardcoded configurations in their files.
I mean, using japanese header over us roms that didn't work instantly made them working. There has to be a hardcoded serting for specific games made in the executable. otherwise perfect dark and yoshi's story wouldn't have worked.

Please see my post above, I edited to reflect the test I just ran with injecting Super Mario RPG into Kirby's Dream Land 3.

Edit: Attached screenshot

 

[VinsCool]

Please see my post above, I edited to reflect the test I just ran with injecting Super Mario RPG into Kirby's Dream Land 3.

Edit: Attached screenshot

great! that means we are on something here

 

[the_randomizer]

great! that means we are on something here

Note, the only address that I changed is at 00007FB0 in Super Mario RPG to match Kirby Dream Land 3's did the trick, so in HxD
it looks like this.

00007FB0 30 31 41 46 4A 45 00 00 00 00 00 00 00 00 00 00

No other bytes or offsets have been changed, I wonder if other SA-1 games or other games for Cx4, etc can work this way


Edit: Star Fox....sort of boots, but the graphics are effed up, there's music, but no graphics other than corrupted screens, so maybe partial Super FX emulation?

 

[pedro702]

Note, the only address that I changed is at 00007FB0 in Super Mario RPG to match Kirby Dream Land 3's did the trick, so in HxD
it looks like this.

00007FB0 30 31 41 46 4A 45 00 00 00 00 00 00 00 00 00 00

No other bytes or offsets have been changed, I wonder if other SA-1 games or other games for Cx4, etc can work this way


Edit: Star Fox....sort of boots, but the graphics are effed up, there's music, but no graphics other than corrupted screens, so maybe partial Super FX emulation?

well obviosly kirby doesnt have super fx emulation to compensate.

So imo its like this the emulator itself has hardcoded gameids to enable specicic chips im guessing.

just wondering what about testing that same room on another VC title like donkey kong contry with the kirby gameid just wondering if dkc has the same hardcoded stuff but just not activated.

 

[the_randomizer]

well obviosly kirby doesnt have super fx emulation to compensate.

So imo its like this the emulator itself has hardcoded gameids to enable specicic chips im guessing.

just wondering what about testing that same room on another VC title like donkey kong contry with the kirby gameid just wondering if dkc has the same hardcoded stuff but just not activated.

Right, but at least we know the game works, but it's weird that Star Fox booted at all, with full sound effects and music, despite being on an SA-1 game. So, next you want me to load Kirby via DKC, to see if it boots? Okay, testing now.

Edit: Seems hard-coded, but I also believe there are flags or bytes that tell the games which chips they're using too, where those are, I don't know, so maybe those can be changed as well? Nintendo did a very strange thing in coding their emulators, that's for sure. At the very least, enhancement chip games can be used as a base to load a game with the same chip, that's certainly good news.

If only the exe can be dumped and examined to find what they did exactly.

 

[pedro702]

Right, but at least we know the game works, but it's weird that Star Fox booted at all, with full sound effects and music, despite being on an SA-1 game. So, next you want me to load Kirby via DKC, to see if it boots? Okay, testing now.

Edit: Seems hard-coded, but I also believe there are flags or bytes that tell the games which chips they're using too, where those are, I don't know, so maybe those can be changed as well? Nintendo did a very strange thing in coding their emulators, that's for sure. At the very least, enhancement chip games can be used as a base to load a game with the same chip, that's certainly good news.

If only the exe can be dumped and examined to find what they did exactly.

so it doesnt work okay, that means each emulator is probably hardcoded for that game alone you probably also have more luck remaning the header to DKC or super metroid when injecting games into them imo.

 

[the_randomizer]

so it doesnt work okay, that means each emulator is probably hardcoded for that game alone you probably also have more luck remaning the header to DKC or super metroid when injecting games into them imo.

Right, but enhancement chips don't seem to work via DKC even when renaming the header, the offset (00007FB0 or so in most games I've seen so far) seems to be the one that needs changing the most more than 00007FC0. This is really weird, I hope we can make more progress soon.

 

[pedro702]

Right, but enhancement chips don't seem to work via DKC even when renaming the header, the offset (00007FB0 or so in most games I've seen so far) seems to be the one that needs changing the most more than 00007FC0. This is really weird, I hope we can make more progress soon.

most likely the emulator is compiled specialy for that game so yeah unless we can get the actual executable and someone can poke its configs somewhere writen on it.

 

[the_randomizer]

most likely the emulator is compiled specialy for that game so yeah unless we can get the actual executable and someone can poke its configs somewhere writen on it.

Right, and I'm sure at one point, someone will be able to dump it, might not be for a while. I'd also love to be able to force filtering and 16:9 aspect ratios on the games. What baffles me is injected SA-1 games seem to suffer slowdown, like Super Mario RPG chugs somewhat at the menu and during certain attacks. Even injecting Kirby's Super Star exhibited some slowdown in audio and video, the standalone VC version never did that, so maybe they were optimized somewhat.

Edit: All three versions of Super Mario RPG (editing the bytes on three different times) all worked

 

[pedro702]

Right, and I'm sure at one point, someone will be able to dump it, might not be for a while. I'd also love to be able to force filtering and 16:9 aspect ratios on the games. What baffles me is injected SA-1 games seem to suffer slowdown, like Super Mario RPG chugs somewhat at the menu and during certain attacks. Even injecting Kirby's Super Star exhibited some slowdown in audio and video, the standalone VC version never did that, so maybe they were optimized somewhat.

Edit: All three versions of Super Mario RPG (editing the bytes on three different times) all worked

just wondering any way you try pilotwings with dream land 3 id on DM3vc? just curious what happens.

 

[the_randomizer]

just wondering any way you try pilotwings with dream land 3 id on DM3vc? just curious what happens.

Just tried it, the game does indeed boot, but has missing DSP-1/mode 7 (since it uses the DSP-1 chip for the 3D). The framerate is also cut in half for some reason, but it shows way more than Star Fox did, so, I think this is progress

doesnt it freeze during missons?

@pedro702 Nope, even the missions load, the game shows the menu, vehicle selection and levels, but the 3D plane/map itself is invisible and the plane is always tilted at a 30 degree angle or so, it's really weird.

Good news is that only that 00007FB0 offset is the only one that needs to be copied from header to header, copying anymore lines doesn't make any difference.