Corrupt.wiki
  • Videogame corruptions
    • Introduction
    • Communities
    • Safety and Ethics of Corruptions
    • What makes a good corruption?
  • Real-Time Corruptor
    • RTC Discord
    • Download RTC
    • Beginner Guides
      • Tutorial Video Guide
      • Corruption Classroom
      • Cheat Sheet Guide
    • In-Depth Guide
      • Introduction
      • Frequently Asked Questions
      • Simple Mode
      • Concepts and Vocabulary
      • General Parameters
      • Corruption Engines
      • Emulation-centric features
      • Classic Vector Lists
      • Glitch Harvester
      • Blast Editor
      • Blast Generator
      • Virtual Memory Domains
      • VMD Generator (Advanced)
      • Cluster Engine (Advanced)
      • Hotkeys
      • Tips, tricks and quirks
    • More RTC Guides
      • RTCV Dev Startup Guide
      • Running RTCV on Linux
      • How to make Passthrough Lists
      • Sequence Loader Plugin
  • Other Corruptors
    • Classic Corruptors
      • Vinesauce ROM Corruptor
      • VineCorrupt
      • Android Vinesauce ROM Corruptor
      • Lesser known corruptors
      • Old Corruptors
    • Scares Scrambler
    • Cheat Engine
    • Web-Based Corruptors
  • Systems
    • NES
      • Corrupting the NES
      • NES Architechture
      • NES Memory Domains
    • SNES
      • Corrupting the SNES
      • SNES Architechture
      • SNES Memory Domains
      • SNES Audio Tinkering
    • Sega Genesis
      • Corrupting the Sega Genesis
      • Genesis Architecture
      • Genesis Memory Domains
      • Cracking the Checksum Routine
    • N64
      • Corrupting the N64
      • N64 Architecture
      • N64 Memory Domains
      • N64 Basic/Advanced ROM Corruption
      • N64 Expert ROM Corruption
    • Gameboy Advance
      • Corrupting the GBA
      • GBA Architecture
      • GBA Memory Domains
    • Nintendo DS
      • Corrupting the DS
      • MelonDS Memory Domains
      • MelonDS-Specific Lists
      • Rom Corruption (Deprecated)
    • Gamecube/Wii
      • Corrupting the GC/Wii
      • Dolphin Memory Domains
      • Dolphin-Specific Lists
      • Using a real Wiimote with Dolphin
      • Dolphin Narry's mod (Deprecated)
    • Playstation 1
      • Corrupting the PSX
      • Advanced corruptions
    • Playstation 2
      • Corrupting the PS2
      • PCSX2 Memory Domains
      • PCSX2-specific Lists
    • Playstation 3
      • Playstation 3 Executable Corruptions
    • Xbox 360
      • Xbox 360 Executable Corruptions (Real Console)
      • Xbox 360 Executable Corruptions (Xenia)
    • Nintendo Switch
      • Switch ROM Corruptions
    • Computers & Mobile
      • Corrupting Android Unity games
      • Corrupting Files with FileStub
      • Corrupting PC Games with ProcessStub
      • Corrupting VMware snapshots
    • Java
      • Java Corruptor Plugin
      • Corrupting Minecraft with the Java Corruptor Plugin and FileStub
      • Corrupting Project Zomboid with the Java Corruptor Plugin and FileStub
Powered by GitBook
On this page
  • Gamecube & Wii Savestate Corruption
  • Index
  • Dolphin Narry's Mod
  • The concept of Savestates
  • A Brief Overview of the Consoles
  • The Gamecube has:
  • The Wii has:
  • Corrupting the Savestates
  • The Savestate Info Tool
  • Target Dolphin
  • Additional Info

Was this helpful?

  1. Systems
  2. Gamecube/Wii

Dolphin Narry's mod (Deprecated)

PreviousUsing a real Wiimote with DolphinNextPlaystation 1

Last updated 1 year ago

Was this helpful?

This is documentation for the old "WGH + Dolphin Narry's Mod" method of corruption Gamecube/Wii games. This page is kept for information archival purposes. This documentation is for valid for RTC 3.xx versions only.

Gamecube & Wii Savestate Corruption

Index

Dolphin Narry's Mod

Author:

Source:

Download:

Dolphin Narry's Mod is a modification of Dolphin which contains various changes dedicated to making the savestate corruption method work. You'll need to use this version of Dolphin if you want to corrupt the savestates.

The concept of Savestates

A savestate at its core contains the information that the emulator needs to restore itself to a specific "state". Included in this data is a copy of the system memory. That means if we corrupt the memory within the savestate then load the state, we can indirectly corrupt the system memory similar to what you do with the RTC.

A Brief Overview of the Consoles

The Gamecube has:

  • 24MB of system ram (SRAM)

  • 16MB of audio ram (ARAM)

The SRAM is the main system memory. While the ARAM is technically designed to be used for storing data related to audio, through various tricks developers were able to use it as low bandwidth memory.

Not all games utilize the ARAM for storing data. Those that do tend to store geometry data in it as the ARAM is fairly slow.

The Wii has:

  • 24MB of system ram (SRAM)

  • 64MB of external ram (EXRAM)

The SRAM is the main system memory. The EXRAM is additional memory which can be used. The EXRAM is slightly slower than the SRAM. Generally, the most important data will be in the SRAM (code, game vital content, etc).

Corrupting the Savestates

First you'll need to load the Savestate in the Windows Glitch Harvester, once it's loaded, you're going to want to enable caching on the file to speed things up.

The Savestate Info Tool

Recent versions of the Windows Glitch Harvester have a tool called the "Savestate Info" tool. This tool gives you information on the addresses of the SRAM, ARAM, and EXRAM within a Dolphin Savestate. Just load up the savestate, press the button, and you'll be able to see the starting addresses.

  • The "Domain" column shows the name of the memory domain

  • The "Offset" column shows you the starting address. You can calculate the end address by adding the size of the domain to the starting address (domain sizes listed above)

  • The "Alignment" column tells you how the memory domain is aligned in the savestate. The Vector Engine hunts for 32-bit aligned floats. If they aren't 4-byte aligned, this will tell you how many bytes off it is. You'll need to set the "Alignment" box in the Vector Engine Config box to match the alignment for it to work properly. If you're using "Target Dolphin", this'll automatically be set for you.

  • The "Start Netcore Button" starts the Netcore2 server. If the Netcore2 server is already started, the button will restart the server.

Target Dolphin

WGH 0.9.3 bring a new feature with Netcore Implementation called "Target Dolphin". If you swap your target mode to Target Dolphin, you can connect directly with Dolphin Narry's Mod via Netcore and it'll automatically load your corrupted savestate when you blast/inject.

Additional Info

The Gamecube and Wii are both based on the PowerPC architecture, so they're Big Endian. Be sure to check the Big Endian box in the vector engine. If you're using "Target Dolphin", this should be handled for you.

A good starting value for the Intensity is around 50,000-100,000 and you can go from there. Here's an example screenshot of what your config may look like:

Narry/Smellyfeetyouhave
https://github.com/NarryG/dolphin/
https://github.com/NarryG/dolphin/releases
Index
Dolphin Narry's Mod
The Concept of Savestates
A Brief Overview of the Consoles
Corrupting the Savestates
The Savestate Info Tool
Additional Info