statically patching codes into N64 ROMs

[eadmaster]

I'm following this guide to get the RAW values from gameshark codes.
To avoid math errors i've made this little bash script to automate the conversion:

                ADDR=${line:2:6}
		HEXADDR="0x$ADDR"
		
		# compute the correct offset according to the address range using bc
		if [[ $HEXADDR -gt 0x246000 && $HEXADDR -lt 0x333000 ]]; then  # check range 8x246000-333000
			OFF=$( echo "ibase=16;obase=10; $ADDR-245000" | bc )
		elif [[ $HEXADDR -gt 0x0EB180 && $HEXADDR -lt 0x0F083C ]]; then  # check range  8x0EB180-0F083C
			OFF=$( echo "ibase=16;obase=10; $ADDR+12EC80" | bc )
		else
			echo "$(basename $0): unsupported code: $line"
			continue
		fi
		
		# read the value
		V1=${line:9:2}
		V2=${line:11:2}
		
		echo "$line" | grep -E '^81'
		if [ $? -eq 0 ]; then
			# code type 81=write 2 bytes
			echo "$(basename $0): patching code: $OFF:$V1"
			ucon64 --nbak --poke=$OFF:$V1 "$OUTPUTROMFILE"  > /dev/null
			OFF=$( echo "ibase=16;obase=10; $OFF+1" | bc )  # increase offset by 1
			echo "$(basename $0): patching code: $OFF:$V2"
			ucon64 --nbak --poke=$OFF:$V2 "$OUTPUTROMFILE"  > /dev/null
		else
			# code type 80=write 1 byte
			ucon64 --nbak --poke=$OFF:$V2 "$OUTPUTROMFILE"  > /dev/null
		fi

(this is part of a bigger script)

Now i'm trying to patch this code into "Mischief Makers (U) [!].z64":

Infinite Health
812F8EC8 2400

the converted RAW codes are:

B3EC8:24
B3EC9:00

I've also found this alternative one in the PJ64 db:

Infinite Health
810ED0E0 03E8

Which is converted to:

21BD60:03
21BD61:E8

I've tried patching both RAW codes, but none of them are working!

[Kyle]

I tried this guide with Mario 64 and didn't have a ton of luck either. If you want a less sexy solution come hang out over here.

http://krikzz.com/forum/index.php?topic=2920.0

[eadmaster]

i'd like to avoid using n64hijack because it requires the 8MB MemPack, which is causing my console to overheat and freeze.

As alternative, i'm considering finding the ROM addresses to patch using a debugger and breakpoints.
Which one do you suggest me to use?

[Helder]

Use MESS then copy the values of the opcodes around your found address and use a hex editor to find the values. You will likely need to fix the checksum though.

[Kyle]

i'd like to avoid using n64hijack because it requires the 8MB MemPack, which is causing my console to overheat and freeze.

You using a third party memory pack? Most of the overheating issues I've heard of are attributed to that.

[eadmaster]

@Kyle: I have the original one and it definitively overheats.
@Helder: The MAME/MESS debugger does not look very comfortable to me as it only has a console interface (besides, it is very slow on my PC).
I've tried various Project64 builds with debugging features enabled but they all are missing memory breakpoints.
mupen64plus has breakpoints implemented in the core, but there is no GUI for them.
n64js reportedly supports breakpoints, but it is not working in my browser (i will try on another pc soon)

In the end I've played a bit with Nemu64 and made this RAW code:

Infinite Health
57FD8:84

(i've replaced "SH" with a "LH" instruction)
Since this method seems to work, i am looking for a list of hex values of the R4300i instructions (i need them to find the correct replacement for each instruction)

[ReyVGM]

Try Bizhawk:
https://code.google.com/p/bizhawk/

It has a RAM watch/search, and other options.

[eadmaster]

Unfortunately i've found many games needs Enablers (aka "(M) Must Be On") codes to boot after patching, and the enablers cannot be statically patched.

I guess that for these "cheat-protected" games the only way is using the n64hijack engine... (do you know any alternative?)

EDIT: i've found some old scene releases fixing the protection:

F-Zero_X_Gameshark_Crack_USA-GSN64
Pokemon_Snap_Gameshark_Crack_AUS-OBS.zip
Pokemon_Snap_Gameshark_Crack_JAP-OBS.zip
Pokemon_Snap_Gameshark_Crack_USA-GSN64.zip
Super_Smash_Brothers_Gameshark_Crack_AUS-GSN64.zip
Super_Smash_Brothers_Gameshark_Crack_USA-GSN64.zip

Then i've made some codes for "F-ZERO X (U) [f2] (GameShark)"

Infinite Shield 1P
2806C:C6
2C7E8:C6

Infinite Lives
B9C1C:84

They are working fine in emulators, i am going to try on the real hardware soon...
If you know more gameshark cracks for the other protected games please let me know!

[eadmaster]

UPDATE: i've made some more codes with this updated Nemu64 release:

Rayman 2 - The Great Escape (U) (M5) [!].z64
Infinite Health
BC0E0:80

Tsumi to Batsu - Hoshi no Keishousha (J) [!] [T+Eng1.0_Zoinkity].z64
Infinite Health
489D8:8C

Infinite Credits
71BB4:80

Infinite Time
42904:8C

Airboarder 64 (E) [f1] (NTSC).z64
Infinite Time
505A0:84

Btw some games are not starting due to unrecognized microcodes... can i use another video plugin and still have the breakpoints working?

As alternative i've also tried:
- n64js (not compatible with many games)
- Bizhawk (breakpoints are not working?)
- MESS (sometimes crashes, very slow, and can't copy/paste hex strings...)

The codes i'm trying to (statically) hack now are
- Bakuretsu Muteki Bangai-O: infinite health in all levels
- Last Legion UX: infinite health in all levels
- Rakuga Kids (E) [f1] (NTSC): infinite health P1
the last one is a bit weird:
i've found the address storing the health is "800ACB88", but when i change the commands writing to it i get the side-effect of making the CPU invincible too!