EvilEngine/PowerUp Event Exploit
The events GivePowerUp (in Battle for Bikini Bottom and onwards) and UpgradePowerUp (in The SpongeBob SquarePants Movie onwards) can be used to increment arbitrary bytes in memory by adjusting the first argument supplied to the event, as first demonstrated by Seil in January 2023.
Normally, the argument supplied to these events is within a small range, and is intended to give the player specific powerups based on the argument. However, it was shown that the argument supplied to these events is used as an index in a byte array, but the index is not restricted, meaning that the Link creator can modify arbitrary bytes within the system's memory, essentially allowing mod creators to utilise Action Replay codes, without requiring the mod player to enter it manually.
For example, in The SpongeBob SquarePants Movie NTSC GameCube version, sending the GivePowerUp event with an argument of 4815 will cause memory address 0x804AF828 to be incremented from 0 to 1, enabling the game's debug fly mode.
Disabling the UpgradePowerUp limit
By default, UpgradePowerUp can upgrade a move from Normal (1) to Macho (2), or increase the number of Health upgrades (increment a byte up to 3). Any memory addresses outside of the normal range are treated as a Health upgrade and can only be incremented up to 3 and no higher. However, using a hack that modifies the instructions in memory that limit the value to 3, we can increment the byte to any desired value.
Disable UpgradePowerUp limit (The SpongeBob SquarePants Movie, GameCube, English)
GivePowerUp -3613300.0000 GivePowerUp -3613291.0000 GivePowerUp -3613263.0000
How to Utilise the Exploit (The SpongeBob SquarePants Movie, NTSC)
In practice, it is not necessary to create all of the links individually to increment bytes in memory. Modder Seil has released a HIP file that can be imported into the default layer of a root hip file (e.g. font.HIP, boot.HIP or plat.HIP), though font.HIP is recommended as it is the first to be loaded. The Dispatcher and Trigger contained within the HIP modifies the behavior of the unused "Set Pad Config to Preset A/B/C/D" events, allowing them to be used to set or add a value in memory.
- Download the PowerUp Exploit assets and paste the Dispatcher and Trigger into the Default layer of a root HIP file (e.g. font.HIP)
- Find the memory address (in hexadecimal) of the float value or byte(s) you wish to change. One way to accomplish this is to use Dolphin Memory Engine to find the memory addresses if you don't know them already.
- There also exists a list of useful memory addresses created by Pepperpot: https://github.com/ItsPepperpot/TSSM-Dolphin-Toolkit. Ensure the address is correct or it can produce Invalid Read/Write Errors in Dolphin.
- Create a link in Industrial Park with the appropriate event and arguments.
List of Modified Events
Set Pad Config to Preset A Sets or adds a 4-byte value in memory.
- Argument 1 (Hex): Memory address
- Argument 2 (Hex): Value
- Argument 3 (Hex): Mode (0=set, 1=add)
Set Pad Config to Preset B Sets or adds a 2-byte value in memory.
- Argument 1 (Hex): Memory address
- Argument 2 (Hex): Value
- Argument 3 (Hex): Mode (0=set, 1=add)
Set Pad Config to Preset C Sets or adds a 1-byte value in memory.
- Argument 1 (Hex): Memory address
- Argument 2 (Hex): Value
- Argument 3 (Hex): Mode (0=set, 1=add)
Set Pad Config to Preset D Sets or adds a floating-point value in memory.
- Argument 1 (Hex): Memory address
- Argument 2 (Float): Value
- Argument 3 (Hex): Mode (0=set, 1=add)
Examples
| Description | Event | Arguments | ||
|---|---|---|---|---|
| 1 (Memory Address) | 2 (Value) | 3 (Mode) | ||
| Change SpongeBob's maximum movement speed from 5.0 to 7.0 | Set Pad Config to Preset D | 0x804AE58C
|
7.000
|
0x00000000
|
| Change the global gravity value from 30.0 to 5.0 | Set Pad Config to Preset D | 0x804AE4B8
|
5.000
|
0x00000000
|
| Add 10 to the Nitro count | Set Pad Config to Preset C | 0x80406DBF
|
0x0000000A
|
0x00000001
|
| Change the number of Goofy Goober Tokens collected to 68 (the maximum normally possible) | Set Pad Config to Preset C | 0x804AF83F
|
0x00000044
|
0x00000000
|
| Change the Sonic Wave Guitar duration from 6 to 10,000 seconds | Set Pad Config to Preset D | 0x8048AFD4
|
10000.000
|
0x00000000
|
Base Memory Addresses (GameCube)
| Battle for Bikini Bottom | The SpongeBob SquarePants Movie | ||||
|---|---|---|---|---|---|
| GQPE78 | GQPP78 | GGVE78 | GGVD78 | GGVP78 | GGVX78 |
0x803C0F15
|
|
0x804AE559
|
|
|
|
TODO: Add addresses for subsequent games (Incredibles, ROTU, Rat Proto) assuming the exploit still works.
Limitations
While the exploit is powerful, it does have some limitations.
- It is currently untested on platforms other than GameCube, and if it works on PS2/Xbox, the memory addresses, and thus arguments for the UpgradePowerUp event, may be different. This means mods that are intended to be ported to other platforms may not be possible, or may require changes to the links.