Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Ocarina of time payload for writing a bigger payload with control stick positions on all 4 players
- Each stick has a x and y pos, so we can write 8 bytes per frame with 4 control sticks
- To start executing the payload, hold L on player 4
- Yes you can easily use less registers, but with where the hook is it seems we are free to use any t registers we want
- //prologue of payload, only ran once
- addiu t9, r0, 0x000C //revert the 000C corruption
- lui $at, 0x800D
- addiu $at, $at, 0x1020 //needed because we can't type E0 or F2
- sh $t9, 0xD0D2($at)
- //
- LUI t9, 0x800A
- ORI t9, t9, 0x2634 //pointer to JAL that disables p2 controller
- SW r0, 0x0000 (t9) //remove p2 JAL
- SW r0, 0x000C (t9) //remove p4 JAL
- LUI t9, 0x800A
- ORI t9, t9, 0x0BC8
- LUI t8, 0x0807
- ORI t8, t8, 0x7428
- JR RA
- SW t8, 0x0000 (t9) //write a jump to 0x801DD0A0 to address 800A0BC8
- //payload ran every frame
- LUI t0, 0x801C
- ORI t0, t0, 0x84B6 //p1 analog stick address
- LH t6, 0x0000 (t0) //load controller 1 input
- LH t1, 0x0018 (t0) //load controller 2 input
- LH t2, 0x0030 (t0) //load controller 3 input
- LH t3, 0x0048 (t0) //load controller 4 input
- LUI at, 0x8040
- LW t4, 0x0000 (at)
- ADD t5, at, t4
- SH t6, 0x0004 (t5) //store controller 1 input
- SH t1, 0x0006 (t5) //store controller 2 input
- SH t2, 0x0008 (t5) //store controller 3 input
- SH t3, 0x000A (t5) //store controller 4 input
- ADDIU t4, t4, 0x0008 //increase by 8 bytes
- ORI t5, r0, 0x0020
- LB t6, 0x0047 (t0)
- BEQ t6, t5, 0x801DD0F0 //if p4 is holding L, execute
- NOP
- JR RA
- SW t4, 0x0000 (at)
- .runpayload
- J 0x80400004
- NOP
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement