How does GameShark / Action Replay work on modern consoles?

Question

It's quite difficult to find information about this on the internet, since the magical words "GameShark", "Action Replay", "memory editor" and "memory trainer" trigger lots of BS, so I thought I should ask in some forum.

I'll get a Nintendo Wii to toy around by the end of this week and I'm interested in knowing methods for modifying game code in memory while it runs. If Action Replay works on a Wii without need for a modchip, I'm sure I can do that with a chipped Wii (I'll modchip my Wii once I get my hands on it).

Does anybody here know what could I do to "hijack" a game like GameShark and Action Replay do? I wanted to be able to set breakpoints on specific parts of the game to do additional logic (e.g. rendering additional stuff) and resume the game.

If somebody can give me an answer abstract enough to cover many consoles so I can dig more on the subject to find more specific answers by myself, I'd be grateful, but answers specific to the Nintendo Wii are much welcome, too.

Edit:

As nobody answered my question, I'll try being a little more specific.

I think hotpatching the addresses of code I want to hijack to make them raise an interrupt request might be the way to go, though I'm not sure (if you know for sure whether I'm right or wrong, please share your knowledge with us!).

Now, the actual problem is how to do this "hotpatching" procedure after the game booted. I have no idea what could I do to queue this procedure to after the game take control over the console. Once the first hotpatch is made, it's easy to progress further into the game code, but the problem is getting the first to occur. I would really like enlightenment on this matter.

Thanks.

Caucasus

You might have better luck on the Game Development SE site. I can migrate this over there for you if you'd like. – Fritzsche

Interesting question. Wish I knew :) I'm curious how the developers of the device actually found out what to change these values to for so many specific games, especially back in the day... massive amounts of trial and error? – Venireman

@Awesomania, usually By dumping the ram, changing numbers in game, dumping ram again, and so on. For instance, if you compare memory dumps taken while using ammo or items, you can find the location in memory where the ammo quantity is held and then change it to grant infinite ammo. – Upandcoming

Answer 1

Using gameshark stuff to render extra stuff is probably a bit tough, but Changing life numbers as mentioned seems much more reasonable. My advice might be to start looking at DS games on R4, the R4 chip has built in patches to games for you to select, and because you deal with the image before it runs, you can modify parts there. Be sure to ready your Hex Editor and Assembler :)

Cordy