ROM Hack [Release] Pokemon X/Y/OR/AS multi cheat plugin

GothicIII

Well-Known Member
Member
Joined
Jan 4, 2015
Messages
831
Trophies
0
Age
36
XP
2,236
Country
Gambia, The
Is it possible to implement a walk-through-walls cheat? It would enhance the gameplay a bit :)

I tried to make it myself but failed.
1. The map-coordinates inside the save are validated pretty good and I can't hack them to a position which is not allowed; the game refuses to load the save afterwards.
2. I tried it with pointers to manipulate the movement but it also didn't work. There are too many pointer² and I can't find a static value to begin with. There are also mechanisms which seem to check the movements and I'm not that good in debugging.-.

EDIT: Somebody did this already:
Seems to be a RomFS.bin edit.
 
Last edited by GothicIII,

Reaper 303

Member
Newcomer
Joined
Aug 24, 2016
Messages
11
Trophies
0
Age
39
XP
55
Country
United States
So i tried this cheat and when i open the cheat menu i dont see any cheats? Am i doing something wrong? NTR works fine on other games but i dont see any cheats for the game. I put the plg file in the correct folder but nothing. Am i supposed to rename it cheat.plg? The game does ask for an update though but it also ask for a system update as well but if i update the firmware wouldnt that make all my cfw not work anymore?
 

vb_encryption_vb

That hardmod guy....
Member
Joined
Nov 21, 2015
Messages
1,995
Trophies
2
Age
41
Location
Acworth, GA
XP
1,950
Country
United States
So i tried this cheat and when i open the cheat menu i dont see any cheats? Am i doing something wrong? NTR works fine on other games but i dont see any cheats for the game. I put the plg file in the correct folder but nothing. Am i supposed to rename it cheat.plg? The game does ask for an update though but it also ask for a system update as well but if i update the firmware wouldnt that make all my cfw not work anymore?


If you have emunand, emunand can be updated. If you have arm9loaderhax you can update sysnand...
 

Kaphotics

badc0ded
Member
Joined
Sep 10, 2010
Messages
612
Trophies
0
XP
626
Country
United States
Is it possible to implement a walk-through-walls cheat? It would enhance the gameplay a bit :)

I tried to make it myself but failed.
1. The map-coordinates inside the save are validated pretty good and I can't hack them to a position which is not allowed; the game refuses to load the save afterwards.
2. I tried it with pointers to manipulate the movement but it also didn't work. There are too many pointer² and I can't find a static value to begin with. There are also mechanisms which seem to check the movements and I'm not that good in debugging.-.

EDIT: Somebody did this already:
Seems to be a RomFS.bin edit.

@SciresM was the original video recorder, it's a "GR" hack where all of the movement permissions for every sub-map were edited to be a standard walking tile.

a/0/3/9 - GR Containers for 40x40 Maps
...0 - movement permissions (u16 width, u16 height, u32[] perm)
https://github.com/kwsch/pk3DS/blob/master/pk3DS/Structs.cs#L1028-L1086

Find the permission data in RAM for the area you're at, then overwrite each coordinate with 0x01000021.
 
Last edited by Kaphotics,

GothicIII

Well-Known Member
Member
Joined
Jan 4, 2015
Messages
831
Trophies
0
Age
36
XP
2,236
Country
Gambia, The
@SciresM was the original video recorder, it's a "GR" hack where all of the movement permissions for every sub-map were edited to be a standard walking tile.

a/0/3/9 - GR Containers for 40x40 Maps
...0 - movement permissions (u16 width, u16 height, u32[] perm)
https://github.com/kwsch/pk3DS/blob/master/pk3DS/Structs.cs#L1028-L1086

Find the permission data in RAM for the area you're at, then overwrite each coordinate with 0x01000021.

Thank you very much for this explanation. This is really valueble :)


What does the shortcut GR stand for?

Ok the 9 file seems to be a garc package. I extracted it and I think that the movement permission is stored from offset 0x80 to 0x1980 in little endian. So this must be the 40x40 maps you're talking about.
Unfortunately i dont Unterstand Some of the Source Code but I think this represents the same idea.

I'll check some ram dumps. If I find a pointer on a static address which points to the permission arrays I'll write a cheat code. But really I highly doubt it that I can write so many bytes without crashing the system...

2nd try would be editing the garc archive and modify the values. I need to find a tool which can repack it and Need some more Information how to repack whole cias and Use them without installing (converting maybe to 3ds) but I think that's the right direction :)

EDIT:
@Kaphotics :

Ok, so POC works with gateshark:) Thank you for giving the hint with a/0/3/9.

The downside is, that it only works for the current map loaded. So I can walk through walls for 40x40 tiles but can't move further. Even the normally walk able road blocks...
This is ok, I need just to understand the archive better, but a bigger problem is that I can't find out a static pointer address.

e.g. 44 55 00 70 80 00 10 00 F0 34 8F 14 F0 36 AF 14
is some offsets above the "GR" model header and points to two possible locations where the next "GR" model is loaded. This is good because I can jump to those locations and hack the model but I can't find the 1st entry. There is no static address and the location is shuffled. This is really a problem and drives me nuts. Its the same problem where I had to give up with mh3u while mh4u had static pointer :/

Maybe I give up and just hack it the conventional way...

EDIT2:
So each region has a fixed address it appears. So I would have to patch each for it...
This is the base code and it works in the 1st village:

Code:
[Pokemon AS Littleroot Town Walk-Through-Walls]
DD000000 00000100
D3000000 149F3704
C0000000 00000640
50000000 01000021
00000000 00000020
D0000000 00000000
DC000000 00000004
D2000000 00000000

line2 is the fixed address where I can't find a pointer to. Each region has a fixed address.
I can't tell now which address works with which route... But this example works for the 1st village up until the 2nd and beyond by lining up the known base address.

[Pokemon Walk through Walls test (Press R)]
DD000000 00000100
D3000000 147F3504
C0000000 00000640
50000000 01000021
00000000 00000020
D0000000 00000000
DC000000 00000004
D1000000 00000000
D3000000 148F3604
C0000000 00000640
50000000 01000021
00000000 00000020
D0000000 00000000
DC000000 00000004
D1000000 00000000
D3000000 149C1104
C0000000 00000640
50000000 01000021
00000000 00000020
D0000000 00000000
DC000000 00000004
D1000000 00000000
D3000000 149F3704
C0000000 00000640
50000000 01000021
00000000 00000020
D0000000 00000000
DC000000 00000004
D1000000 00000000
D3000000 14AC1204
C0000000 00000640
50000000 01000021
00000000 00000020
D0000000 00000000
DC000000 00000004
D1000000 00000000
D3000000 14AF3804
C0000000 00000640
50000000 01000021
00000000 00000020
D0000000 00000000
DC000000 00000004
D2000000 00000000

EDIT3: Wrote custom script to patch the GR model data (was nearly a 1 liner). Now waiting to repack :)
 
Last edited by GothicIII,

Kaphotics

badc0ded
Member
Joined
Sep 10, 2010
Messages
612
Trophies
0
XP
626
Country
United States
Thank you very much for this explanation. This is really valuable :)

What does the shortcut GR stand for?

GR is possibly "Game Region", basically a 64x64 chunk of map. The game stitches these together via the MM (map matrix) file, which says when you load a map it'll load certain chunks in a grid.

Assembled map for Sootopolis City:

ICfYl9e.png


Assembled map for Littleroot:

2fgxJCm.png
 
Last edited by Kaphotics,

GothicIII

Well-Known Member
Member
Joined
Jan 4, 2015
Messages
831
Trophies
0
Age
36
XP
2,236
Country
Gambia, The
GR is possibly "Game Region", basically a 64x64 chunk of map. The game stitches these together via the MM (map matrix) file, which says when you load a map it'll load certain chunks in a grid.

*snip*

Alright. I repacked the CIA and it works too. The downside is I can't deactivate the effect which makes map changing impossible because the "warp points" are disabled... Although I disabled the model-collision but the map-boundaries are still active also in Z-direction (I can't walk through some mountain steps). It looks exactly as you posted with your pictures.

Whatever I managed to do what I wanted for a long time :) thats good enough for me.

I'm very impressed that this game is so far reverse engineered. Texture/Model mods are already possible and maybe soon world map editing too. This has potential :)
 

Kaphotics

badc0ded
Member
Joined
Sep 10, 2010
Messages
612
Trophies
0
XP
626
Country
United States
Alright. I repacked the CIA and it works too. The downside is I can't deactivate the effect which makes map changing impossible because the "warp points" are disabled... Although I disabled the model-collision but the map-boundaries are still active also in Z-direction (I can't walk through some mountain steps). It looks exactly as you posted with your pictures.

Whatever I managed to do what I wanted for a long time :) thats good enough for me.

I'm very impressed that this game is so far reverse engineered. Texture/Model mods are already possible and maybe soon world map editing too. This has potential :)

Unfortunately, ROM editing the overworlds hasn't succeeded as there's probably some verification done (with checksums or whatever); that roadblock has prevented any further PoC's.

As for the certain collisions, the 'collision' file format hasn't been RE'd (we believe they are those 'coll' files). Probably is just an invisible-wall sort of object.
 

shinwg

Well-Known Member
Member
Joined
Jul 1, 2016
Messages
538
Trophies
0
Age
42
XP
735
Country
United States
how to get this cheat working I launch ntr than the game green screen but in game when press select nothing happen
 

shinwg

Well-Known Member
Member
Joined
Jul 1, 2016
Messages
538
Trophies
0
Age
42
XP
735
Country
United States
I am playing pokemon Y usa when load NTR menu in game I cant find the cheat and yes I put everything like this SD/plugin/0004000000055E00/cheat.plg
 

Xifex

Active Member
Newcomer
Joined
Aug 30, 2016
Messages
35
Trophies
0
Age
29
XP
74
Country
France
Hello,frist thanks, but one question , why when the pokemon eclore of the egg why he is not shiny?
I active all shiny..
Thanks :)

I play Rosa ( Saphri alpha)
 
Last edited by Xifex,

Stoned

Well-Known Member
Member
Joined
Mar 26, 2014
Messages
2,764
Trophies
2
Age
45
XP
4,405
Country
Germany
Hello,frist thanks, but one question , why when the pokemon eclore of the egg why he is not shiny?
I active all shiny..
Thanks :)

I play Rosa ( Saphri alpha)

You have to receive the Egg. Than Use Fly, andere than breed it. :)
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
  • BigOnYa @ BigOnYa:
    I kept thinking jaws was gonna come up and attack
  • K3Nv2 @ K3Nv2:
    Jaws is on a diet
  • K3Nv2 @ K3Nv2:
    Damn power went out
  • BigOnYa @ BigOnYa:
    Ok xdqwerty, your little bro prob tripped On the cord and unplugged you
  • K3Nv2 @ K3Nv2:
    Ya I'm afraid of the dark hug me
  • BigOnYa @ BigOnYa:
    Grab and hold close your AncientBoi doll.
  • K3Nv2 @ K3Nv2:
    Damn didn't charge my external battery either
  • BigOnYa @ BigOnYa:
    Take the batteries out of your SuperStabber3000... Or is it gas powered?
  • K3Nv2 @ K3Nv2:
    I stole batteries from your black mamba
    +1
  • K3Nv2 @ K3Nv2:
    My frozen food better hold up for an hour I know that
  • BigOnYa @ BigOnYa:
    Or else gonna be a big lunch and dinner tomorrow.
  • BigOnYa @ BigOnYa:
    Did you pay your power bill? Or give all yo money to my wife, again.
  • K3Nv2 @ K3Nv2:
    Oh good the estimated time is the same exact time they just said
    +1
  • BigOnYa @ BigOnYa:
    Load up your pc and monitor, and head to a McDonalds dining room, they have free WiFi
  • K3Nv2 @ K3Nv2:
    Sir please watch your porn in the bathroom
    +2
  • BigOnYa @ BigOnYa:
    No sir we can not sell you anymore apple pies, after what you did with the last one.
  • K3Nv2 @ K3Nv2:
    We ran out
  • HiradeGirl @ HiradeGirl:
    for your life
    +1
  • K3Nv2 @ K3Nv2:
    My life has no value my fat ass is staying right here
  • K3Nv2 @ K3Nv2:
    Nearly 4 hours without power :(
  • Veho @ Veho:
    SO POWERLESS
  • K3Nv2 @ K3Nv2:
    Tell Kanye I need power
    K3Nv2 @ K3Nv2: Tell Kanye I need power