Finding N64 Enable Codes
How To Hack MTC0 Enabler Codes (Used with special permission of Code Master)
Information That Is Needed To Know Before Tackling This Code
ASM - aka Assembly Language knowledge is good to know, because these codes that are being written are in fact ASM codes. Well, let's cut to the chase, what could Nintendo possibly be doing to cause a problem with the Cheat Device. Not only does it disable the Code Generator's Button to go to the In-Game Menu, but no codes will work without an Enable Code either. This means that they are doing something that disables how the Cheat Device works. Well, here's some information that not many know, and I have figured this info out over my time with hacking N64. Cheat Device Pro (Version 3.0 & Higher) uses WatchLo & WatchHi Co-Processor break points to know when to activate the codes that have been turned on. Well, obviously, if they changed the WatchLo & WatchHi Co-Processor registers, it would make Cheat Device not be able to set its own 'Break Points' to know when to activate the codes, thus disabling the Cheat Device.
The Actual Searching Method!!
Well, obviously if you can't use the In-Game Code Generator, then you cant dump memory to the PC, so you ask, how do I search for this? Well, simple, you must have an Illegal Rom copy of the cartridge :P (Well, having a 'Backup' copy of an N64 rom is not illegal in all places if you own the original cartridge, but for the sake of argument we'll just say it is.) In the rom file, you need to get yourself a Dissembler, to disassemble the N64 Rom into R4300i coding. (aka ASM) I recommend either N64PSX.EXE by Nagr, or Niew by Titanik. Both are good, and can be used to help find this command. Well, now what is the command that we are looking for? Obviously, if they want to change a Co-Processor register, you would just set the register equal to something else right? Exactly, there is a Co-Processor opcode called 'mtc0', which means, 'Move To Co-Processor 0'. Well, you need to find an line that is something like, 'mtc0 $v0,$s2' or 'mtc0 $v0,$s3'. In this opcode, the first register can be 'anything', $at, $v0, $v1, $a0, etc.. But the 2nd register must be $s2 or $s3. Why must it be that register? Simple, the opcode is moving a register to the Co-Processor registers, which have different names as well. So, in essence, $s2 is equal to WatchLo, and $s3 is equal to WatchHi. Make sense now? They are setting WatchLo or WatchHi with this 'mtc0 xxx,$s2/$s3' line. It also happens that the Cheat Device needs both WatchLo & WatchHi to function properly. So they can change either WatchLo or WatchHi to make the Cheat Device not set its own break point to turn on codes, or check to see if the GS Button was pressed, etc.. OK, now I know the 'mtc0 xxx,$s2/$s3' line in the ROM, how do I make that into a Cheat Device code? Simple enough. Write down the rom address of the line, lets say the line was 0005A278h. Now you need to go to the rom address 00000008h in your dissembler, this is where the game's 'Entry Point' is stored. For most games, it will have 80000400h at this line. So, take this address you just got from 00000008h in the rom, and add the 0005A278h to it, and your total is 8005A678h and then subtract 1000h from it and the address becomes 80059678h. And to make the Final Enable Code, change the beginning of the code to F1, so you have F1059678h. And last, but not least add 2400 to the end of that and there you have it, F1059678 2400, your final 'Enable Code'.
Tips & Tricks Of The Trade
Now, there are some key tips to finding this type of code.
- None really here, unless u make your own program to disassemble the rom yourself and check for the 'mtc0 xxx,$s2/$s3' line. If you can and do this, it becomes very simple to make an Enable Code. There you have it!! The first EVER N64 Enable Code FAQ on how to make them. Note that the codes will only work on Cheat Device 3.0 Or Higher because of the F1 at the beginning of the code means that the Cheat Device activates before the game even starts to run.
An Easier Way Of Finding "MTCO" Type Enablers via Nemu 0.8 by Viper187
This can be much easier than the original method by CodeMaster, thanks to a recently released update of Nemu 64 that includes some rather useful stuff. To do this, as with CM's method, you need to have the ROM for the game you want to hack the enabler for and Nemu 0.8.
- Open Nemu and load the game (ROM) you want to hack the enabler for.
- Once the game begins to run, and you see the intro logo crap, you can Pause it. That should be far enough for our purposes.
- Now, open Nemu's "Dump Memory" window. Plugins > Debugger: Dump Memory
- Set the address range to dump. Start at 80000000 and end at 80400000. Ending at 80800000 may be needed for hi-res games, but I doubt it.
- Pick a filename and location for this memory dump.
- Set the Format to "TEXT -Disassembled + PC"
- Click "Dump" and it will create a somewhat large text file. Open this file in the text editor of your choice (I prefer Textpad 3.2.0).
- Upon loading the file, you'll see all kinds of ASM stuff.
- Use the Find/Search feature of your text editor to search for "MTC0". Now, the particular MTC0 line we're looking for is "MTC0 $xx, reserved". I realize that CM said "MTC0 xx,$s2/$s3" above, but this is how it appears to work with Nemu's disassembler and the actual RAM. I've looked at the enablers for several games and each one has been the same so far, right down to the reg. tip: You may actually just want to search for "reserved"; it might appear less than "MTC0" itself.
- Once you've found the MTC0 line, simply take the address beside it, for example "80023240", and make it into your enabler. Do this by changing the first 2 digits to F1 and using the value 2400 (hex).
- Test the enabler on the game and start cheating! :_
Hacking Enabler codes that do not conform to the "mtc0 xxx" search - by Parasyte
To hack most of the newer enable codes for N64, follow the ASM from the entry point and look for something that reads or writes to an address below 80000400. If you find something, KILL IT! You must do that by either nulling, that is setting the offset to zero or finding some other suitable offset. You must do this for every instance you can find. the new GS protection put into games will read/write to the following addresses -
80000080 80000100 80000180 80000190
go through the entry point and find all instances of "ori/addiu xxxx" where 'xxxx' is either '0080', '0100', '0180', or '0190'. then search above those opcodes for an "lui 8000" opcode if you find that lui, just change the 'xxxx' in the ori/addiu opcodes to '0120' and the protection will be flawed. some games will also force 8MB mode before actually checking for the expansion pak. To force 8MB mode, addresses around 80000300 will be written to. many times, you can find the ASM by searching for "addiu/ori 013x" where 'x' is a value 0-F. you may find some "sb/sh/sw 013x($yy)" opcodes. if $yy is $sp, ignore that entire opcode. Otherwise, look above that address for "lui $yy,x000" where 'x' is either '8' or 'A'.
An example of one common enabler that can be used to force either high or low resolution modes and is useful in getting a game to boot and running in either mode is as follows:
40 - low rez
80 - full hi-rez
78 - trick the game into thinking it's hi-rez, but there's actually 1/8th of the RAM free... Which the GS uses for it's trainer routines and such.
that address simply specifies the highest address the game is allowed to use. just don't go above 80.. Since that RAM is reserved and unusable, the game will crash. But just play around with the values.. you might come up with better values.
It works for every game. BUT it does NOT force screen resolution!!!!! It forces the game to use any amount of RAM you want. It does not make the games any faster, does not give it a higher screen resolution. It's mainly used to hack games that run with the expansion pak. You can use the PC Utils. Addresses 80000000 - 80780000 are available in this mode. So the codes you hack with it may not work in the full 8MB mode.
When modifying the 80000318 address, and it tells you there's no expansion pak, that generally means the game is reading that address to ensure it's value is 80800000. This may be defeated by watching reads of 80000318 using Nemu 0.8 or possibly another method of finding them.
Completely recommend this course (from Central Connecticut State University) if you're interested in learning MIPS
Tutorial encompasses basic MIPS, working with VI, RSP and SI!
Brief talk into calling conventions/stack, arithmetic, memory access instructions delay slot, etc
C to MIPS equivalent (Mostly here for reverse engineering purposes)
EXCELLENT resource for hacking with MIPS
Simple, shortish MIPS guide
Hello World in Super Mario 64 out of MIPS
A brief, but not well explained (also images missing), tutorial for tracing basic arithmetic operations and making a gs out of assembly
Very vague, basic MIPS rundown.
MIPS IV Instruction Set (PDF)