EvilEngine/PowerUp Event Exploit

From Heavy Iron Modding

The events GivePowerUp (in Battle for Bikini Bottom and onwards) and UpgradePowerUp (in The SpongeBob SquarePants Movie onwards) can be used to increment arbitrary bytes in memory by adjusting the first argument supplied to the event, as first demonstrated by Seil in January 2023.

Normally, the argument supplied to these events is within a small range, and is intended to give the player specific powerups based on the argument. However, it was shown that the argument supplied to these events is used as an index in a byte array, but the index is not restricted, meaning that the Link creator can modify arbitrary bytes within the system's memory, essentially allowing mod creators to utilise Action Replay codes, without requiring the mod player to enter it manually.

For example, in The SpongeBob SquarePants Movie NTSC GameCube version, sending the GivePowerUp event with an argument of 4815 will cause memory address 0x804AF828 to be incremented from 0 to 1, enabling the game's debug fly mode.

Disabling the UpgradePowerUp limit

By default, UpgradePowerUp can upgrade a move from Normal (1) to Macho (2), or increase the number of Health upgrades (increment a byte up to 3). Any memory addresses outside of the normal range are treated as a Health upgrade and can only be incremented up to 3 and no higher. However, using a hack that modifies the instructions in memory that limit the value to 3, we can increment the byte to any desired value.

Disable UpgradePowerUp limit (The SpongeBob SquarePants Movie, GameCube, English)

GivePowerUp -3613300.0000
GivePowerUp -3613291.0000
GivePowerUp -3613263.0000

How to Utilise the Exploit (The SpongeBob SquarePants Movie, NTSC)

In practice, it is not necessary to create all of the links individually to increment bytes in memory. Modder Seil has released a HIP file that can be imported into the default layer of a root hip file (e.g. font.HIP, boot.HIP or plat.HIP), though font.HIP is recommended as it is the first to be loaded. The Dispatcher and Trigger contained within the HIP modifies the behavior of the unused "Set Pad Config to Preset A/B/C/D" events, allowing them to be used to set or add a value in memory.

  1. Download the PowerUp Exploit assets and paste the Dispatcher and Trigger into the Default layer of a root HIP file (e.g. font.HIP)
  2. Find the memory address (in hexadecimal) of the float value or byte(s) you wish to change. One way to accomplish this is to use Dolphin Memory Engine to find the memory addresses if you don't know them already.
  3. Create a link in Industrial Park with the appropriate event and arguments.

List of Modified Events

Set Pad Config to Preset A Sets or adds a 4-byte value in memory.

  • Argument 1 (Hex): Memory address
  • Argument 2 (Hex): Value
  • Argument 3 (Hex): Mode (0=set, 1=add)

Set Pad Config to Preset B Sets or adds a 2-byte value in memory.

  • Argument 1 (Hex): Memory address
  • Argument 2 (Hex): Value
  • Argument 3 (Hex): Mode (0=set, 1=add)

Set Pad Config to Preset C Sets or adds a 1-byte value in memory.

  • Argument 1 (Hex): Memory address
  • Argument 2 (Hex): Value
  • Argument 3 (Hex): Mode (0=set, 1=add)

Set Pad Config to Preset D Sets or adds a floating-point value in memory.

  • Argument 1 (Hex): Memory address
  • Argument 2 (Float): Value
  • Argument 3 (Hex): Mode (0=set, 1=add)

Examples

Description Event Arguments
1 (Memory Address) 2 (Value) 3 (Mode)
Change SpongeBob's maximum movement speed from 5.0 to 7.0 Set Pad Config to Preset D 0x804AE58C 7.000 0x00000000
Change the global gravity value from 30.0 to 5.0 Set Pad Config to Preset D 0x804AE4B8 5.000 0x00000000
Add 10 to the Nitro count Set Pad Config to Preset C 0x80406DBF 0x0000000A 0x00000001
Change the number of Goofy Goober Tokens collected to 68 (the maximum normally possible) Set Pad Config to Preset C 0x804AF83F 0x00000044 0x00000000
Change the Sonic Wave Guitar duration from 6 to 10,000 seconds Set Pad Config to Preset D 0x8048AFD4 10000.000 0x00000000

Base Memory Addresses (GameCube)

Base addresses for the events in each Heavy Iron Game with the exploit.
Battle for Bikini Bottom The SpongeBob SquarePants Movie
GQPE78 GQPP78 GGVE78 GGVD78 GGVP78 GGVX78
0x803C0F15 0x804AE559

TODO: Add addresses for subsequent games (Incredibles, ROTU, Rat Proto) assuming the exploit still works.

Limitations

While the exploit is powerful, it does have some limitations.

  • It is currently untested on platforms other than GameCube, and if it works on PS2/Xbox, the memory addresses, and thus arguments for the UpgradePowerUp event, may be different. This means mods that are intended to be ported to other platforms may not be possible, or may require changes to the links.