TMNT Ubisoft Game NTSC-U AR Gamecube

[Wiitendo]

I"ve not found any codes for it searching these forums, along with a ton of other sites as well including codejunkies. Well, codejunkies isn't allowing me to view any US codes at all. As I have not found them around here or anywhere else, I have started to hack my own codes again. I'm currently using the old method of PSO and using a cat5e cable to my desktop. I've made my (m) code and am at a bit of an issue right now with my health code. As its been so long since I've actually made codes for it, I've got a health code that is pointer based using universal pointer searcher [0x804C682C] + 0x174 and [0x80C40E08] + 0x174 but I can't for the life of me remember how to convert a pointer with an offest to a functioning raw code for GCNcrypt. Anyone want to help me out here with this?

[Andross89]

I"ve not found any codes for it searching these forums, along with a ton of other sites as well including codejunkies. Well, codejunkies isn't allowing me to view any US codes at all. As I have not found them around here or anywhere else, I have started to hack my own codes again. I'm currently using the old method of PSO and using a cat5e cable to my desktop. I've made my (m) code and am at a bit of an issue right now with my health code. As its been so long since I've actually made codes for it, I've got a health code that is pointer based using universal pointer searcher [0x804C682C] + 0x174 and [0x80C40E08] + 0x174 but I can't for the life of me remember how to convert a pointer with an offest to a functioning raw code for GCNcrypt. Anyone want to help me out here with this?

I've tried several times to make codes for this game. I've already found several pointers. But due to the game's programming, they don't work properly. I think this game needs ASM.

It's a shame because I had the PC version with codes and had a lot more fun.

I don't have the ability to solve your problem. But I hope you can do what I never could.

[Ralf@gc-forever]

Kenobi's GC AR code types explanation doc(s) can be found in the "AR codes - quick reference" thread (2nd post, downloads section):

GCN Action Replay Codes Types Explanation v1.0 & v1.1 by kenobi


Codejunkies NTSC-U GameCube codes (direct link):

http://us.codejunkies.com/search/codes_ ... t=GameCube

Codejunkies PAL GameCube codes (direct link):

http://uk.codejunkies.com/search/codes_ ... t=GameCube


GameHacking.org NTSC-U Teenage Mutant Ninja Turtles codes:

https://gamehacking.org/game/54959

[Wiitendo]

Yeah Ralf. I've found those codes but they are for the cartoon Teenage Mutant Ninja Turtles game. I don't thnk that they even made codes for the computer animated movie version. I've found some but am a bit confused on the way of making a pointer code for them. My understanding is that for 8 bit, its set up 40rrrrrr xxxxxxyy with r being the address of the pointer, x being the offset and y being the value. Since the code I'm looking at is a 32 bit, it should be 44rrrrrr yyyyyyyy but I don't know how to add the offset to it

[Andross89]

...I don't thnk that they even made codes for the computer animated movie version...

They may have ignored this game. Or they may have tried and given up. There are some examples. Vexx has "Infinite Life" But it doesn't have "Infinite Health". And it's basic code.

Or they may not have tried as hard. I doubt that the employees of Codejunkies created the codes, above all, for the love of the system.

[Ralf@gc-forever]

@Wiitendo: Then you must use two 16-bit pointer codes to write a 32-bit value:

Code: Select all

42pppppp xxxxiiii
42pppppp yyyyjjjj

pppppp = Pointer address

xxxx =  offset / 2
yyyy = (offset / 2) + 1

iiiiijjjj = 32-bit value

e.g.

Pointer address: 0x804C682
Offset         : 0x0174
Value          : 0x12345678

pppppp = 0x4C682C

xxxx = 0x0174 / 2 = 0x00BA
yyyy = 0x00BA + 1 = 0x00BB

Pointer code:

424C682C 00BA1234
424C682C 00BB5678

[Wiitendo]

Alright Ralf that makes a bit more sense. I'm assuming that the pointer gets divided by two since we are using the 16 bit instead of 32 bit. The plus one on the second one though, why do we do that? I'll try it out and see what happens with it. Now for my (m) code, the hook address is 8001E2F0 and I'm sure that from my recollection, I make it a C4 codetype correct? Or was it a C0 codetype? The bionicle heroes code I made back during gscentral days was a C4 type but I could be wrong since its been so long ago.
So this is what I have for it unencrypted.
C401E2F0 0000FF01 or should it be C001E2f0 0000FF01?

Edit:
I just realized we are doing half word writes and that's why we add the +1 to the second line

[Wiitendo]

I will say that I am somewhat on the right track. After I went ahead and encrypted the code, Both Leo and Ralph on their first levels, didn't lose any health but it did freeze towards the end of Ralphs level. So I'm going to look into it a bit more.

[Andross89]

I will say that I am somewhat on the right track. After I went ahead and encrypted the code, Both Leo and Ralph on their first levels, didn't lose any health but it did freeze towards the end of Ralphs level. So I'm going to look into it a bit more.

The same problem I had. You can put a conditional to prevent freezing. But there's a worse problem:

Entering and exiting levels randomly will cause the pointer to stop working. You will always be forced to play in the same sequence of levels. And even if you do this, you may still need to turn the GameCube on and off for the code to work again. That's why I gave up.

This game manages to be worse than NBA Street in this aspect.

And the game won't freeze just because of the code... It's the typical movie-based game that was programmed in a hurry.

Or it could be an ignored problem in the Jade engine... I also have this random freezing problem in the last two Prince of Persia.

And that's it.

[Wiitendo]

Well I did put a breakpoint on it as well but if you nop the address it also makes the enemies invincible.

[Andross89]

Well I did put a breakpoint on it as well but if you nop the address it also makes the enemies invincible.

Yes, disabling the address directly can happen this. I think it's possible to resolve this by redirecting and including instructions. But it takes skill to complete this task.

Listen, if you managed to find this so far, could you provide the addresses responsible for the increase in time and decrease in the special bar? It would already be a lot for me. Thanks.

[Wiitendo]

On the breakpoint addresses like I said, it makes the enemies invincible as well. However, if you fulfill Ralphs special meter, you can still kill the enemies with one hit mostly. Let me look into the health a bit more, I wonder if a button activator to refill the health instead of making you invincible will work without freezing the game. Like press L+B to refill health. So for that it's 0x0200 for b button and 0x0040 for L click.
To add that to the pointer code is what I would need to figure out. I'm just spitballing here because obviously having it on all the time will freeze it.

424C682C 00BA1234
424C682C 00BB5678

I've got to go to work in a little bit, but I'm willing to look into the time on Monday when I'm off work again and I'll look into their special meters as well. Leo looks like he needs 10 kills to activate it and ralph is just a bar that gradually goes up with each defeated enemy. So those shouldn't be too bad. The timer counts up so I could try to do a greater than search but if that doesn't work then it counts down from whatever max it is.

[Andross89]

On the breakpoint addresses like I said, it makes the enemies invincible as well. However, if you fulfill Ralphs special meter, you can still kill the enemies with one hit mostly. Let me look into the health a bit more, I wonder if a button activator to refill the health instead of making you invincible will work without freezing the game. Like press L+B to refill health. So for that it's 0x0200 for b button and 0x0040 for L click.
To add that to the pointer code is what I would need to figure out. I'm just spitballing here because obviously having it on all the time will freeze it.

424C682C 00BA1234
424C682C 00BB5678

I've got to go to work in a little bit, but I'm willing to look into the time on Monday when I'm off work again and I'll look into their special meters as well. Leo looks like he needs 10 kills to activate it and ralph is just a bar that gradually goes up with each defeated enemy. So those shouldn't be too bad. The timer counts up so I could try to do a greater than search but if that doesn't work then it counts down from whatever max it is.

Maybe you already know, but here we go:

The only good thing is that the addresses are "close".

Start with the coin. It's easy to find and the value doesn't always change. Anything else is easy after that. The time is a 32-bit value that always changes. I could be wrong, but it has a visual address and a really effective one.

You will notice a pattern. Or have you already noticed...

[Wiitendo]

Believe me, I'm noticing a lot of patterns with this game. But it's cool. I can say this, it should be working by the end of this week. I've got someone making me a elf file so I can load it up in ghidra to look around a bit. Should be able to find something useful until my USB gecko arrives. What about the Wii version? How much difference was it from the GameCube version? I'm wondering if looking at those codes if I could get an idea as to how this memory works on here

[Andross89]

Believe me, I'm noticing a lot of patterns with this game. But it's cool. I can say this, it should be working by the end of this week. I've got someone making me a elf file so I can load it up in ghidra to look around a bit. Should be able to find something useful until my USB gecko arrives. What about the Wii version? How much difference was it from the GameCube version? I'm wondering if looking at those codes if I could get an idea as to how this memory works on here

I have no idea. I stopped at the GameCube.

Perhaps looking at the codes for the Twilight versions might be the closest answer to your curiosity.

[Wiitendo]

So the codes that I saw for the Wii were for the newish at the time tv show. I've got to find all of my documentation I had from hacking back in 2008. I know there were some games that had problems like this but can't remember what they were.

[Wiitendo]

So I figured out on my lunch break how to get what's needed for the button activators. I'll try that a bit when I get home in the morning. If it works, then awesome.

Edit:
I forgot dolphin had a debugger. Been using psoload to do the majority of hacking the old way.

[Andross89]

...I forgot dolphin had a debugger...

And I never got to do ASM with him. If successful, tell us which version you are using.

[Wiitendo]

So me and him went over the codes we got his way. They don't work either. So when he has time, we are going to go about doing some assembly work on the game to see if we can figure that out. I did notice in Dolphin, that there are three addresses for health that I have constantly found for Ralph as Night Watcher for the second level. The first level, with Leo, is a static address. It has never changed on multiple memory dumps for me. I thought about doing pointers for each level but they don't work either.

[Wiitendo]

Reclaimer Shawn has helped me a lot on this so I'm giving him credit. While this is a Gecko code, I will be looking at trying to convert it over to an Action Replay if possible.
The only things is that I'm not seeing a assembly style of code for the Action Replay in any documentation.

Infinite Health All Turtles by Reclaimer Shawn
C219437C 00000005
9421FFB0 BDC10008
81DB0128 3DE042C8
7C0E7800 41820008
D03B0174 B9C10008
38210050 00000000

[Andross89]

Reclaimer Shawn has helped me a lot on this so I'm giving him credit. While this is a Gecko code, I will be looking at trying to convert it over to an Action Replay if possible.
The only things is that I'm not seeing a assembly style of code for the Action Replay in any documentation.

Infinite Health All Turtles by Reclaimer Shawn
C219437C 00000005
9421FFB0 BDC10008
81DB0128 3DE042C8
7C0E7800 41820008
D03B0174 B9C10008
38210050 00000000

I had made this type of tool available in some thread... Anyway, I'll attach it again.

If the code doesn't work, you may need to check the redirection and whether the addresses are actually not used.

And does Infinite Health guarantee the ninja rank in fights? Could consider including the ASM of the address responsible for this if not.

[Wiitendo]

What is the address thing in the middle for? Is it for the address that I'm trying to write to or is it a value? Right above the button to convert it over

[Andross89]

What is the address thing in the middle for? Is it for the address that I'm trying to write to or is it a value? Right above the button to convert it over

You're talking about the program, right? I find it strange that you didn't test it... It's very simple and wouldn't take 5 seconds.

Assuming you are talking about the program, it is the address where the instructions will be redirected before returning. You would only need to encrypt, if you feel necessary, later.

Look what it would look like redirecting to area "80003200":

0419437C 4BE6EE84
04003200 9421FFB0
04003204 BDC10008
04003208 81DB0128
0400320C 3DE042C8
04003210 7C0E7800
04003214 41820008
04003218 D03B0174
0400321C B9C10008
04003220 38210050
04003224 4819115C

And assuming the code doesn't work, you would need to check if the value "4BE6EE84" is actually redirecting to area "80003200". If area "80003200" is used by the game, causing conflict. And if the address "04003224" is returning to area "80194380" correctly. Believe me, I've fixed/improved a lot of code with these problems.

[Wiitendo]

Yeah I've never used it before. In trying it out right now. I've got a few addresses for the timer. Currently looking at that. I'm going to link a file a bit later for you. It's essentially a cheat engine program that only works with dolphin. Its faster and more accurate as well

[Wiitendo]

So that doesn't allow to be converted to an actual AR code using GCNcrypt. I've double checked everything and it comes up as an invalid code when inputting into an actual AR. So I'll have to really look into that to figure it out.