The-Homebrew-Cloud/usbloadergx
2
0
Fork 0
mirror of https://github.com/wiidev/usbloadergx.git synced 2024-11-04 18:45:05 +01:00
Code Issues Packages Projects Releases Wiki Activity

Patch the MKW RCE vulnerability and error 23400

Browse Source 
Thanks to Seeky and InvoxiPlayGames for the gecko codes.
This commit is contained in:
wiidev 2020-11-08 21:28:05 +00:00
parent 30855664dd
commit fdf0704d43
3 changed files with 377 additions and 395 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

744
source/patches/patchcode.c
View File

@ -37,8 +37,8 @@
#include "memory/memory.h"
#include "gecko.h"
static u8 *codelistend = (u8 *) 0x80003000;
static u8 *codelist = (u8 *) 0x800022A8;
static u8 *codelistend = (u8 *)0x80003000;
static u8 *codelist = (u8 *)0x800022A8;
static u8 *code_buf = NULL;
static u32 code_size = 0;
@ -49,239 +49,93 @@ static u32 tempgameconfsize = 0;
static u8 *tempgameconf = NULL;
extern void patchhook(u32 address, u32 len);
extern void multidolhook(u32 address);
extern void langvipatch(u32 address, u32 len, u8 langbyte);
extern void vipatch(u32 address, u32 len);
//static const u32 multidolpatch1[2] = {
// 0x3C03FFB4,0x28004F43
//};
//static const u32 healthcheckhook[2] = {
// 0x41810010,0x881D007D
//};
//static const u32 updatecheckhook[3] = {
// 0x80650050,0x80850054,0xA0A50058
//};
//static const u32 multidolpatch2[2] = {
// 0x3F608000, 0x807B0018
//};
//static const u32 recoveryhooks[3] = {
// 0xA00100AC,0x5400073E,0x2C00000F
//};
//static const u32 nocopyflag1[3] = {
// 0x540007FF, 0x4182001C, 0x80630068
//};
//static const u32 nocopyflag2[3] = {
// 0x540007FF, 0x41820024, 0x387E12E2
//};
// this one is for the GH3 and VC saves
//static const u32 nocopyflag3[5] = {
// 0x2C030000, 0x40820010, 0x88010020, 0x28000002, 0x41820234
//};
//static const u32 nocopyflag3[5] = {
// 0x2C030000, 0x41820200,0x48000058,0x38610100
//};
// this removes the display warning for no copy VC and GH3 saves
//static const u32 nocopyflag4[4] = {
// 0x80010008, 0x2C000000, 0x4182000C, 0x3BE00001
//};
//static const u32 nocopyflag5[3] = {
// 0x801D0024,0x540007FF,0x41820024
//};
//static const u32 movedvdpatch[3] = {
// 0x2C040000, 0x41820120, 0x3C608109
//};
//static const u32 regionfreehooks[5] = {
// 0x7C600774, 0x2C000001, 0x41820030,0x40800010,0x2C000000
//};
//static const u32 cIOScode[16] = {
// 0x7f06c378, 0x7f25cb78, 0x387e02c0, 0x4cc63182
//};
//static const u32 cIOSblock[16] = {
// 0x2C1800F9, 0x40820008, 0x3B000024
//};
//static const u32 fwritepatch[8] = {
// 0x9421FFD0,0x7C0802A6,0x90010034,0xBF210014,0x7C9B2378,0x7CDC3378,0x7C7A1B78,0x7CB92B78 // bushing fwrite
//};
static const u32 vipatchcode[3] = {
0x4182000C,0x4180001C,0x48000018
};
static const u32 viwiihooks[4] = {
0x7CE33B78,0x38870034,0x38A70038,0x38C7004C
};
static const u32 kpadhooks[4] = {
0x9A3F005E,0x38AE0080,0x389FFFFC,0x7E0903A6
};
static const u32 kpadoldhooks[6] = {
0x801D0060, 0x901E0060, 0x801D0064, 0x901E0064, 0x801D0068, 0x901E0068
};
static const u32 joypadhooks[4] = {
0x3AB50001, 0x3A73000C, 0x2C150004, 0x3B18000C
};
static const u32 gxdrawhooks[4] = {
0x3CA0CC01, 0x38000061, 0x3C804500, 0x98058000
};
static const u32 gxflushhooks[4] = {
0x90010014, 0x800305FC, 0x2C000000, 0x41820008
};
static const u32 ossleepthreadhooks[4] = {
0x90A402E0, 0x806502E4, 0x908502E4, 0x2C030000
};
static const u32 axnextframehooks[4] = {
0x3800000E, 0x7FE3FB78, 0xB0050000, 0x38800080
};
static const u32 wpadbuttonsdownhooks[4] = {
0x7D6B4A14, 0x816B0010, 0x7D635B78, 0x4E800020
};
static const u32 wpadbuttonsdown2hooks[4] = {
0x7D6B4A14, 0x800B0010, 0x7C030378, 0x4E800020
};
static const u32 multidolhooks[4] = {
0x7C0004AC, 0x4C00012C, 0x7FE903A6, 0x4E800420
};
static const u32 multidolchanhooks[4] = {
0x4200FFF4, 0x48000004, 0x38800000, 0x4E800020
};
static const u32 langpatch[3] = {
0x7C600775, 0x40820010, 0x38000000
};
//static const u32 oldpatch002[3] = {
// 0x2C000000, 0x40820214, 0x3C608000
//};
//
//static const u32 newpatch002[3] = {
// 0x2C000000, 0x48000214, 0x3C608000
//};
//
//static const u32 dczeropatch[4] = {
// 0x7C001FEC, 0x38630020, 0x4200FFF8, 0x4E800020
//};
static const u32 vipatchcode[3] = {0x4182000C, 0x4180001C, 0x48000018};
static const u32 viwiihooks[4] = {0x7CE33B78, 0x38870034, 0x38A70038, 0x38C7004C};
static const u32 kpadhooks[4] = {0x9A3F005E, 0x38AE0080, 0x389FFFFC, 0x7E0903A6};
static const u32 kpadoldhooks[6] = {0x801D0060, 0x901E0060, 0x801D0064, 0x901E0064, 0x801D0068, 0x901E0068};
static const u32 joypadhooks[4] = {0x3AB50001, 0x3A73000C, 0x2C150004, 0x3B18000C};
static const u32 gxdrawhooks[4] = {0x3CA0CC01, 0x38000061, 0x3C804500, 0x98058000};
static const u32 gxflushhooks[4] = {0x90010014, 0x800305FC, 0x2C000000, 0x41820008};
static const u32 ossleepthreadhooks[4] = {0x90A402E0, 0x806502E4, 0x908502E4, 0x2C030000};
static const u32 axnextframehooks[4] = {0x3800000E, 0x7FE3FB78, 0xB0050000, 0x38800080};
static const u32 wpadbuttonsdownhooks[4] = {0x7D6B4A14, 0x816B0010, 0x7D635B78, 0x4E800020};
static const u32 wpadbuttonsdown2hooks[4] = {0x7D6B4A14, 0x800B0010, 0x7C030378, 0x4E800020};
static const u32 multidolhooks[4] = {0x7C0004AC, 0x4C00012C, 0x7FE903A6, 0x4E800420};
static const u32 multidolchanhooks[4] = {0x4200FFF4, 0x48000004, 0x38800000, 0x4E800020};
static const u32 langpatch[3] = {0x7C600775, 0x40820010, 0x38000000};
static const u8 GCT_Header[8] = {0x00, 0xD0, 0xC0, 0xDE, 0x00, 0xD0, 0xC0, 0xDE};
//---------------------------------------------------------------------------------
void dogamehooks(u32 hooktype, void *addr, u32 len)
//---------------------------------------------------------------------------------
{
if(hooktype == 0x00)
if (hooktype == 0x00)
return;
bool isChannel = (*((char *) 0x80000005) == 0) && (*((char *) 0x80000006) == 0);
bool isChannel = (*((char *)0x80000005) == 0) && (*((char *)0x80000006) == 0);
void *addr_start = addr;
void *addr_end = addr+len;
void *addr_end = addr + len;
while(addr_start < addr_end)
while (addr_start < addr_end)
{
switch(hooktype)
switch (hooktype)
{
default:
case 0x00:
default:
case 0x00:
break;
case 0x01:
if(memcmp(addr_start, viwiihooks, sizeof(viwiihooks))==0){
patchhook((u32)addr_start, len);
}
case 0x01:
if (memcmp(addr_start, viwiihooks, sizeof(viwiihooks)) == 0)
patchhook((u32)addr_start, len);
break;
case 0x02:
if(memcmp(addr_start, kpadhooks, sizeof(kpadhooks))==0){
patchhook((u32)addr_start, len);
}
if(memcmp(addr_start, kpadoldhooks, sizeof(kpadoldhooks))==0){
patchhook((u32)addr_start, len);
}
case 0x02:
if (memcmp(addr_start, kpadhooks, sizeof(kpadhooks)) == 0)
patchhook((u32)addr_start, len);
if (memcmp(addr_start, kpadoldhooks, sizeof(kpadoldhooks)) == 0)
patchhook((u32)addr_start, len);
break;
case 0x03:
if(memcmp(addr_start, joypadhooks, sizeof(joypadhooks))==0){
patchhook((u32)addr_start, len);
}
case 0x03:
if (memcmp(addr_start, joypadhooks, sizeof(joypadhooks)) == 0)
patchhook((u32)addr_start, len);
break;
case 0x04:
if(memcmp(addr_start, gxdrawhooks, sizeof(gxdrawhooks))==0){
patchhook((u32)addr_start, len);
}
case 0x04:
if (memcmp(addr_start, gxdrawhooks, sizeof(gxdrawhooks)) == 0)
patchhook((u32)addr_start, len);
break;
case 0x05:
if(memcmp(addr_start, gxflushhooks, sizeof(gxflushhooks))==0){
patchhook((u32)addr_start, len);
}
case 0x05:
if (memcmp(addr_start, gxflushhooks, sizeof(gxflushhooks)) == 0)
patchhook((u32)addr_start, len);
break;
case 0x06:
if(memcmp(addr_start, ossleepthreadhooks, sizeof(ossleepthreadhooks))==0){
patchhook((u32)addr_start, len);
}
case 0x06:
if (memcmp(addr_start, ossleepthreadhooks, sizeof(ossleepthreadhooks)) == 0)
patchhook((u32)addr_start, len);
break;
case 0x07:
if(memcmp(addr_start, axnextframehooks, sizeof(axnextframehooks))==0){
patchhook((u32)addr_start, len);
}
case 0x07:
if (memcmp(addr_start, axnextframehooks, sizeof(axnextframehooks)) == 0)
patchhook((u32)addr_start, len);
break;
/*
case 0x08:
if(memcmp(addr_start, customhook, customhooksize)==0){
patchhook((u32)addr_start, len);
}
if(memcmp(addr_start, multidolhooks, sizeof(multidolhooks))==0){
multidolhook((u32)addr_start+sizeof(multidolhooks)-4);
}
/*
case 0x08:
if (memcmp(addr_start, customhook, customhooksize) == 0)
patchhook((u32)addr_start, len);
if (memcmp(addr_start, multidolhooks, sizeof(multidolhooks)) == 0)
multidolhook((u32)addr_start + sizeof(multidolhooks) - 4);
break;
*/
*/
}
if(memcmp(addr_start, multidolhooks, sizeof(multidolhooks))==0)
{
multidolhook((u32)addr_start+sizeof(multidolhooks)-4);
}
if (memcmp(addr_start, multidolhooks, sizeof(multidolhooks)) == 0)
multidolhook((u32)addr_start + sizeof(multidolhooks) - 4);
if(isChannel && memcmp(addr_start, multidolchanhooks, sizeof(multidolchanhooks)) == 0)
if (isChannel && memcmp(addr_start, multidolchanhooks, sizeof(multidolchanhooks)) == 0)
{
*(((u32*)addr_start)+1) = 0x7FE802A6;
DCFlushRange(((u32*)addr_start)+1, 4);
ICInvalidateRange(((u32*)addr_start)+1, 4);
multidolhook((u32)addr_start+sizeof(multidolchanhooks)-4);
*(((u32 *)addr_start) + 1) = 0x7FE802A6;
DCFlushRange(((u32 *)addr_start) + 1, 4);
ICInvalidateRange(((u32 *)addr_start) + 1, 4);
multidolhook((u32)addr_start + sizeof(multidolchanhooks) - 4);
}
addr_start += 4;
@ -300,21 +154,21 @@ void app_pokevalues()
{
if (*(gameconf + i) == 0)
{
if (((u32 *) (*(gameconf + i + 1))) == NULL || *((u32 *) (*(gameconf + i + 1))) == *(gameconf + i + 2))
if (((u32 *)(*(gameconf + i + 1))) == NULL || *((u32 *)(*(gameconf + i + 1))) == *(gameconf + i + 2))
{
*((u32 *) (*(gameconf + i + 3))) = *(gameconf + i + 4);
DCFlushRange((void *) *(gameconf + i + 3), 4);
*((u32 *)(*(gameconf + i + 3))) = *(gameconf + i + 4);
DCFlushRange((void *)*(gameconf + i + 3), 4);
}
i += 4;
}
else
{
codeaddr = (u32 *) *(gameconf + i + *(gameconf + i) + 1);
codeaddr2 = (u32 *) *(gameconf + i + *(gameconf + i) + 2);
codeaddr = (u32 *)*(gameconf + i + *(gameconf + i) + 1);
codeaddr2 = (u32 *)*(gameconf + i + *(gameconf + i) + 2);
if (codeaddr == 0 && addrfound != NULL)
codeaddr = addrfound;
else if (codeaddr == 0 && codeaddr2 != 0)
codeaddr = (u32 *) ((((u32) codeaddr2) >> 28) << 28);
codeaddr = (u32 *)((((u32)codeaddr2) >> 28) << 28);
else if (codeaddr == 0 && codeaddr2 == 0)
{
i += *(gameconf + i) + 4;
@ -345,14 +199,14 @@ static void app_loadgameconfig()
{
if (gameconf == NULL)
{
gameconf = (u32*) MEM2_alloc(65536);
gameconf = (u32 *)MEM2_alloc(65536);
if (gameconf == NULL)
return;
}
const char *discid = (const char *) Disc_ID;
if(!tempgameconf)
const char *discid = (const char *)Disc_ID;
if (!tempgameconf)
{
tempgameconf = (u8 *) defaultgameconfig;
tempgameconf = (u8 *)defaultgameconfig;
tempgameconfsize = defaultgameconfig_size;
}
@ -387,10 +241,12 @@ static void app_loadgameconfig()
{
while (i != tempgameconfsize && tempgameconf[i] != ':')
i++;
if (i == tempgameconfsize) break;
if (i == tempgameconfsize)
break;
while ((tempgameconf[i] != 10 && tempgameconf[i] != 13) && (i != 0))
i--;
if (i != 0) i++;
if (i != 0)
i++;
parsebufpos = 0;
gameidmatch = 0;
while (tempgameconf[i] != ':')
@ -406,7 +262,8 @@ static void app_loadgameconfig()
parsebuffer[parsebufpos++] = tempgameconf[i++];
else if (tempgameconf[i] == ' ')
break;
else i++;
else
i++;
if (parsebufpos == 8)
break;
}
@ -419,10 +276,9 @@ static void app_loadgameconfig()
if (strncasecmp(discid, parsebuffer, strlen(parsebuffer)) == 0)
{
gameidmatch += strlen(parsebuffer);
idmatch: if (gameidmatch > maxgameidmatch2)
{
idmatch:
if (gameidmatch > maxgameidmatch2)
maxgameidmatch2 = gameidmatch;
}
}
while ((i != tempgameconfsize) && (tempgameconf[i] != 10 && tempgameconf[i] != 13))
i++;
@ -436,7 +292,8 @@ static void app_loadgameconfig()
parsebuffer[parsebufpos++] = tempgameconf[i++];
else if (tempgameconf[i] == ' ' || tempgameconf[i] == '(' || tempgameconf[i] == ':')
break;
else i++;
else
i++;
if (parsebufpos == 17)
break;
}
@ -444,16 +301,12 @@ static void app_loadgameconfig()
//if (!autobootcheck)
{
if (strncasecmp("codeliststart", parsebuffer, strlen(parsebuffer)) == 0 && strlen(parsebuffer) == 13)
{
sscanf((char *) (tempgameconf + i), " = %x", (unsigned int *) &codelist);
}
sscanf((char *)(tempgameconf + i), " = %x", (unsigned int *)&codelist);
if (strncasecmp("codelistend", parsebuffer, strlen(parsebuffer)) == 0 && strlen(parsebuffer) == 11)
{
sscanf((char *) (tempgameconf + i), " = %x", (unsigned int *) &codelistend);
}
sscanf((char *)(tempgameconf + i), " = %x", (unsigned int *)&codelistend);
if (strncasecmp("poke", parsebuffer, strlen(parsebuffer)) == 0 && strlen(parsebuffer) == 4)
{
ret = sscanf((char *) tempgameconf + i, "( %x , %x", (unsigned int *)&codeaddr, (unsigned int *)&codeval);
ret = sscanf((char *)tempgameconf + i, "( %x , %x", (unsigned int *)&codeaddr, (unsigned int *)&codeval);
if (ret == 2)
{
*(gameconf + (gameconfsize / 4)) = 0;
@ -464,12 +317,12 @@ static void app_loadgameconfig()
gameconfsize += 4;
*(gameconf + (gameconfsize / 4)) = codeval;
gameconfsize += 4;
DCFlushRange((void *) (gameconf + (gameconfsize / 4) - 5), 20);
DCFlushRange((void *)(gameconf + (gameconfsize / 4) - 5), 20);
}
}
if (strncasecmp("pokeifequal", parsebuffer, strlen(parsebuffer)) == 0 && strlen(parsebuffer) == 11)
{
ret = sscanf((char *) (tempgameconf + i), "( %x , %x , %x , %x", (unsigned int *)&codeaddr, (unsigned int *)&codeval, (unsigned int *)&codeaddr2, (unsigned int *)&codeval2);
ret = sscanf((char *)(tempgameconf + i), "( %x , %x , %x , %x", (unsigned int *)&codeaddr, (unsigned int *)&codeval, (unsigned int *)&codeaddr2, (unsigned int *)&codeval2);
if (ret == 4)
{
*(gameconf + (gameconfsize / 4)) = 0;
@ -482,12 +335,12 @@ static void app_loadgameconfig()
gameconfsize += 4;
*(gameconf + (gameconfsize / 4)) = codeval2;
gameconfsize += 4;
DCFlushRange((void *) (gameconf + (gameconfsize / 4) - 5), 20);
DCFlushRange((void *)(gameconf + (gameconfsize / 4) - 5), 20);
}
}
if (strncasecmp("searchandpoke", parsebuffer, strlen(parsebuffer)) == 0 && strlen(parsebuffer) == 13)
{
ret = sscanf((char *) (tempgameconf + i), "( %x%n", (unsigned int *)&codeval, (int *)&tempoffset);
ret = sscanf((char *)(tempgameconf + i), "( %x%n", (unsigned int *)&codeval, (int *)&tempoffset);
if (ret == 1)
{
gameconfsize += 4;
@ -498,10 +351,10 @@ static void app_loadgameconfig()
gameconfsize += 4;
temp++;
i += tempoffset;
ret = sscanf((char *) (tempgameconf + i), " %x%n", (unsigned int *)&codeval, (int *)&tempoffset);
ret = sscanf((char *)(tempgameconf + i), " %x%n", (unsigned int *)&codeval, (int *)&tempoffset);
}
*(gameconf + (gameconfsize / 4) - temp - 1) = temp;
ret = sscanf((char *) (tempgameconf + i), " , %x , %x , %x , %x", (unsigned int *)&codeaddr, (unsigned int *)&codeaddr2, (unsigned int *)&codeoffset, (unsigned int *)&codeval2);
ret = sscanf((char *)(tempgameconf + i), " , %x , %x , %x , %x", (unsigned int *)&codeaddr, (unsigned int *)&codeaddr2, (unsigned int *)&codeoffset, (unsigned int *)&codeval2);
if (ret == 4)
{
*(gameconf + (gameconfsize / 4)) = codeaddr;
@ -512,11 +365,11 @@ static void app_loadgameconfig()
gameconfsize += 4;
*(gameconf + (gameconfsize / 4)) = codeval2;
gameconfsize += 4;
DCFlushRange((void *) (gameconf + (gameconfsize / 4) - temp - 5), temp * 4 + 20);
DCFlushRange((void *)(gameconf + (gameconfsize / 4) - temp - 5), temp * 4 + 20);
}
else gameconfsize -= temp * 4 + 4;
else
gameconfsize -= temp * 4 + 4;
}
}
}
if (tempgameconf[i] != ':')
@ -533,12 +386,12 @@ static void app_loadgameconfig()
}
}
if(tempgameconf != defaultgameconfig)
free(tempgameconf);
if (tempgameconf != defaultgameconfig)
MEM2_free(tempgameconf);
if (code_size > (u32) codelistend - (u32) codelist)
if (code_size > (u32)codelistend - (u32)codelist)
{
gprintf("Ocarina: Too many codes found: filesize %i, maxsize: %i\n", code_size, (u32) codelistend - (u32) codelist);
gprintf("Ocarina: Too many codes found: filesize %i, maxsize: %i\n", code_size, (u32)codelistend - (u32)codelist);
MEM2_free(code_buf);
code_buf = NULL;
code_size = 0;
@ -552,134 +405,130 @@ void load_handler(u32 hooktype, u32 debugger, u32 pauseAtStart)
if (hooktype != 0x00)
{
if (debugger == 0x01)
codelist = (u8 *) 0x800028B8;
codelistend = (u8 *) 0x80003000;
codelist = (u8 *)0x800028B8;
codelistend = (u8 *)0x80003000;
app_loadgameconfig();
if (debugger == 0x01)
{
//! Prefer Slot B
if(usb_isgeckoalive(EXI_CHANNEL_1))
//! Prefer Slot B
if (usb_isgeckoalive(EXI_CHANNEL_1))
{
// slot B
memset((void*)0x80001800,0,codehandler_size);
memcpy((void*)0x80001800,codehandler,codehandler_size);
// Slot B
memset((void *)0x80001800, 0, codehandler_size);
memcpy((void *)0x80001800, codehandler, codehandler_size);
if (pauseAtStart == 0x01)
*(u32*)0x80002774 = 1;
memcpy((void*)0x80001CDE, &codelist, 2);
memcpy((void*)0x80001CE2, ((u8*) &codelist) + 2, 2);
memcpy((void*)0x80001F5A, &codelist, 2);
memcpy((void*)0x80001F5E, ((u8*) &codelist) + 2, 2);
DCFlushRange((void*)0x80001800,codehandler_size);
*(u32 *)0x80002774 = 1;
memcpy((void *)0x80001CDE, &codelist, 2);
memcpy((void *)0x80001CE2, ((u8 *)&codelist) + 2, 2);
memcpy((void *)0x80001F5A, &codelist, 2);
memcpy((void *)0x80001F5E, ((u8 *)&codelist) + 2, 2);
DCFlushRange((void *)0x80001800, codehandler_size);
}
else
{
// Slot A
memset((void*)0x80001800,0,codehandlerslota_size);
memcpy((void*)0x80001800,codehandlerslota,codehandlerslota_size);
memset((void *)0x80001800, 0, codehandlerslota_size);
memcpy((void *)0x80001800, codehandlerslota, codehandlerslota_size);
if (pauseAtStart == 0x01)
*(u32*)0x80002774 = 1;
memcpy((void*)0x80001CDE, &codelist, 2);
memcpy((void*)0x80001CE2, ((u8*) &codelist) + 2, 2);
memcpy((void*)0x80001F5A, &codelist, 2);
memcpy((void*)0x80001F5E, ((u8*) &codelist) + 2, 2);
DCFlushRange((void*)0x80001800,codehandlerslota_size);
*(u32 *)0x80002774 = 1;
memcpy((void *)0x80001CDE, &codelist, 2);
memcpy((void *)0x80001CE2, ((u8 *)&codelist) + 2, 2);
memcpy((void *)0x80001F5A, &codelist, 2);
memcpy((void *)0x80001F5E, ((u8 *)&codelist) + 2, 2);
DCFlushRange((void *)0x80001800, codehandlerslota_size);
}
}
else
{
memset((void*)0x80001800,0,codehandleronly_size);
memcpy((void*)0x80001800,codehandleronly,codehandleronly_size);
memcpy((void*)0x80001906, &codelist, 2);
memcpy((void*)0x8000190A, ((u8*) &codelist) + 2, 2);
DCFlushRange((void*)0x80001800,codehandleronly_size);
memset((void *)0x80001800, 0, codehandleronly_size);
memcpy((void *)0x80001800, codehandleronly, codehandleronly_size);
memcpy((void *)0x80001906, &codelist, 2);
memcpy((void *)0x8000190A, ((u8 *)&codelist) + 2, 2);
DCFlushRange((void *)0x80001800, codehandleronly_size);
}
// Load multidol handler
memset((void*)0x80001000,0,multidol_size);
memcpy((void*)0x80001000,multidol,multidol_size);
DCFlushRange((void*)0x80001000,multidol_size);
switch(hooktype)
memset((void *)0x80001000, 0, multidol_size);
memcpy((void *)0x80001000, multidol, multidol_size);
DCFlushRange((void *)0x80001000, multidol_size);
switch (hooktype)
{
default:
break;
case 0x01:
memcpy((void*)0x8000119C,viwiihooks,12);
memcpy((void*)0x80001198,viwiihooks+3,4);
break;
case 0x02:
memcpy((void*)0x8000119C,kpadhooks,12);
memcpy((void*)0x80001198,kpadhooks+3,4);
break;
case 0x03:
memcpy((void*)0x8000119C,joypadhooks,12);
memcpy((void*)0x80001198,joypadhooks+3,4);
break;
case 0x04:
memcpy((void*)0x8000119C,gxdrawhooks,12);
memcpy((void*)0x80001198,gxdrawhooks+3,4);
break;
case 0x05:
memcpy((void*)0x8000119C,gxflushhooks,12);
memcpy((void*)0x80001198,gxflushhooks+3,4);
break;
case 0x06:
memcpy((void*)0x8000119C,ossleepthreadhooks,12);
memcpy((void*)0x80001198,ossleepthreadhooks+3,4);
break;
case 0x07:
memcpy((void*)0x8000119C,axnextframehooks,12);
memcpy((void*)0x80001198,axnextframehooks+3,4);
break;
/*
case 0x08:
if (customhooksize == 16)
{
memcpy((void*)0x8000119C,customhook,12);
memcpy((void*)0x80001198,customhook+3,4);
}
break;
*/
case 0x09:
memcpy((void*)0x8000119C,wpadbuttonsdownhooks,12);
memcpy((void*)0x80001198,wpadbuttonsdownhooks+3,4);
break;
case 0x0A:
memcpy((void*)0x8000119C,wpadbuttonsdown2hooks,12);
memcpy((void*)0x80001198,wpadbuttonsdown2hooks+3,4);
break;
default:
break;
case 0x01:
memcpy((void *)0x8000119C, viwiihooks, 12);
memcpy((void *)0x80001198, viwiihooks + 3, 4);
break;
case 0x02:
memcpy((void *)0x8000119C, kpadhooks, 12);
memcpy((void *)0x80001198, kpadhooks + 3, 4);
break;
case 0x03:
memcpy((void *)0x8000119C, joypadhooks, 12);
memcpy((void *)0x80001198, joypadhooks + 3, 4);
break;
case 0x04:
memcpy((void *)0x8000119C, gxdrawhooks, 12);
memcpy((void *)0x80001198, gxdrawhooks + 3, 4);
break;
case 0x05:
memcpy((void *)0x8000119C, gxflushhooks, 12);
memcpy((void *)0x80001198, gxflushhooks + 3, 4);
break;
case 0x06:
memcpy((void *)0x8000119C, ossleepthreadhooks, 12);
memcpy((void *)0x80001198, ossleepthreadhooks + 3, 4);
break;
case 0x07:
memcpy((void *)0x8000119C, axnextframehooks, 12);
memcpy((void *)0x80001198, axnextframehooks + 3, 4);
break;
/*
case 0x08:
if (customhooksize == 16)
{
memcpy((void *)0x8000119C, customhook, 12);
memcpy((void *)0x80001198, customhook + 3, 4);
}
break;
*/
case 0x09:
memcpy((void *)0x8000119C, wpadbuttonsdownhooks, 12);
memcpy((void *)0x80001198, wpadbuttonsdownhooks + 3, 4);
break;
case 0x0A:
memcpy((void *)0x8000119C, wpadbuttonsdown2hooks, 12);
memcpy((void *)0x80001198, wpadbuttonsdown2hooks + 3, 4);
break;
}
DCFlushRange((void*)0x80001198,16);
DCFlushRange((void *)0x80001198, 16);
memcpy((void *) 0x80001800, (void*) Disc_ID, 6); // For Wiird
DCFlushRange((void *) 0x80001800, 6);
memcpy((void *)0x80001800, (void *)Disc_ID, 6); // For Wiird
DCFlushRange((void *)0x80001800, 6);
}
//Copy the codes
// Copy the codes
if (code_buf && code_size > 0)
{
memset(codelist, 0, (u32) codelistend - (u32) codelist);
memset(codelist, 0, (u32)codelistend - (u32)codelist);
memcpy(codelist, code_buf, code_size);
DCFlushRange(codelist, (u32) codelistend - (u32) codelist);
free(code_buf);
DCFlushRange(codelist, (u32)codelistend - (u32)codelist);
MEM2_free(code_buf);
code_buf = NULL;
gprintf("Ocarina codes applied to %p size: %i\n", codelist, (u32) codelistend - (u32) codelist);
gprintf("Ocarina codes applied to %p size: %i\n", codelist, (u32)codelistend - (u32)codelist);
}
if(hooktype != 0x00)
{
//This needs to be done after loading the .dol into memory
// This needs to be done after loading the .dol into memory
if (hooktype != 0x00)
app_pokevalues();
}
}
int LoadGameConfig(const char *CheatFilepath)
{
int filesize = 0;
tempgameconf = (u8 *) defaultgameconfig;
tempgameconf = (u8 *)defaultgameconfig;
tempgameconfsize = defaultgameconfig_size;
gameconfsize = 0;
FILE* fp;
FILE *fp;
char filepath[200];
snprintf(filepath, sizeof(filepath), "%s/gameconfig.txt", CheatFilepath);
@ -690,9 +539,10 @@ int LoadGameConfig(const char *CheatFilepath)
snprintf(filepath, sizeof(filepath), "sd:/gameconfig.txt");
fp = fopen(filepath, "rb");
int i;
for(i = 1; i <= 8; ++i)
for (i = 1; i <= 8; ++i)
{
if(fp) break;
if (fp)
break;
snprintf(filepath, sizeof(filepath), "usb%i:/gameconfig.txt", i);
fp = fopen(filepath, "rb");
@ -706,21 +556,22 @@ int LoadGameConfig(const char *CheatFilepath)
filesize = ftell(fp);
fseek(fp, 0, SEEK_SET);
tempgameconf = (u8*) MEM2_alloc(filesize);
if (tempgameconf == NULL) {
tempgameconf = (u8 *) defaultgameconfig;
tempgameconf = (u8 *)MEM2_alloc(filesize);
if (tempgameconf == NULL)
{
tempgameconf = (u8 *)defaultgameconfig;
fclose(fp);
return -1;
}
int ret = fread((void*) tempgameconf, 1, filesize, fp);
int ret = fread((void *)tempgameconf, 1, filesize, fp);
fclose(fp);
if (ret != filesize)
{
MEM2_free(tempgameconf);
tempgameconf = (u8 *) defaultgameconfig;
tempgameconf = (u8 *)defaultgameconfig;
return -1;
}
tempgameconfsize = filesize;
@ -728,6 +579,126 @@ int LoadGameConfig(const char *CheatFilepath)
return 0;
}
int ocarina_patch_mkw(u8 *gameid)
{
// Thanks to Seeky for the gecko codes
u8 GCT_RCE_Patch[24] =
{
0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF,
0x20, 0x07, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00,
0xF0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};
switch (gameid[3])
{
case 'P':
GCT_RCE_Patch[1] = 0x89;
GCT_RCE_Patch[2] = 0xA1;
GCT_RCE_Patch[3] = 0x94;
break;
case 'E':
GCT_RCE_Patch[1] = 0x89;
GCT_RCE_Patch[2] = 0x5A;
GCT_RCE_Patch[3] = 0xC4;
break;
case 'J':
GCT_RCE_Patch[1] = 0x89;
GCT_RCE_Patch[2] = 0x92;
GCT_RCE_Patch[3] = 0xF4;
break;
case 'K':
GCT_RCE_Patch[1] = 0x88;
GCT_RCE_Patch[2] = 0x85;
GCT_RCE_Patch[3] = 0xCC;
break;
default:
return 0;
}
if (code_buf != NULL)
{
gprintf("Loading %s with RCE patch & other cheats.\n", gameid);
code_buf = (u8 *)MEM2_realloc(code_buf, code_size + 16);
memcpy(code_buf + code_size - 8, GCT_RCE_Patch, sizeof(GCT_RCE_Patch));
code_size = code_size + 16;
}
else
{
// No cheats were loaded
gprintf("Loading %s with RCE patch.\n", gameid);
code_buf = (u8 *)MEM2_alloc(32);
if (code_buf)
{
memcpy(code_buf, GCT_Header, sizeof(GCT_Header));
memcpy(code_buf + 8, GCT_RCE_Patch, sizeof(GCT_RCE_Patch));
code_size = 32;
}
}
return code_size;
}
int ocarina_patch_games(u8 *gameid)
{
// Thanks to InvoxiPlayGames for the gecko codes
u8 GCT_Con_Patch[16] =
{
0x04, 0x00, 0x00, 0x00, 0x41, 0x41, 0x41, 0x41,
0xF0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};
if (memcmp(gameid, "SC7", 3) == 0)
{
GCT_Con_Patch[1] = 0x23;
GCT_Con_Patch[2] = 0xC9;
GCT_Con_Patch[3] = 0x54;
}
else if (memcmp(gameid, "RJA", 3) == 0)
{
GCT_Con_Patch[1] = 0x1B;
GCT_Con_Patch[2] = 0x83;
GCT_Con_Patch[3] = 0x8C;
}
else if (memcmp(gameid, "SM8", 3) == 0)
{
GCT_Con_Patch[1] = 0x23;
GCT_Con_Patch[2] = 0x8C;
GCT_Con_Patch[3] = 0x74;
}
else if (memcmp(gameid, "SZB", 3) == 0)
{
GCT_Con_Patch[1] = 0x8E;
GCT_Con_Patch[2] = 0x3B;
GCT_Con_Patch[3] = 0x20;
}
else if (memcmp(gameid, "R9J", 3) == 0)
{
GCT_Con_Patch[1] = 0x8D;
GCT_Con_Patch[2] = 0x69;
GCT_Con_Patch[3] = 0x34;
}
if (code_buf != NULL)
{
gprintf("Loading %s with error 23400 patch & other cheats.\n", gameid);
code_buf = (u8 *)MEM2_realloc(code_buf, code_size + 8);
memcpy(code_buf + code_size - 8, GCT_Con_Patch, sizeof(GCT_Con_Patch));
code_size = code_size + 8;
}
else
{
// No cheats were loaded
gprintf("Loading %s with error 23400 patch.\n", gameid);
code_buf = (u8 *)MEM2_alloc(24);
if (code_buf)
{
memcpy(code_buf, GCT_Header, sizeof(GCT_Header));
memcpy(code_buf + 8, GCT_Con_Patch, sizeof(GCT_Con_Patch));
code_size = 24;
}
}
return code_size;
}
int ocarina_load_code(const char *CheatFilepath, u8 *gameid)
{
char filepath[150];
@ -739,11 +710,10 @@ int ocarina_load_code(const char *CheatFilepath, u8 *gameid)
gprintf("Ocarina: Searching codes...%s\n", filepath);
FILE * fp = fopen(filepath, "rb");
FILE *fp = fopen(filepath, "rb");
if (!fp)
{
gprintf("Ocarina: No codes found");
printf("\n");
gprintf("Ocarina: No codes found\n");
return 0;
}
@ -751,7 +721,7 @@ int ocarina_load_code(const char *CheatFilepath, u8 *gameid)
u32 filesize = ftell(fp);
rewind(fp);
code_buf = (u8*) MEM2_alloc(filesize);
code_buf = (u8 *)MEM2_alloc(filesize);
if (!code_buf)
{
gprintf("Ocarina: Not enough memory\n");
@ -784,50 +754,47 @@ void langpatcher(void *addr, u32 len, u8 languageChoice)
u8 ocarinaLangPatchByte = 1;
switch (languageChoice)
{
case JAPANESE:
ocarinaLangPatchByte = 0x00;
break;
case ENGLISH:
ocarinaLangPatchByte = 0x01;
break;
case GERMAN:
ocarinaLangPatchByte = 0x02;
break;
case FRENCH:
ocarinaLangPatchByte = 0x03;
break;
case SPANISH:
ocarinaLangPatchByte = 0x04;
break;
case ITALIAN:
ocarinaLangPatchByte = 0x05;
break;
case DUTCH:
ocarinaLangPatchByte = 0x06;
break;
case S_CHINESE:
ocarinaLangPatchByte = 0x07;
break;
case T_CHINESE:
ocarinaLangPatchByte = 0x08;
break;
case KOREAN:
ocarinaLangPatchByte = 0x09;
break;
default:
return;
case JAPANESE:
ocarinaLangPatchByte = 0x00;
break;
case ENGLISH:
ocarinaLangPatchByte = 0x01;
break;
case GERMAN:
ocarinaLangPatchByte = 0x02;
break;
case FRENCH:
ocarinaLangPatchByte = 0x03;
break;
case SPANISH:
ocarinaLangPatchByte = 0x04;
break;
case ITALIAN:
ocarinaLangPatchByte = 0x05;
break;
case DUTCH:
ocarinaLangPatchByte = 0x06;
break;
case S_CHINESE:
ocarinaLangPatchByte = 0x07;
break;
case T_CHINESE:
ocarinaLangPatchByte = 0x08;
break;
case KOREAN:
ocarinaLangPatchByte = 0x09;
break;
default:
return;
}
u8 * addr_start = addr;
u8 * addr_end = addr + len;
u8 *addr_start = addr;
u8 *addr_end = addr + len;
while (addr_start < addr_end)
{
if (memcmp(addr_start, langpatch, sizeof(langpatch)) == 0)
{
langvipatch((u32) addr_start, len, ocarinaLangPatchByte);
}
langvipatch((u32)addr_start, len, ocarinaLangPatchByte);
addr_start += 4;
}
}
@ -841,10 +808,7 @@ void vidolpatcher(void *addr, u32 len)
while (addr_start < addr_end)
{
if (memcmp(addr_start, vipatchcode, sizeof(vipatchcode)) == 0)
{
vipatch((u32) addr_start, len);
}
vipatch((u32)addr_start, len);
addr_start += 4;
}
}

2
source/patches/patchcode.h
View File

@ -36,6 +36,8 @@ void langpatcher(void *addr, u32 len, u8 languageChoice);
void vidolpatcher(void *addr, u32 len);
void patchdebug(void *addr, u32 len);
int LoadGameConfig(const char *CheatFilepath);
int ocarina_patch_mkw(u8 *gameid);
int ocarina_patch_games(u8 *gameid);
int ocarina_load_code(const char *CheatFilepath, u8 *gameid);
#ifdef __cplusplus

26
source/usbloader/GameBooter.cpp
View File

@ -330,14 +330,30 @@ int GameBooter::BootGame(struct discHdr *gameHdr)
//! Load wip codes
load_wip_code(gameHeader.id);
// force hooktype if not selected but Ocarina is enabled
if(ocarinaChoice && Hooktype == OFF)
Hooktype = 1;
//! Load Ocarina codes
if (ocarinaChoice)
ocarina_load_code(Settings.Cheatcodespath, gameHeader.id);
//! Patch MKW RCE vulnerability
if (PrivServChoice != PRIVSERV_WIIMMFI && memcmp(gameHeader.id, "RMC", 3) == 0)
{
ocarinaChoice = 1;
ocarina_patch_mkw(gameHeader.id);
}
//! Patch error 23400 for a few games with dedicated servers
if (memcmp(gameHeader.id, "SC7", 3) == 0 || memcmp(gameHeader.id, "RJA", 3) == 0 ||
memcmp(gameHeader.id, "SM8", 3) == 0 || memcmp(gameHeader.id, "SZB", 3) == 0 || memcmp(gameHeader.id, "R9J", 3) == 0)
{
ocarinaChoice = 1;
PrivServChoice = PRIVSERV_OFF; // Private server patching causes error 20100
ocarina_patch_games(gameHeader.id);
}
//! Force hooktype if not selected but Ocarina is enabled
if(ocarinaChoice && Hooktype == OFF)
Hooktype = 1;
//! Load gameconfig.txt even if ocarina disabled
if(Hooktype)
LoadGameConfig(Settings.Cheatcodespath);