ARM11 Mario Kart 7 Unlock Everything (All regions)

#define START_SECTION __attribute__ ((section (".text.start"), naked))

// make sure code is PIE
#ifndef __PIE__
#error "Must compile with -fPIE"
#endif

int(*IFile_Open)(void *this, const short *path, int flags) = 0x0022FE08;
int(*IFile_Write)(void *this, unsigned int *written, void *src, unsigned int len) = 0x00168764;
int (*GX_SetTextureCopy)(void *input_buffer, void *output_buffer, unsigned int size, int in_x, int in_y, int out_x, int out_y, int flags) = 0x0011DD48;
int (*GSPGPU_FlushDataCache)(void *addr, unsigned int len) = 0x00191504;
int (*svcSleepThread)(unsigned long long nanoseconds) = 0x0023FFE8;

int uvl_entry();

int START_SECTION
uvl_start ()
{
    __asm__ volatile (".word 0xE1A00000");
    uvl_entry();
    __asm__ volatile ("bx lr");
}

int
uvl_entry ()
{
    unsigned int addr;
    void *this = 0x08F10000;
    int *written = 0x08F01000;
    int *buf = 0x18410000;

    unsigned int offset = 0;
    unsigned int i;
    unsigned int f;

    svcSleepThread(0x400000LL);

    //copy block of memory to buffer
    addr = 0x1413B000;      //This is the address we'll take memory from in the game
    GSPGPU_FlushDataCache(addr, 0x10000);
    GX_SetTextureCopy(addr, buf, 0x10000, 0, 0, 0, 0, 8);
    GSPGPU_FlushDataCache(buf, 0x10000);

    for (i = 0; i < 0x10000; i++)   //Scan ram for a constant value between regions
    {
        if ((buf[i] == 0x00610064) && (buf[i + 1] == 0x00610074) && (buf[i + 2] == 0x002F003A) && (buf[i + 3] == 0x0073002F))
        {
            offset = i - 2291;

            //Write screen buff so we know it worked
            GSPGPU_FlushDataCache(0x18000000, 0x00038400);
            GX_SetTextureCopy(0x18000000, 0x1F48F000, 0x00038400, 0, 0, 0, 0, 8);
            svcSleepThread(0x400000LL);
            GSPGPU_FlushDataCache(0x18000000, 0x00038400);
            GX_SetTextureCopy(0x18000000, 0x1F4C7800, 0x00038400, 0, 0, 0, 0, 8);
            svcSleepThread(0x400000LL);
        }
    }

        f = offset + 1;

        buf[f] = 0xFF01869F;//VR + Tracks

        f = offset + 2;

        buf[f] = 0xFFFFFFFF;//Characters

        f = offset + 4;

        buf[f] = 0x0000FFFF;//Karts

        f = offset + 5;

        buf[f] = 0x000000FF;//Wheels

        f = offset + 6;

        buf[f] = 0x000000FF;//Gliders

        f = offset + 7;

        buf[f] = 0x000900FF;//Mirror Mode & Title Art & 10,000 VR flag

        //flush back to memory and also write to file for debuging
        svcSleepThread(0x400000LL);
        GSPGPU_FlushDataCache(buf, 0x10000);
        GX_SetTextureCopy(buf, addr, 0x10000, 0, 0, 0, 0, 8);
        GSPGPU_FlushDataCache(addr, 0x10000);
        //IFile_Write(this, written, buf, 0x10000);
        svcSleepThread(0x400000LL);

    return 0;
}