Cheating in Nintendo Games with Cheat Engine

As you may know, Wii games don't have any known action replay codes, and some of you may have found that memory editing doesn't seem to work.

Disclaimer ⚠️

The methodology herein is obsolete for two reasons. For one, endianness can be set within Cheat Engine. Secondly, dolphin now has a built in cheat search function.

It is still valuable for informational purposes, and for use with other memory editing tools such as scanmem.

Background

Memory editing, in short, involves searching for the values (health, lives, coins, points) that you want to edit, then changing or freezing them.

If you're seeking to cheat in a Gamecube game, chances are that cheats are already loaded. Right click on the game in the Dolphin window, go to Properties > AR Codes. Choose the codes you want, and start up the game. That's it.

Get the Memory Editor

The best memory editor is Cheat Engine. Download it from CheatEngine.org. On Linux, something like scanmem can do the trick.

Configuration

Open up Cheat Engine. Go to Edit > Settings. On the left, choose the "Scan settings" page. Make sure that MEM_MAPPED is CHECKED. This is required for things to work.

Master Code

The following is a piece of JavaScript which runs right in your browser. We'll need it later in the tutorial. To use it, copy to clipboard, paste into your console (CTRL+SHIFT+I), and press Enter:

let i = Number(prompt("What's your integer?")).toString(16);
if((i.length & 1) == 1)
  i = "0" + i;
let z = [], min = "";
for(var a = 0; a < i.length; ++a) {
  if(min.length==2) {
    z.push(min);
    min = "";
  } else if(a == i.length - 1) {
    z.push(min += i[a]);
  }
  
  min += i[a];
}

z = z.reverse();
while(z.length < 4)
  z.push("00");
  
alert(Number("0x" + z.join("")));

This code is necessary because Wii and Gamecube games don't use regular byte order in memory. Essentially, it uses reversed, or "big-endian" byte order. This complicates things because Cheat Engine does not have a reverse search function. Luckily, this code does all the dirty work of converting a big endian number to a little endian one. An example of endian-ness is demonstrated as follows:

Number (Decimal / Regular): 1337

Little Endian 4 Byte Integer (Hexadecimal) 05 39 00 00

Big Endian 4 Byte Integer 39 05 00 00

Not much too it. The byte order is just reversed. You can also use my Endianness reversal page to interactively rotate bits.

Case Study: Super Smash Bros. Brawl Coins

A companion video is available for this example.

Coins in Smash Bros. can get you trophies. Open up the emulator, open up Brawl. Open up Cheat Engine. Be sure that the Scan Type is "Exact Value" and that the "Value type" is 4 bytes. In "Memory Scan Options", choose "All".

Ok, so we'll start up the game (go to Vault > Trophies and Stickers > Coin Launcher). Let's say we had 1337 coins. Pause the game. Use the master code to determine our big-endian number, which turns out to be 956628992.

Do a "First Scan" for this value in Cheat Engine.
Go back to the game and fire a single coin.
We now have 1336 coins. The master code tells us that the value is 939851776.
Do a "Next Scan" for this value.
Repeat steps 2-4 until you see addresses sharing the same value (usually about four).
Add these addresses to the table (click that red arrow pointing to the table).

Now that we have our target addresses acquired, we can do basically two things: increase this value, or freeze it (or both). Let's say we wanted 9999 coins.

To change the value, select all the addresses in the table related to the value, right click on one of them, and go to Change Record > Value.

Now we're dealing with big endian numbers, so we have to use the master code to get the equivalent for 9999, which turns out to be 254214144.

Once the value is set, go to the game. You'll notice the old value may still be there. But if you update the value (fire a coin), you'll see that it actually registered if it didn't appear to in the first place.

Bonus

I only have a FEW tries to get the value, and I'm left with a LARGE number of values even after narrowing it down. You can use save states to help. Save a state where the target number is high. Search, narrow it down. When you run out, just load the state, and continue searching and narrowing it down. You can eventually find the code this way.

Conclusion

That's it! Leave any comments, questions or concerns below.

avindra/Hacking Nintendo Games with Cheat Engine.md