This one was pretty ridiculous to set up. It involves having to run assembly from virtual memory, in which only certain parts of the GCI are written to it, so I had to figure out each write so that I could properly format the part of the GCI that ends up in virtual memory. Then, the amout of data written to virtual memory isn't enough to actually run the exploit, but the memory holding the full save data is dynamic and has already been freed already by this point. However, nothing seems to overwrite that data if you just stay in the menus, so I had to set up the assembly in virtual memory to search for the save data via memcmp and then branch to it. Overall I would say this is probably the most complicated exploit I've made yet.
The repo can be found here, and the gci files can be found here.
FIFA Street 2 Save Exploit
FIFA Street 2 Save Exploit
TTYD Speedrunner
Re: FIFA Street 2 Save Exploit
Demonstration video: https://youtu.be/s73Av4SLX_A
well done!