WiiU AutoSplitter stuff

EXPORT_FUNC_C(int, OSLaunchTitlev, u64 titleId, u32 argc, char* argv[]);
EXPORT_FUNC_C(int, OSLaunchTitlel, u64 titleId, u32 argc, ...); //wrapped by _SYSLaunchTitleDirect --> OSLaunchTitlel with 0 argcs
EXPORT_FUNC_C(int, OSLaunchTitleByPathv, const char* path, u32 pathLen, u32 argc, char* argv[]);
EXPORT_FUNC_C(int, OSLaunchTitleByPathl, const char* path, u32 pathLen, u32 argc, ...);

OSLaunchTitleArgvStr everything lands here
LaunchTitleArgvStr, launch_title

EXPORT_FUNC_C(int, OSRestartGame, u32 argc, char** argv); (wrapped by SYSRelaunchTitle --> still use OSRestartGame)
EXPORT_FUNC_C(void, OSForceFullRelaunch, void);


http://rawpixels.net/
1280x720
RGB32
RGBA
8,8,8,8
Packed
(ignore alpha)


Foreground app memory (RAMPID 7): 0x50000000 to 0x8FFFFFFF (0x40000000)
App MEM2 region: 10000000

logical addresses + 0x40000000 = physical address

Espresso CPU:
1.243125 ghz cpu --> 1243.125 MHz

Latte GPU:
549.999755 MHz

Starbuck:
Possibly 400MHz (Starlet Wii arm processor: 243 MHz)

Espresso CPU timings:
248625000 bus speed / 4
62156250
62156,248 ticks are one millisecond

Starbuck CPU timings:
-1000129 ticks are one second
-1000108 ticks are one second
-1000000 should be it

1380769619131401 ticks since epoch
48,717808219178082191780821917808 actual years since epoch = 17782 actual days since epoch = 1536371330 seconds

wiiu: 43,783917400158580669710806697108
0,68767123287671232876712328767123

1.1.1975: 15956-15957 (55-58 erlaubt)

03:58 = 4E7CDC98BE073 = 1380770942541939
04:15 = 4E7CE0657E716 = 1380771962545942
1020004003 ticks in 17 min (17,000066716666666666666666666667 minuten)
17 min



Need to build mcp, kernel and main lib in this order

Need:
MEMAllocFromDefaultHeap (mem2 allocs) --> svcAlloc, svcAllocAlign, svcFree

OSGetTitleID (ppc sends it over)

DCFlushRange --> svcFlushDCache

OSIsAddressValid --> int check_ppc_addr_range(void *address, u32 size) = 0x5E (syscall id) //returns -1 if wrong, 0 if good
OSGetTime --> int IOS_GetAbsTime64(u64 *out_buf) = 0x1D (syscall id) //returns 0 if success, current time since epoch in ticks (microseconds)


http://wiiubrew.org/wiki/IOSU_Syscalls (use retail ids)
Syscalls: 0x100 (length) for one
Find address with: 0xE7F000F0 + (0x100 * syscall id)

Initial boot (boot from HBL):
1. Pack exploit and autosplitter together. Strip out h files onto sd/app folder if necessary and load them on boot
2. Run exploit (no function hooks, only if exploit hasn't been run yet, if it has skip to step 3, no deinit of stuff)
3. Load DBConfig (button remaps, amiibo remaps, stick axis invert, language remap)
4. Softexit to System Menu

System Menu:
5. In System Menu starts patching hooks (for language remapping etc) (maybe patch ppcExit instead of exit)
6. On first ever title or menu launch when app launched == 1 (gated) issue ioctl after checking the handle exists to iosohax that connections are now allowed, otherwise IOSU instantly closes connections (block the ports regardless at all times). Send address of shared gamepadData and frameCounter Pointer as well.
7. IOSU draws one red pixel in framebuffer --> gamepad and TV on boot of games (draw permanently in a separate thread)
8. Input Display accepts connections as soon as the ioctl gate has been unlocked and gamepadDataPtr and frameCounterPtr address is acquired. Use sleep to achieve periodically "polling". 120 frames per second autosplitter and 60 frames for the input display
9. gamepadDataPtr is set by a combination of WPADRead and VPADRead hooks (pro controller takes priority). Gxwaitforvsync hook decides what to set gamepadPtr to
10. gamepadDataPtr is set to 0 on title exit (exit/ppcExit), IOSU then stops showing inputs

Any Title (System Menu + games):

11. Whenever a title is booted ioctl send title id that was launched. Otherwise title id is 0
12. Autosplitter on IOSU verifies that the title id in question is running, otherwise connection closes

IOSU autoSplitter max space usage: 55650 bytes (45 MB global heap, 262 kb shared data IOSU) 0x10000 = 65536 bytes (acquire using svcAlloc)

13. Remaps are handled on the elf side
14. On return to HBL close gate with ioctl before app unloads and reset gamepadData Pointer
15. elf blocks all ports (via socket listen hook) that arent coming from the MEM2 app code block (block autosplitter, input viewer port always)
16. anti cheat protection is handled in elf in gx2waitforvsync hook
17. Gx2waitforvsync hook increases global frame counter on every single call in an u32* ptr address with no rese (might have to gate it to home button calls)

Dump finished run achievements to system slc somewhere? One file. Fourcc. 4 byte size index. 28 bytes per entry (8 byte title id, 8 byte start time absolute, 8 byte end time absolute, 4 byte total load frames). Encrypt 28 bytes with aes 256 bit public key. Allow special pc app using autosplitter port with a special handshake value to receive the file to the pc. Only I have private key for decryption

Add softreset combination that works in every game and forces a game reboot (VPAD/KPAD) = OSRestartGame
Adjust autosplitter PC app to send byte stream. Adjust autosplitter WiiU to work without std::vector (dynamically growing array instead)

if mem2 allocation for autosplits crash botw, need to move entire autosplitter to kernel IOSU too without using std::vector



OLD:

Perform find export for HIDStart at the beginning
compute offset to Hidparams
send to ioso via hax

02000580 HIDStart
020008D8 Buffered Data

02000510 get params
020007E8 get data
+0x358

OSDynLoad_FindExport(nsysccr_handle, 0, "CCRHIDStart", &real_addr1);
-0x70 = get params

OSDynLoad_FindExport(nsysccr_handle, 0, "CCRHIDGetBufferedData", &real_addr2);
-0xF0 = get data



vpad init: 0x02001820
+0x1EFC
=
vpad parser: 0x0200371C



vpad init: 0x02001820
+0x1EDC
=

RetrieveInputSectionForChannel: 0x020036FC

28c
358


112361C
1123644
28

10027BF8 = ptr to data where inputs get written by ncsys lib
10027BFA = 16 bits all held button codes besides Sticks

102EF780 = where inputs are stored in the vpad library (until 102F077F)

Stick offset:
0x218
0x27C


0x278 byte
0x27C word
0x280 byte