[Tutorial] Porting Preloader hacks.ini

When there is a new System Menu, many people complain that there is no hacks.ini for the new System Menu yet, so they can't use preloader hacks on the new System Menu. So I decided I'd write a quick tutorial on how to port the hacks from one System Menu to another. This works between different versions and different regions as well. So if you have a Japanese Wii and are annoyed there are no hacks, this will work for you as well.

What you need:

[*]NUSD
[*]Key.bin (This is easy, just open a Hex Editor and paste EB E4 2A 22 5E 85 93 E4 48 D9 C5 45 73 81 AA F7 in as a hex string and save as key.bin)
[*]A hex editor (Any should do, I use XVI32)
[*]Notepad
[*]Calculator with Hex function, Windows calculator will do
[*]Preloader hacks.ini file for any system menu

First thing, get everything listed above. Then fire up NUSD, with key.bin in the same folder, and download the System Menu you have the hacks.ini for and the System Menu you want to port it to. Make sure you tick decrypt as well. The title will be 0000000100000002, and the version depends on which version and region you want. You should be able to find which one you need on wiibrew.org.

Now take a look at the patch, or "hack", you want to port. (You do them one at a time)
Let's take for example, the Move Disc Channel hack from System Menu 3.2E

[Move Disc channel]
version=290
offset=0x813A7E84
value=0x60000000

Let's take a look at that. The first line with the [ and ] is the name. The next line tells preloader which System Menu version this patch is for. The next line is the offset, which tells preloader where in the system menu to patch the value. The final line tells preloader what to make the value at that offset. Now the problem is, the offset is different for different for different System Menus. And that's what we need to change.

Now the offset in the hacks.ini is not the one used by hex editors, so we need to do a quick calculation. Open up Windows Calculator and press View>Scientific, then select the Hex option. Then type in the offset from the hack (if there are several, do the first one) WITH the 0x at the start(You need to type the x on your keyboard I think), and then subtract 0x8132FAE0 from it. Now we have the offset we need.

Now open up the decrypted 00000008.app from the System Menu you have the hacks.ini of (in this case 3.2E) in a hex editor. You need to find in your hex editor the option of going to a certain address. In XVI32 it's under Address>Goto, but different hex editors may vary. Type in the offset we just got in Windows Calculator. This will take you to that address. This shows us what the value should be, before its patched by preloader. You then need to copy 8 numbers (4 little boxes) from that address onwards. Copy this into notepad. You also need to copy several "boxes" either side.

Now open up the decrypted 00000008.app from the destination System Menu in a hex editor. You now need to search for the hex string you just copied from the last System Menu. Search for it, and when its found, hit search again. Hopefully it wont find it again, meaning this is the place. If it does find it again, go back to the first system menu and copy a few more boxes from either side as well, and try again. Do this until there is only one result.

Now you need to find the offset in this System Menu. So look at the first digit from the string you copied from the original System Menu and find it in the new one. (If you only found one result in the first search, this will already be highlighted). Take down the address of the currently highlighted box. In XVI32, this is displayed in the bottom left corner. Write this down somewhere.

Now go back to Windows calcuator and put it back in Hex. Then type in the address of the value in the new System Menu and add 8132FAE0. This gives you the new offset. Then just go into notepad and type up your hacks.ini.

[Move Disc Channel]
version=417
offset=0x813AF388
value=0x60000000

(here I ported it to 4.0U, even though it already exists for this System Menu, it was just for the sake of this tutorial)
The first line remains the same. The second line is the new System Menu version, same as the one used for NUSD. The next line is the new offset, and the last line is the value, and that remains the same.

Hopefully this was/will be useful to someone at some stage. I will update this post with screenshots of the whole process soon to make it all clearer. If you need me to, I can clarify any parts as well. Just give us a shout.

Oh, and thanks to : Crediar, for making preloader, da_letter_a, for a mentioning something that proved very helpful, and depeha, for his tutorial on phone port patching at : http://walkmans.wordpress.com/2008/01/07/patch-porting/

EDIT: Fixed a few errors. For a version with screenshots, go to : http://sifjar.blogspot.com - At the moment this has images which are probably too large - they crash Firefox everytime I try to view the page. I will try to make them smaller over the next couple of days.



Edited 4 time(s). Last edit at 07/20/2009 09:55PM by SifJar.

Applause for the great writeup.

To add some usefulness to my noise:

Quote
SifJar
The title will be 0000000100000002, and the version depends on which version and region you want. You should be able to find which one you need on wiibrew.org.

You can find the version numbers here: [wiibrew.org]
They can be found in the second to fifth column. The second column is for Japan, the third one is for U-versions, the fourth one is for E-versions, the fifth one is for Korea.
For example: System menu 4.1U is version 449 (as you can see in the third column) of the system menu.

EDIT: why was this post considered spam?

Here's a better link to a version with screenshots. http://sifjarsblog.wordpress.com/2009/08/03/tutorial-porting-preloader-hacks-ini/

Thanks. One slight addition...

When NUSD1.3beta gets the system menus it doesn't name any of them as 08.app

If you pack the wad and unpack it you get 08.apps back out. I assume these are the right ones. If you know what the "08.app" will be called there's clearly no need to pack and unpack. Some examples of the relevant app files are given below:
3.2E / v290 - 00000046.app
4.2E / v482 - 0000008b.app

Perhaps there's an easier way?

open the files in a hex editor and the right one is the one without u8 near the start of the file afaik.

Any suggestions for porting hacks.ini to hacks_hash.ini?

Quote
mauifrog
Any suggestions for porting hacks.ini to hacks_hash.ini?

Sure. If you follow this guide up to the point where you have found the original value in the first SM (just choose any SM that has the hack you want in a hacks.ini) [i.e. take the offset from hacks.ini, subtract 0x8132FAE0, go to that address in the SM DOL in a hex editor], you then want to copy the 4 bytes from that address onwards (the values to be patched), and write them in the format 0x######## (e.g. if you got the values 1F 2E 32 F4, that'd be 0x1F2E32F4). This is a "word". You want to copy enough words so that the sequence only appears once (i.e. each word may appear more than once in the SM, so you might need to copy the word after or two words after).

Once you have a unique sequence of words, that's the "hash=" value for hash_hacks.ini e.g.

hash=0x8140a464,0x8140a484

Then you just take the "value=" from the original hacks.ini and put it as "patch=" in hash_hacks.ini.

If there's more than one offset, you just need to put more than one set of "hash=" and "patch=". If you're patching sequential words, you can have multiple values for "patch=" separated by commas e.g.

hash=0x38000000,0x2c000000,0x40820010,0x38000036,0x900da9c8,0x480017
patch=0x38000001,0x2c000000,0x900DA5D8,0x38000032

Here, the first 4 words from "hash" will be patched (although the second won't actually be changed).

If you need any more help, let me know.

EDIT: I advise trying to port an already ported patch first, just to make sure you get the right result. Then try others.



Edited 1 time(s). Last edit at 03/13/2013 10:54AM by SifJar.

Thank you

Just one question, is this right?
0x8137AE64 - 0x8132FAE0 = 4b384



Edited 1 time(s). Last edit at 03/13/2013 02:18PM by mauifrog.

Yeah, that's right.