ARM11 Mario Kart 7 Unlock Everything

#define START_SECTION __attribute__ ((section (".text.start"), naked))

// make sure code is PIE
#ifndef __PIE__
#error "Must compile with -fPIE"
#endif

int(*IFile_Open)(void *this, const short *path, int flags) = 0x0022FE08;
int(*IFile_Write)(void *this, unsigned int *written, void *src, unsigned int len) = 0x00168764;
int (*GX_SetTextureCopy)(void *input_buffer, void *output_buffer, unsigned int size, int in_x, int in_y, int out_x, int out_y, int flags) = 0x0011DD48;
int (*GSPGPU_FlushDataCache)(void *addr, unsigned int len) = 0x00191504;
int (*svcSleepThread)(unsigned long long nanoseconds) = 0x0023FFE8;

int uvl_entry();

int START_SECTION
uvl_start ()
{
    __asm__ volatile (".word 0xE1A00000");
    uvl_entry();
    __asm__ volatile ("bx lr");
}

int
uvl_entry ()
{
    unsigned int addr;
    void *this = 0x08F10000;
    int *written = 0x08F01000;
    int *buf = 0x18410000;

    unsigned int i;

    //IFile_Open(this, L"dmc:/mem-0xFFFF0000.bin", 6);
    svcSleepThread(0x400000LL);

    //copy block of memory to buffer
    addr = 0x1413C140;      //This is the address we'll take memory from in the game
    GSPGPU_FlushDataCache(addr, 0x10000);
    GX_SetTextureCopy(addr, buf, 0x10000, 0, 0, 0, 0, 8);
    GSPGPU_FlushDataCache(buf, 0x10000);

    i = 1;

    buf[i] = 0xFF01869F;//VR + Tracks

    i = 2;

    buf[i] = 0xFFFFFFFF;//Characters

    i = 4;

    buf[i] = 0x0000FFFF;//Karts

    i = 5;

    buf[i] = 0x000000FF;//Wheels

    i = 6;

    buf[i] = 0x000000FF;//Gliders

    i = 7;

    buf[i] = 0x000900FF;//Mirror Mode & Title Art & 10,000 VR flag

    //flush back to memory and also write to file for debuging
    svcSleepThread(0x400000LL);
    GSPGPU_FlushDataCache(buf, 0x10000);
    GX_SetTextureCopy(buf, addr, 0x10000, 0, 0, 0, 0, 8);
    GSPGPU_FlushDataCache(addr, 0x10000);
    //IFile_Write(this, written, buf, 0x10000);
    svcSleepThread(0x400000LL);

    //Write screen buff so we know it worked
    GSPGPU_FlushDataCache(0x18000000, 0x00038400);
    GX_SetTextureCopy(0x18000000, 0x1F48F000, 0x00038400, 0, 0, 0, 0, 8);
    svcSleepThread(0x400000LL);
    GSPGPU_FlushDataCache(0x18000000, 0x00038400);
    GX_SetTextureCopy(0x18000000, 0x1F4C7800, 0x00038400, 0, 0, 0, 0, 8);
    svcSleepThread(0x400000LL);

    return 0;
}