General Information TCP Gecko 2.53

Cafe codetypes is a feature from TCP Gecko to simplify the making of cheat codes for the Nintendo Wii U. This documentation breaks down all available cafe codetypes into components, describes what those components do and shows available parameters. Each component is assigned a letter and color for better visualization how each cafe codetype functions.

Letters with washed out colours represent codelines that are required for a cafe codetype to work. All code types except manually written PowerPC assembly code can write to read-only/executable memory regions. Take in mind that memory writes in read-only/executable memory regions are not persistent, meaning that if some other code modifies such addresses, the code handler will not re-write that value. If those code types are in a conditional with false result, its target address is modified or the codelist is re-sent, writes will be allowed to happen again.

NOTICE: All cafe codetypes follow a specific sequence of Hexadecimal values. Failure to follow the structure of any codetypes may crash the console. Also, accessing or writing to invalid addresses can crash the console. When you crash, you may unplug your Wii U, plug it back in, start your Wii U by pressing the power button and run the TCP Gecko Installer again.

Q&As TCP Gecko 2.53

What is a pointer?

A pointer is an object in many programming languages that stores a memory address. A pointer references a location in memory, and obtaining the value stored at that location is known as dereferencing (Load) the pointer.

What is an offset?

An offset within an array or other data structure object is an integer indicating the distance (displacement) between the beginning of the object and a given element or point, presumably within the same object.

What is a "volatile offset"?

A volatile offset is a offset only active within the codetype that requested its use. Following codelines will not be affected.

What is a integer value?

A number which is not a fraction; a whole number.

What is a float value?

A float is a data type composed of a number that is not an integer, because it includes a fraction represented in decimal format.

Data sizes *

A 8-bit Hexadecimal value has 256 possible values. (Hex: 0 to FF) A 16-bit Hexadecimal value has 65'536 possible values. (Hex: 0 to FFFF) A 32-bit Hexadecimal value has 4'294'967'296 possible values. (Hex: 0 to FFFFFFFF)

Signed vs unsigned value *

Signedness is a property of data types representing numbers in computer programs. For example, a two's complement signed 16-bit integer can hold the values −32768 to 32767 inclusively, while an unsigned 16 bit integer can hold the values 0 to 65535.

What does "two's complement" mean?

Two's complement is a mathematical operation on binary numbers. It is used in computing as a method of signed number representation. The two's complement is calculated by inverting the bits and adding one.

* Use a Decimal to Hexadecimal calculator for ease of value convertion.

Sources TCP Gecko 2.53

https://www.techopedia.com/definition/23980/float-computer-science https://en.wikipedia.org/wiki/Offset_(computer_science) https://en.wikipedia.org/wiki/Signedness https://en.wikipedia.org/wiki/Pointer_(computer_programming) https://en.wikipedia.org/wiki/Two%27s_complement

RAM Writes [00]Memory Writes

Writes a 8-bit (VV), 16-bit (VVVV) or 32-bit (VVVVVVVV) value to memory address (LLLLLLLL). * KKKK adds a unsigned volatile offset to the computed pointer.

* Writing value to a pointer must have a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

String Writes [01]Memory Writes

Writes NNNN amount of bytes (VV) to memory address LLLLLLLL. If a pointer is in use, a signed volatile offset (KKKKKKKK) is added to the computed pointer. * If a codeline is filled, a new line can be added.

* Writing value to a pointer must have a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

Skip Writes [02]Memory Writes

Consecutively writes 8-bit (VV), 16-bit (VVVV) or 32-bit (VVVVVVVV) value NNNN amount of times. Memory writes start at address LLLLLLLL or at computed pointer + signed volatile offset KKKKKKKK. * YYYYYYYY determines the offset between each write. Integer value II (8-bit), IIII (16-bit), IIIIIIII (32-bit) constantly adds to VV, VVVV, VVVVVVVV each write.

* Writing value to a pointer must have a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

Memory Fill [20]Memory Writes

Repeatedly writes a 32-bit value (VVVVVVVV) starting at memory address LLLLLLLL or computed pointer + volatile offset KKKKKKKK. * Range between the first and last range is determined by offset MMMMMMMM. This code type executes once after being sent and then stops. If the code type is in a conditional with false result, its target address is modified or the codelist is re-sent, writes will re-send.

* Writing value to a pointer must have a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

Memory Copy [21]Memory Writes

Copies a block of memory starting at memory address EEEEEEEE to memory address LLLLLLLL or computed pointer + volatile offset KKKKKKKK. * Range between the first and last range is determined by offset MMMMMMMM. This code type executes once after being sent and then stops. If the code type is in a conditional with false result, its target address is modified or the codelist is re-sent, writes will re-send.

* Writing value to a pointer must have a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

Corruptor [F0]Memory Writes

Searches for value VVVVVVVV between memory address LLLLLLLL to EEEEEEEE. If the value equals to the current inspected memory address, value WWWWWWWW will be stored to that address. This code type executes once after being sent and then stops. If the code type is in a conditional with false result, its target address is modified or the codelist is re-sent, writes will re-send.

If Equal [03]If/Else

Compares the value at memory address LLLLLLLL or computed pointer + signed volatile offset KKKKKKKK with value VV (8-bit), VVVV (16-bit), VVVVVVVV (32-bit). * If both values are equal, codetypes below will be executed. If the condition is false, codetypes below will be skipped. Codetype D0 determines when to continue code execution.

* Comparing a pointer's value must have a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

If Not Equal [04]If/Else

Compares the value at memory address LLLLLLLL or computed pointer + signed volatile offset KKKKKKKK with value VV (8-bit), VVVV (16-bit), VVVVVVVV (32-bit). * If both values are not equal, codetypes below will be executed. If the condition is false, codetypes below will be skipped. Codetype D0 determines when to continue code execution.

* Comparing a pointer's value must have a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

If Greater [05]If/Else

Compares the value at memory address LLLLLLLL or computed pointer + signed volatile offset KKKKKKKK with value VV (8-bit), VVVV (16-bit), VVVVVVVV (32-bit). * If the value at the computed address is greater than VV, VVVV or VVVVVVVV, codetypes below will be executed. If the condition is false, codetypes below will be skipped. Codetype D0 determines when to continue code execution.

* Comparing a pointer's value must have a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

If Lower [06]If/Else

Compares the value at memory address LLLLLLLL or computed pointer + signed volatile offset KKKKKKKK with value VV (8-bit), VVVV (16-bit), VVVVVVVV (32-bit). * If the value at the computed address is lower than VV, VVVV or VVVVVVVV, codetypes below will be executed. If the condition is false, codetypes below will be skipped. Codetype D0 determines when to continue code execution.

* Comparing a pointer's value must have a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

If Greater Or Equal [07]If/Else

Compares the value at memory address LLLLLLLL or computed pointer + signed volatile offset KKKKKKKK with value VV (8-bit), VVVV (16-bit), VVVVVVVV (32-bit). * If the value at the computed address is greater than or equal to VV, VVVV or VVVVVVVV, codetypes below will be executed. If the condition is false, codetypes below will be skipped. Codetype D0 determines when to continue code execution.

* Comparing a pointer's value must have a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

If Lower Or Equal [08]If/Else

Compares the value at memory address LLLLLLLL or computed pointer + signed volatile offset KKKKKKKK with value VV (8-bit), VVVV (16-bit), VVVVVVVV (32-bit). * If the value at the computed address is lower than or equal to VV, VVVV or VVVVVVVV, codetypes below will be executed. If the condition is false, codetypes below will be skipped. Codetype D0 determines when to continue code execution.

* Comparing a pointer's value must have a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

Conditional Logical AND [09]If/Else

Compares the value at memory address LLLLLLLL or computed pointer + signed volatile offset KKKKKKKK with value VV (8-bit), VVVV (16-bit), VVVVVVVV (32-bit). * If the value at the computed address has the same true bits as VV, VVVV or VVVVVVVV, codetypes below will be executed. If the condition is false, codetypes below will be skipped. Codetype D0 determines when to continue code execution.

* Comparing a pointer's value must have a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

Conditional Logical OR [0A]If/Else

Compares the value at memory address LLLLLLLL or computed pointer + signed volatile offset KKKKKKKK with value VV (8-bit), VVVV (16-bit), VVVVVVVV (32-bit). * If the value at the computed address has at least one true bit as VV, VVVV or VVVVVVVV, codetypes below will be executed. If the condition is false, codetypes below will be skipped. Codetype D0 determines when to continue code execution.

* Comparing a pointer's value must have a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

If Value Between [0B]If/Else

Compares the value at memory address LLLLLLLL or computed pointer + signed volatile offset KKKKKKKK with value VV (8-bit), VVVV (16-bit), VVVVVVVV (32-bit) and value WW (8-bit), WWWW (16-bit), WWWWWWWW (32-bit). * If the computed value is between VV, VVVV or VVVVVVVV and value WW, WWWW or WWWWWWWW, codetypes below will be executed. If the condition is false, codetypes below will be skipped. Codetype D0 determines when to continue code execution.

* Comparing a pointer's value must have a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

Add Time-Dependence [0C]If/Else

If NNNNNNNN amount of frames has passed after the code was injected, codetypes below will be skipped. cafe codetype D2 determines where to continue code execution.

Reset Timer [0D]If/Else

If address LLLLLLLL has a value equal to the specified 16-bit value VVVV, the previous Time-Dependent-Codetype will restart its timer.

Input Conditional [0E]If/Else

If controller input VVVVVVVV is pressed, code types below will execute. 0X determines which controller type to use. 0Y determines which controller port to read from. 0X options: 00: Wii U GamePad 01: WiiMote 02: WiiMote & Nunchuck 03: Classic/Pro Controller 0Y options: 00: Port 1 01: Port 2 02: Port 3 03: Port 4 Note: There's only one Wii U GamePad port in retail Wii Us. GamePad / WiiMote / WiiMote & Nunchuck / Classic Controller / Pro Controller VVVVVVVV options: 00008000 / 00000800 / 00000800 / 00000010 / 00000010: A 00004000 / 00000400 / 00000400 / 00000040 / 00000040: B 00002000 / -------- / -------- / 00000008 / 00000008: X 00001000 / -------- / -------- / 00000020 / 00000020: Y -------- / 00000200 / 00000200 / -------- / --------: 1 -------- / 00000100 / 00000100 / -------- / --------: 2 00000800 / 00000001 / 00000001 / 00000002 / 00000002: D-Pad Left 00000400 / 00000002 / 00000002 / 00008000 / 00008000: D-Pad Right 00000200 / 00000008 / 00000008 / 00000001 / 00000001: D-Pad Up 00000100 / 00000004 / 00000004 / 00004000 / 00004000: D-Pad Down -------- / -------- / 00002000 / -------- / --------: Z -------- / -------- / 00004000 / -------- / --------: C 00000080 / -------- / -------- / 00000080 / 00000080: ZL 00000040 / -------- / -------- / 00000004 / 00000004: ZR 00000020 / -------- / -------- / 00002000 / 00002000: L 00000010 / -------- / -------- / 00000200 / 00000200: R 00000008 / 00000010 / 00000010 / 00000400 / 00000400: Plus (+) 00000004 / 00001000 / 00001000 / 00001000 / 00001000: Minus (-) 00000002 / 00008000 / 00008000 / 00000800 / 00000800: Home 00000001 / -------- / -------- / -------- / --------: Sync 00020000 / -------- / -------- / -------- / 00001000: Right Stick Button 00040000 / -------- / -------- / -------- / 00002000: Left Stick Button 00010000 / -------- / -------- / -------- / --------: TV 04000000 / -------- / -------- / 00100000 / 00400000: Right Stick Emulation Left 02000000 / -------- / -------- / 00200000 / 00800000: Right Stick Emulation Right 01000000 / -------- / -------- / 00800000 / 02000000: Right Stick Emulation Up 00800000 / -------- / -------- / 00400000 / 01000000: Right Stick Emulation Down 40000000 / -------- / -------- / 00010000 / 00040000: Left Stick Emulation Left 20000000 / -------- / -------- / 00020000 / 00080000: Left Stick Emulation Right 10000000 / -------- / -------- / 00080000 / 00200000: Left Stick Emulation Up 08000000 / -------- / -------- / 00040000 / 00100000: Left Stick Emulation Down -------- / -------- / 00000001 / -------- / --------: Nunchuck Stick Emulation Left -------- / -------- / 00000002 / -------- / --------: Nunchuck Stick Emulation Right -------- / -------- / 00000008 / -------- / --------: Nunchuck Stick Emulation Up -------- / -------- / 00000004 / -------- / --------: Nunchuck Stick Emulation Down Note: Add values together if you wish to use button combinations.

Negate Conditional [0F]If/Else

Codetypes below this code line will execute if the previous condition was false. If Equal To > If Not Equal To If Not Equal To > If Equal To If Greater Than > If Lower Than Or Equal To If Lower Than > If Greater Than Or Equal To If Greater Than Or Equal To > If Lower Than If Lower Than Or Equal To > If Greater Than If Value Between > If Lower Than Or Greater Than Conditional AND > Conditional NAND Conditional OR > Conditional NOR Time Dependence > Execute after TTTTTTTT frames has passed.

Loop [80]If/Else

Codelines between codetype [80] and codetype [D1] will repeat until NNNNNNNN amount of loops has been reached.

Loop Indexed [81]If/Else

Codelines between codetype [81] and codetype [D1] will repeat until the value at integer register R has been reached.

Break Loop [82]If/Else

Forces the loop count to be set to max, preventing the loop from resuming.

Load Integer [10]Perform Operations

Loads the value at memory address LLLLLLLL or computed pointer + signed volatile offset KKKKKKKK into integer register R There are 8 available integer registers: 0, 1, 2, 3, 4, 5, 6 and 7.

* Loading a value from a pointer requires a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

Store Integer [11]Perform Operations

Stores the value from integer register R to memory address LLLLLLLL or computed pointer + signed volatile offset KKKKKKKK. There are 8 available integer registers: 0, 1, 2, 3, 4, 5, 6 and 7.

* Storing a value to a pointer requires a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

Load Float [12]Perform Operations

Loads the value at memory address LLLLLLLL or computed pointer + signed volatile offset KKKKKKKK into float register R. There are 8 available float registers: 0, 1, 2, 3, 4, 5, 6 and 7.

* Loading a value from a pointer requires a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

Store Float [13]Perform Operations

Stores the value from float register R to memory address LLLLLLLL or computed pointer + signed volatile offset KKKKKKKK. There are 8 available float registers: 0, 1, 2, 3, 4, 5, 6 and 7.

* Storing a value to a pointer requires a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

Integer Operations [14]Perform Operations

Operates two integer values, O represents the type of operation: 0 = Addition (R = R + S) 1 = Subtraction (R = R - S) 2 = Multiplication (R = R * S) 3 = Division (R = R / S) 4 = Addition (R = R + VVVVVVVV) 5 = Subtraction (R = R - VVVVVVVV) 6 = Multiplication (R = R * VVVVVVVV) 7 = Division (R = R / VVVVVVVV) 8 = Convert integer to float (Integer register S = Converted float register R) 9 = AND (R = R & S) A = OR (R = R | S) B = XOR (R = R ^ S) C = AND (R = R & VVVVVVVV) D = OR (R = R | VVVVVVVV) E = XOR (R = R ^ VVVVVVVV) F = Assign (R = VVVVVVVV)

* Usage of a pointer requires a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

Float Operations [15]Perform Operations

Operates two integer values, O represents the type of operation: 0 = Addition (R = R + S) 1 = Subtraction (R = R - S) 2 = Multiplication (R = R * S) 3 = Division (R = R / S) 4 = Addition (R = R + VVVVVVVV) 5 = Subtraction (R = R - VVVVVVVV) 6 = Multiplication (R = R * VVVVVVVV) 7 = Division (R = R / VVVVVVVV) 8 = Convert float to integer (Integer register R = Converted float register R) F = Assign (R = VVVVVVVV)

* Usage of a pointer requires a loaded pointer beforehand. See cafe codetype "Load Pointer [30]" to learn more.

Load Pointer [30]Memory Access

Load a pointer from memory address LLLLLLLL or computed pointer + offset KKKKKKKK. Loading a pointer-in-pointer is possible by placing the "Pointer-in-pointer" format as many times needed. * RANGE_ST represents the start of reliable memory range the pointed address is located. RANGE_EN represents the end of reliable memory range the pointed address is located. If the pointer or pointer-in-pointer is invalid, codetypes below will be skipped. Code execution will resume right after cafe codetype D0.

* Loading a pointer-in-pointer with an offset is possible by placing cafe codetype "Add Offset To Pointer [31]" right after a previously loaded pointer.

Add Offset To Pointer [31]Memory Access

Adds a non-volatile offset (defined by QQQQQQQQ) to the previously computed pointer.

Add Offset To Pointer Indexed [32]Memory Access

Adds the value from integer register (R) + QQQQQQQQ to the previously computed pointer.

Subtract Offset From Pointer [33]Memory Access

Subtracts a non-volatile offset (defined by QQQQQQQQ) from the previously computed pointer.

Subtract Offset From Pointer Indexed [34]Memory Access

Subtracts the previously computed pointer by the value from integer register (R) + QQQQQQQQ.

Execute ASM [C0]Execute

This executes machine code *, NNNN defines the amount of codelines (excluding the first one). All registers (GPRs, FPRs and SPRs) are available if used properly. Code must branch to the LR at the end of the code. (blr / 0x4E800020). If the link register (LR) is needed, remember to back it up in the stack or somewhere else and recover it later to prevent crashes.

* Refer to this documentation for writing PowerPC Assembly code: https://www.ibm.com/support/knowledgecenter/ssw_aix_72/assembler/assembler_pdf.pdf.

System- And Procedure Calls [C1]Execute

Perform a system call XXXX * or a procedure call LLLLLLLL. If syscall XXXX is 0000, LLLLLLLL will be executed. This code type takes Integer Registers and Float Registers as input and output. From integer/float register 0 to 7 is same as r3 to r10 or f1 to f8.

* Visit WiiUBrew.org to find all available SysCall values.

Insert ASM via LR [C2]Execute

This codetype will replace the hook address LLLLLLLL with an absolute branch and link to the first "XXXXXXXX" instruction. NNNN defines the amount of code lines excluding the first one. NOTE: The coder is responsible of restoring the original instruction that got replaced by the hook and also undoing the patch when the cheat code is disabled. You must end the assembly code with a "blr", meaning you should save/restore the LR as needed. This codetype should work fine as long as your hook address is within a non-leaf function, meaning that the function saves the LR at the beginning. *

* Refer to this documentation for writing PowerPC Assembly code: https://www.ibm.com/support/knowledgecenter/ssw_aix_72/assembler/assembler_pdf.pdf.

Insert ASM via CTR [C3]Execute

This codetype will replace the hook address LLLLLLLL with an absolute branch to the first "XXXXXXXX" instruction. NNNN defines the amount of code lines excluding the first one. NOTE: The coder is responsible of restoring the original instruction that got replaced by the hook and also undoing the patch when the cheat code is disabled. You must end the assembly code with a "bctr"and before this you must load the address LLLLLLLL + 0x4 into the CTR. This codetype is included for compatibility in case the C2 codetype causes a crash for a given address (i.e. the address is within a leaf function). *

* Refer to this documentation for writing PowerPC Assembly code: https://www.ibm.com/support/knowledgecenter/ssw_aix_72/assembler/assembler_pdf.pdf.

ASM String Writes [C4]Execute

This codetype allows writing data to the code region. LLLLLLLL defines the starting memory address for the writes. NNNN defines the amount of code lines excluding the first one. *

* Refer to this documentation for writing PowerPC Assembly code: https://www.ibm.com/support/knowledgecenter/ssw_aix_72/assembler/assembler_pdf.pdf.

Display Message And Pause [E0]Execute

Displays a message on the screen and pauses the current title. RRGGBB sets a background color, text is white by default. String SS is a UTF-8 formatted string to display on the screen. This string is null-terminated. Meaning that the last byte must end with 00. This code type executes once after being sent and then stops. If the code type is in a conditional with false result, this code type can be re-activated. WARNING: Some titles don't support this code type.

Display Pointer Message And Pause [E1]Execute

Displays a message on the screen and pauses the current title. RRGGBB sets a background color, text is white by default. String located at the computed pointer should contain a buffer of UTF-8 formatted characters to display on the screen. This string is null-terminated. Meaning that the last byte must end with 00. This code type executes once after being sent and then stops. If the code type is in a conditional with false result, this code type can be re-activated. WARNING: Some titles don't support this code type.

* Refer to this documentation for writing PowerPC Assembly code: https://www.ibm.com/support/knowledgecenter/ssw_aix_72/assembler/assembler_pdf.pdf.

Clear Message And Resume [E2]Execute

Clears a message displayed by code type E0 and E1 and un-pauses the current title. This code type executes once after being sent and then stops. If the code type is in a conditional with false result, this code type can be re-activated. WARNING: Some titles don't support this code type.

* Refer to this documentation for writing PowerPC Assembly code: https://www.ibm.com/support/knowledgecenter/ssw_aix_72/assembler/assembler_pdf.pdf.

Terminator [D0]Termination

If a condition or pointer is invalid, the codehandler will branch here, skipping any codelines between the conditional or pointer codetype and the terminator.

Loop Terminator [D1]Termination

If the amount of loops from a loop codetype hasn't been reached, this codetype tells the codehandler to branch to the previous uncompleted loop.

Conditional Terminator [D2]Termination

Terminates 1 conditional cafe code type. If a condition is false, the codehandler will skip any codelines between the conditional codetype and the conditional terminator. This codetype keeps track of all conditionals inside other conditionals, this gives the ability to create multiple "layers" of "if" statements.