Skip navigation

Tag Archives: homebrew

Sometimes you may find there is a patch in StartPatch you want, but you’d rather have it in a preloader hack.ini. That’s pretty simple to do. Here’s how you do it. You need the StartPatch source, a text editor and a hex calculator (Windows calculator can do the job). You don’t need anything more than that.

In StartPatch, patches are in the file “patches.h”. The patches have the following stucture:

{
		{"Disable HAXX, DVDX, RZDX Checks"},
		0x4B30,
		{
			0x48, 0x03, 0x2D, 0x75
		},
		{
			0x60, 0x00, 0x00, 0x00
		},
		4
	},

Let’s break that down.

The first and last { and } signify the start and end of the patch.

The second line line is the name of the patch. This is in double quotes and wrapped in {}, and follwed by a comma (,).

The next line is the offset of the patch. It is followed by a comma (,).

The next section is the original value at that offset. Each byte is seperated by a comma (,) and the whole thing is wrapped in {}, and follwed by a comma (,)

The next section is the new value for the offset. This has the same format as the previous section.

At the end, there is a 4, because 4 bytes are patched (a byte is two digits, the 0x signifies these values are in hexadecimal).

Now, a preloader hacks.ini follows this format:

[hack name]
version=(SM version)
offset=0x(offset)
value=0x(value)

This is undeniably much simpler, but thats besides the point. We have from the StartPatch patch everything needed for the preloader hack.

For value (this is new value, not original value, original value is not in preloader hacks), we combine all four bytes and put an 0x before it (i.e. 0x60000000).

For offset, we add 0x8132FAE0 in a hex calculator (this is known as the “base address” and is added in preloader hacks, but not in StartPatch patches).

Version can be found on wiibrew (http://wiibrew.org/wiki/System_Menu). Then we just slot this into the template above and get:

[Disable HAXX,DVDX,RZDx Checks]
version=482
offset=0x81334610
value=0x60000000

And that’s it done. It’s relatively straight forward.
It’s also possible to do the reverse, and port preloader hacks.ini to StartPatch patches, but this is slightly more complicated. If there’s interest, I’ll post a tutorial on that too.

Advertisements

When there is a new System Menu, many people complain that there is no hacks.ini for the new System Menu yet, so they can’t use preloader hacks on the new System Menu. So I decided I’d write a quick tutorial on how to port the hacks from one System Menu to another. This works between different versions and different regions as well. So if you have a Japanese Wii and are annoyed there are no hacks, this will work for you as well.

What you need:

  • NUSD
  • Key.bin (This is easy, just open a Hex Editor and paste EB E4 2A 22 5E 85 93 E4 48 D9 C5 45 73 81 AA F7 in as a hex string and save as key.bin)
  • A hex editor (Any should do, I use XVI32)
  • Notepad
  • Calculator with Hex function, Windows calculator will do
  • Preloader hacks.ini file for any system menu

First thing, get everything listed above. Then fire up NUSD, with key.bin in the same folder, and download the System Menu you have the hacks.ini for and the System Menu you want to port it to. Make sure you tick decrypt as well. The title will be 0000000100000002, and the version depends on which version and region you want. You should be able to find which one you need on wiibrew.org.

Now take a look at the patch, or “hack”, you want to port. (You do them one at a time)
Let’s take for example, the Move Disc Channel hack from System Menu 3.2E

[Move Disc channel]
version=290
offset=0x813A7E84
value=0x60000000

Let’s take a look at that. The first line with the [ and ] is the name. The next line tells preloader which System Menu version this patch is for. The next line is the offset, which tells preloader where in the system menu to patch the value. The final line tells preloader what to make the value at that offset. Now the problem is, the offset is different for different System Menus. And that’s what we need to change.

Now the offset in the hacks.ini is not the one used by hex editors, so we need to do a quick calculation. Open up Windows Calculator and press View>Scientific, then select the Hex option. Then type in the offset from the hack (if there are several, do the first one), and then subtract 0x8132FAE0 from it (NOTE: the 0x simply identifies that a number is in hex. You do not need to type this in Windows Calculator). Now we have the offset we need.

Photobucket
Photobucket

When you download the System Menu with NUSD and tick the decrypt box, you should get a number of .app files. Most of these are U8 archives and you can ignore them, but one is the .dol of the System Menu, and its the one you need. To find it, open all the files over 100KB in size with a Hex Editor and find the one without the U8 header (If you can see “U8” anywhere in the text side of the Hex Editor, you have one of the U8 archives). The one without the header is the .dol file.

Now open up the decrypted .dol from the System Menu you have the hacks.ini of (in this case 3.2E) in a hex editor. You need to find in your hex editor the option of going to a certain address. In XVI32 it’s under Address>Goto, but different hex editors may vary. Type in the offset we just got in Windows Calculator. This will take you to that address. This shows us what the value should be, before its patched by preloader. You then need to copy 8 numbers (4 little boxes) from that address onwards. Copy this into notepad. You also need to copy several “boxes” either side. Note: If this is 00000000, you cannot port the hack with this method, as that is an advanced patch, and this method is for simple patches.

Photobucket

Photobucket

Photobucket

Photobucket

Now open up the decrypted .dol from the destination System Menu in a hex editor. You now need to search for the hex string you just copied from the last System Menu. Search for it, and when its found, hit search again. Hopefully it wont find it again, meaning this is the place. If it does find it again, go back to the first system menu and copy a few more boxes from either side as well, and try again. Do this until there is only one result.

Photobucket

Now you need to find the offset in this System Menu. So look at the first digit from the string you copied from the original System Menu and find it in the new one. Take down the address of the currently highlighted box. In XVI32, this is displayed in the bottom left corner. Write this down somewhere.

Photobucket
Photobucket

Now go back to Windows calcuator and put it back in Hex. Then type in the address of the value in the new System Menu and add 0x8132FAE0. This gives you the new offset. Then just go into notepad and type up your hacks.ini. You need to add 0x to the answer you got in calculator to get the offset.

Photobucket

Photobucket

[Move Disc Channel]
version=417
offset=0x813AF388
value=0x60000000

(here I ported it to 4.0U, even though it already exists for this System Menu, it was just for the sake of this tutorial)
The first line remains the same. The second line is the new System Menu version, same as the one used for NUSD. The next line is the new offset, and the last line is the value, and that remains the same.

If the hack you are porting contains more than one offset and value, you just do the same for each one.

And then its ready for use. If you do port something to a new System Menu, please post at the wiki on WiiBrew.org

Hopefully this was/will be useful to someone at some stage. If you need me to, I can clarify any parts as well. Just give us a shout.

Oh, and thanks to : Crediar, for making preloader, da_letter_a, for a mentioning something that proved very helpful, WB3000 for NUSD and depeha, for his tutorial on phone port patching at : http://walkmans.wordpress.com/2008/01/07/patch-porting/