Hacking Post your WiiU cheat codes here!

[admin]

Here you can find everything you need to know about Wii U Cheat Codes.

Spoiler: Why have many codes stopped working? Why is the location shifted by 0x2000?

This is a very common issue with the system. Depending on what homebrews are loaded the system uses different memory alignments which cause many addresses above 0x11000000 to be shifted (commonly by 0x2000). However, it is possible to make pointer codes which always get the right address.

None of them are the "real" ones. Right before the Game starts you have to allocate some memory for the Threads and their stacks. I think I changed up the alignment by cleaning up the code for the release on GitHub. Best opinion would be using the current layout.

Spoiler: Where do I find Cheat Codes?

You can check out the aracom's (aka Amibu) website where you can also submit your own codes: http://wiiucodes.tk/
My site also features an extensive database of codes and game specific documentations: Cheat Code Database | Game-specific documentations (some pointer codes are not yet updated to the new format. Will be fixed later)
Beneath you will also find some cheat codes.

Spoiler: Where can I share my cheat codes?

• Visit http://wiiucodes.tk/ or post them here.
• Before posting/submitting new codes ensure the codes you have found aren't already found by another one. If your code contains addresses found by another one, please give credits in the description
• When submitting codes ensure you the submission fits your region and game revision
• Do not share codes you have hacked with a game launched through Loadiine since Loadiine will cause many addresses to be shifted.
• Use the right formatting:
  Code Title [Author]
  XXXXXXXX XXXXXXXX
  XXXXXXXX XXXXXXXX
  *note
  
  Example:
  Max. Health [CosmoCortney]
  00000000 15073BC1
  00000050 00000000
  *gives you max. health/all 20 hearts

Spoiler: What Do I need in order to use/create cheat codes?

Hardware:

• Ensure your Wii U's FW is between 5.3.2 and 5.5.1 (FW below 5.3.2 are untested)
• An SD Card
• A computer (preferable OS: Windows 7 or higher, 64bit recommended)
• A router
• A wifi- or eithernet connection between your router and computer. Eithernet recommended

Software:

• JGecko U (an all in one remote debugger and hacking tool)
• Java 8 or higher (64bit recommended)
• Optionally TCPGecko .NET (Same as JGecko U, buggy and less equipped)
• HomebrewLauncher.elf (A kernel-based homebrew launcher. Check out this thread)
• Optionally the kernel exploit and HomebrewLauncher.mp4/html (to load HomebrewLauncher.elf) if you are going to self-host. Check out this thread
• TCPGecko.elf (An important tool to load the codehandler and connect to JGecko U/TCPGecko .NET)
• codehandler.bin (A piece of software that executes cheat codes)
• A pointer searcher. Bully's java-based universal Pointer Searcher is recommended. Alternatively you can use Mr. Mysterios's Pointer Searcher for Windows

Spoiler: How do I enable/apply cheat codes?

Step 1: Preparing your SD Card.

1. Insert your SD Card into your computer
2. Format it as FAT32 with default cluster size. However, 4096 Bytes should be fine as well
3. Create the following paths and copy the files as shown here:
   SD_CARD:\wiiu\apps\homebrew_launcher\ {place homebrew_launcher.elf and its icon and meta here}
   SD_CARD:\wiiu\apps\TCPGecko\ {place tcpgecko.elf and its icon and meta here as well as the codehandler.bin}

Spoiler: file tree

SD_CARD:\wiiu\apps\homebrew_launcher\homebrew_launcher.elf
SD_CARD:\wiiu\apps\homebrew_launcher\icon.png
SD_CARD:\wiiu\apps\homebrew_launcher\meta.xml
SD_CARD:\wiiu\apps\TCPGecko\tcpgecko.elf
SD_CARD:\wiiu\apps\TCPGecko\icon.png
SD_CARD:\wiiu\apps\TCPGecko\meta.xml
SD_CARD:\wiiu\apps\TCPGecko\codehandler.bin

1. Do not use different folder or filenames otherwise the codehandler.bin won't be found
2. Insert your SD Card into your Wii U

Step 2.0: Exploiting your Wii U and open up the Homebrew Launcher

For self-hosters:

1. Get Mongoose (free version is sufficient) to host a local website
2. Create a folder where you want to host the exploits from.
3. Open your anti-virus software or defender and create an exception for this folder so its content won't be detected as viruses
4. Download any exploit pack you can find on GBATemp to the folder
5. extract it
6. Open Mongoose and set up the shared directory. You can find it by clicking the little arrow on the righ side of the task-bar. Right-click the Mongoose icon and click on "set shared directory". Now navigate to the folder that contains the index.html
7. Open command prompt (CMD) and type in ipconfig /all
8. search for your computer's local IP address. It should look like this: 192.168.XXX.XXX. Remember it! Mine for instance is 191.168.1.103
9. If not already done connect your Wii U with your router
10. Turn on your Wii U and open the webbrowser. Type your computer's local IP address like the following: http://192.168.XXX.XXX/
11. Now open the kernel exploit
12. if successfully executed open the webbrowser again and open the HomebrewLauncher.
13. Continue reading at Step 3

Step 2.1: For onlineusers

1. Visit any exploit hosting website.
   recommended: http://wj44.ml/
2. Now open the kernel exploit
3. if successfully executed open the webbrowser again and open the HomebrewLauncher.
4. Continue reading at Step 3

Step 3: Once your in the Homebrew Launcher

1. Open TCPGecko.
2. Remember your Wii U's local IP address
3. Press X to install CosmoCortney's Codehandler
4. You should be sent back to the Main Menu
5. Launch any game. StarFox Zero and StarFox Guard are currently not supported

Step 4: Apply Cheat Codes

1. Open JGecko U
2. You can let JGecko U try to detect your Wii U's IP address. If it fails enter it manually
3. Once connected change to the Cheat Code tab
4. Click Add cheat
5. On the new window enter a title, the code itself and hit ok
6. Tick all cheats your want to apply and click send
7. Have fun!
8. I recommend to read the thread dedicated to JGecko U

Step 5: Searching for cheats

1. Open JGecko U (recommended) or TCPGecko .NET
2. Connect either one of them to your Wii U
3. Now you can start searching. Below you will find a little instruction by Cyan explaining how to perform a known value search. Good tutorials are being made
4. please mind that´a lot of cheats' addresses change depending on the revision, other running homebrews. If this is the case please create a pointer code

Read the Cafe Code Type documentation to learn how to format cheat codes for the Wii U.

Spoiler: About Online Cheating

Absolute No-Goes[/B]: Speed code, Moon Jump/fly, invincibility, Speed Hack (that changes game's speed), reset timer, lap count modifier, ranking modifier, max points, infinite health, strafe modifier, instant win, unlockables that are yet not released or unused, and anything else that affects the game in any bad way for your opponents
Choose wisely (Don't do this to gain impossible combinations): Unlockables, level/gear up, equipment modifier
No Problem: Visual modifications, audio modifications, outfit modifier, anything else that does not affect the gameplay

Do not post screenshots featuring cheats or any cheat codes to Miiverse! Nintendo will quickly get you banned. Share them here or on Twitter


If a code works on a different version too, please tell this here with tagging the code's creator

Spoiler: Tutorials

How to "poke" Cheat Codes while playing/probing addresses
Once you are connected with the game the tab's content within TCPGecko and JGecko U will be available to edit.
on the Search tab, above the "connect" button, you have two empty text field.
The following types of data can be poked:
8-bits: LLLLLLLL XX
16-bits: LLLLLLLL XXXX
32-bits: LLLLLLLL XXXXXXXX

JGecko U additionally features the following:
64-bits: LLLLLLLL XXXXXXXXXXXXXXXX
96-bits: LLLLLLLL XXXXXXXXXXXXXXXXXXXXXXXX

LLLLLLLL represents the address/location
XX represents the value where XX (two X) represent a byte


About pointers code
Pointers are noted like this :
[[LLLLLLLL] + QQQQQQQQ] XXXXXXXX

pointer-in-pointer like this:
[[[LLLLLLLL] + QQQQQQQQ] + QQQQQQQQ] XXXXXXXX
LLLLLLLL represents the address/location of the (first) pointer. QQQQQQQQ is the offset to the value or next pointer. XXXXXXXX represents the value.


the difference is that instead of poking the value of XXXXXXXX to address LLLLLLLL, you need to look at the address located at [LLLLLLLL] and add QQQQQQQQ to it. this is the location where you need to poke XXXXXXXX.
Example :
[10123456] + 1A BBBBBBBB
1. go to 10123456
2. open your calculator and write the value you found at that position.
3. add 1A to get a new address (the result is the location where you need to poke).
4. go to that result address
5. poke BBBBBBB

More help on pointers can be found here and here.
a full tutorial about pointers can be found here.


Searching Codes - Known values
To search code follow the guide above to connect TCPGecko to the game. and go to Search tab (the first one).

You will have to search the WiiU memory for the value you want to edit.
For example, if you have 10 lives and want 99 lives, then you will have to "play" with the live count.


Step1: initialize the search engine with your current live count

Select the memory range: 10, replace 50000000 to 40000000 (access to memory above 4 is not allowed by some game and will crash). If the gae still crashes during the search process reduce the range a bit more (to 3C000000 for instance)
If the maximum possible value is smaller than 255/0xFF you will have to do an 8-bit search. If the maximum possible value is smaller than 65535 but can be bigger than 255 use a 16-bit search instead. If the value can be higher than 65535 do a 32-bit search.
JGecko U will allow you to do 64-bit and 96-bit searches. They are made to search for up to 3 consecutive floats (to make it easier to find size modifiers).
Select "specific value" and enter 10 (for 10 lives). right-click the "10" and select "Dec to Hex" to convert 10 to hexadecimal A
Be sure you will not lose any lives in game for 10-15min (don't move, or press Start to pause the game). Attention, do not press Home to pause!
Press Search button, TCPGecko/Jgecko U will now search all the memory range for your value.
when completed, it will display a list of found address (few thousands!)

Note: to speed up the search, you can limit the range from 10000000 to 150000000, if nothing is found then start from 15000000 to 30000000, etc.
It requires restarting the search from the start with different ranges, but will fasten the user's input.



Step2: Refine address

Play the game, change map, change any content of your inventory, HP, lives, etc. whatever you want.
if your live is now 8, Select Specific value and enter 8.
Press search button and wait until TCPGecko/JGecko U has compared all the addresses of the previous search with the current one. All addresses of which value has changed from 10 to 8 will be kept. All other will be removed from the list.

Step3: Refine more
Repeat Step2 with different values.

Step4: Try possible address
right-click one of the address in the list and select "poke".
The address will be copied to the field on the bottom. in the "value" field, enter 63 (99 in hex) and click the "poke" button.
If nothing happens on the game side, it's not the correct address. try another one.
If your lives number in the game became 99 you found a cheat ! Note the address and the value.

There are a lot of "pseudo cheats" that change the displayed text but not the value itself. Once you gain a life/coin/rupee the value will be reset +1. Try another address and collect a life/coin/whatever. If the amount jumps to you poked value +1 you have found the right address.

Searching Codes - unknown values
To search codes with unknown values, you will have to compare memory (equal, bigger, smaller, different, etc.)

Step1: initiate search.
Select "unknown value" and "equal". Click search button.
TCPGecko/JGecko U will store that 'unknown' value in "column1"
Remember that your current game state is column1.

Step2: Refine step
play, change values.
Select "column1" in the search condition, and determine if the current value in game is equal to column1, bigger to column1, smaller, different, etc.
Press Search. The current state of the game will be stored in "column2".

Step3: Refine more.
repeat step2, select the column you want to compare with the current game's state until TCPGecko provide a small address list.
Then Poke the possible address to see if it works.

If TCPGecko does not find any matched, Select "no" and it will reset all the search engine.

Spoiler: Troubleshooting

TCPGecko can't connect
1. Be sure your network is enabled on WiiU (and that you block Nintendo update servers with a proxy, DNS or router)
2. Verify your Firewall allows network access to TCPGecko and is not blocking the port used by the program.
3. Verify your antivirus (example : AVAST!) is not blocking communication with your wiiU.
4. do not try to connect before launching the game !

What is the data type size?
32bit means that TCPGecko will search for a full 32bit memory address. If you search value 0x63 then it will search all "00000063" values in memory.
16 bit will search all "0063" values
8 bit will search all "63" values.

What is the best data type size?
Often, 32bit is best as the developer just use "int" (32 bit) as variable type. storing health or lives are often 32 bit long.
if you search 8 bit for health, 1) you might not find the correct memory address (because health can be more than 255) and 2) you will keep wrong address as possible match. For example address with value 25BD63FA will be kept by TCPGecko because it contains "63" but it's not a typical variable format. "00000063" is the typical format for storing a value in game.

But sometime, you need to search smaller values, for example in a game your bag have slots where you can store different items. There's a chance that the bag itself contains only a list of possible items "sword, shield, boomerang, bomb, etc.". if there's less than 255 item in the game, then item code is stored on 8bit (0x00 to 0xFF)
bag emplacement = AABBCCDD EEFFGGHH
each letter is an emplacement, and can contain an item value. if sword is 01 and shield is 04, the bag can be 04010000 for "shield, sword, empty, empty".

in that case, you need to search a 8 bit size, because the full 32 bit contains 4 different information (4 bag's slot)
Here, you are not searching for a value, but for items type, or location on the bag, etc., it's rare that a full 32bit is used for that data.

So, when do I select 32bit, 16bit or 8bit?
This is up to you to understand what you are searching.
just remember that:
8 bit can store value from 0 to 255, so if you search a code for max money and that money can be bigger than 255, then don't choose 8bit!
16 bit can store value from 0 to 65535, if max money is 99 999 then it's still not enough
32 bit can store values from 0 to 4294967295


I found an address, but if I reload the game it doesn't work anymore!
It means the address you found is not fixed. the game is using pointers to store the data you want to edit, and the data can be located somewhere else on next reboot, or even on next level/map !
You will have to use pointer search instead of normal search.
You can find more information about pointers here: http://gamehacking.org/faqs/wiiexample2.htm
It's a Wii tutorial, but it's a good place to understand what pointers are and how it works.

On WiiU, you will have to use WiiU Pointer Search program. there's a Youtube tutorial. (link will be added later)


TCPGecko crashed or can't (re)connect. Is it a WiiU's side issue or Computer's side issue?
TCPGecko often crashes without releasing the connection socket, freezing all further connection attempt.
There's a modified handler version wich force a release the socket, but you need to host the exploit yourself (see the links at the top of the tutorial).

You can check if the connection issue is from TCPGecko or from your WiiU by using PyGecko.
Using PyGecko will let you see if your computer can connect to the WiiU using a different program.

1. You need to install Python 2.7 (not Python 3.0)
2. Go to pyGecko folder and open a command line there (On windows 7+ : shift+rightclick > open command line here)
3. type "python pygecko.py" without the quotes and press enter
4. type one per line and press enter (note: replace x.x.x.x with your WiiU IP):

rpc = TCPGecko('x.x.x.x')
import struct
addr = rpc.readmem(0x10000000, 4)
print(struct.unpack('>I', addr)[0])

if "rpc" command doesn't give you a timeout error, it means the code handler is installed and working. the print function will display the first 32bit of 0x10000000 range.

Spoiler: Code List

Coming Soon.

Spoiler: Game Trainer

Game Trainer are GUI software that directly allow you to use cheat with a specific game.

Mario Kart 8 Trainer
XCXGecko: Xenoblade Chronicles X Trainer
BOTW Trainer
Wind Waker HD Trainer
Twilight Princess HD Trainer
Hyrule Warrior Trainer
Paper Mario: Color Splash Trainer

Explanations:

Spoiler: Whats the codehandler?

The codehandler is a little piece of software that executes cheat codes while it runs in the background. It first checks what type of cheat code is being used (Code Type) and then jumps to the corresponding function. It then checks whether a pointer has to be loaded or a direct address. After that it checks the data size and executes the cheat. Once the cheat is executed the codehandler checks for the next cheat and so on. This allows you to build cheat codes of any kind. Activate them by pressing a button, execute PPC ASM, do integer and floating point operations to archive great effects and even more.

Change log:

• sort of initial release/proof of concept which had to be injected into memory by the early versions of JGecko U. The codehandler was executed by an .rpl inside the memory. This method was really unreliable, caused some games to freeze and did not work on FWs higher than 5.3.2.
  By some time it supported RAM writes, String Writes, Skip- & Incremental Writes, conditionals of ==, !=, <, >, =< and =>, load int, store int, load float, store float, int ops, float ops, termination.
• a new version of TCPGecko has been release which has to be launched via the Homebrew Launcher. wj44 and I talked about some possibilities about installing the codehandler so I created the codehandler.bin which is now its own executable file. The new TCPGecko build is capable of installing the codehandler which provides absolute reliability. New codetypes such as like as conditional &&, ||, value between, add time dependence, reset timer, timer termination, no operation, fill memory, load pointer, add offset to pointer and corruptor have been added. The old pointer scheme was removed since it only allowed a pointer depth of 2 levels. The new release features an infinite pointer depth
• the cheat codes have now to be sent into another memory. So we can now execute assembly codes and perform syscalls!
  This has been released yet but comes with a few struggles. The new memory range has no write permission which leads to freezes. But this problem should be solved with kern_write.
  The new range is needed in order to execute assembly codes and to store cheats from an SD card (if this feature will ever be a thing)

Spoiler: What is TCPGecko.elf?

This program has to be launched via the Homebrew Launcher. It then builds up a TCP connection between the Wii U and your computer. It allows to install the codehandler to feature cheat code execution. The socket code of it causes some games to freeze on the boot screen such as like as StarFox Zero.

Spoiler: What is JGecko U?

This can be considered as the successor of TCPGecko .NET. It is less buggy, platform independent and features more options. It's an all-in-one debugging tool that lets you create, save, load and send cheat code lists.

Thanks to:
CosmoCortney: thread creation, cheat code maintainer, Cafe Code Type creator/designer and Codehandler developer
wj44: TCPGecko.elf, Exploit hosting
Cyan: Known-Value-Search Tutorial writer
BullyWiiPlaza: Developer of JGecko U and the Java-based Pointer Searcher
aracom (aka Amibu): for creating the official Wii U Cheat Code Database
Mr. Mysterio: Cheat code maintainer, creator of the Pointer Searcher for Windows
And all users who submit cheats