Gaming Gateway Cheats

[Localhorst86]

Wish we knew how to find pointers, not sure where to start.

http://gamehacking.org/wiki/Tools#ARDS_Pointer_Tool this will probably help

We're just gonna need two RAM dumps from the same game but with variable addresses. I'll try once the address for Badge Arcade changes again.

 

[Errorjack]

http://gamehacking.org/wiki/Tools#ARDS_Pointer_Tool this will probably help

We're just gonna need two RAM dumps from the same game but with variable addresses. I'll try once the address for Badge Arcade changes again.

Would this work for 3DS though? I've got two dumps with both addresses for it but comparing them gives an 'Stream error'.

You can try yourself, both RAMs dumped with addresses for each one. https://mega.nz/#!KwhkQaRB!6--BYMpcryGQqEISeCtlhlH2FfEp1Sowzruvsk0Jgrs

 

[Localhorst86]

You can try this tool http://raing3.gshi.org/forum/index.php?topic=1314.0

allthough for some reason the memory dumps you provided do not contain the addresses 08EF20CA and 0907F3BA. The memory only goes up to 03AC70BB. I assume this has to do with virtual memory addresses. Not sure how we would go about that...

 

[Errorjack]

You can try this tool http://raing3.gshi.org/forum/index.php?topic=1314.0

allthough for some reason the memory dumps you provided do not contain the addresses 08EF20CA and 0907F3BA. The memory only goes up to 03AC70BB. I assume this has to do with virtual memory addresses. Not sure how we would go about that...

I dumped with Gateway's in-built RAM dumper so I guess that could be the case. I would install NTR CFW but you cannot played ripped games.

EDIT: This program seems to have found stuff, but it spits out ARDS codes and I'm not entirely sure how to convert those to Gateway

 

[Skeet1983]

I dumped with Gateway's in-built RAM dumper so I guess that could be the case. I would install NTR CFW but you cannot played ripped games.

EDIT: This program seems to have found stuff, but it spits out ARDS codes and I'm not entirely sure how to convert those to Gateway

There is a program created by Mega-Mew called AR2GW to convert codes, but it doesn't seem to work with Windows OS yet. I PM'd him about it and he is aware of issue and will fix when he can...

 

[Errorjack]

There is a program created by Mega-Mew called AR2GW to convert codes, but it doesn't seem to work with Windows OS yet. I PM'd him about it and he is aware of issue and will fix when he can...

Yeah I was aware with that program by google but nothing I can do about it. The source code IS there so maybe I can convert the code to PC.

 

[Scarlet]

I made some Fire Emblem If Special Edition codes if anybody wants to test them. They lock the respective character's HP at 40. From what I can tell, the cheats work in respect to each character's position when the game is first loaded. So on the select units screen, Character 1 is on the top-left, 2 top-middle, 3 top-right, 4 second row left etc. So yeah, feel free to try them and mess with them as you see fit.

Spoiler

[Character 1 Always 40 HP]
D3000000 10000000
26931743 00000028

[Character 2 Always 40 HP]
D3000000 10000000
26931883 00000028

[Character 3 Always 40 HP]
D3000000 10000000
269319C3 00000028

[Character 4 Always 40 HP]
D3000000 10000000
26931B03 00000028

[Character 5 Always 40 HP]
D3000000 10000000
26931C43 00000028

[Character 6 Always 40 HP]
D3000000 10000000
26931D83 00000028

[Character 7 Always 40 HP]
D3000000 10000000
26931EC3 00000028

[Character 8 Always 40 HP]
D3000000 10000000
26932003 00000028

 

[dsrules]

There is a program created by Mega-Mew called AR2GW to convert codes, but it doesn't seem to work with Windows OS yet. I PM'd him about it and he is aware of issue and will fix when he can...

that program doesn't really convert, it probably just rewrite the address
ARCode 00345678 12345678
GW
D3000000 14000000
00345678 12345678

 

[Errorjack]

that program doesn't really convert, it probably just rewrite the address
ARCode 00345678 12345678
GW
D3000000 14000000
00345678 12345678

Shit. So we're stuck on pointers then, I guess? I found something odd with Majora's Mask 3D regarding the codes.

If you keep whatever character you are and go into a new map, the code will work. But if you take your mask off, it'll start becoming dynamic. Look at what I recorded below.
1: 0907F4BA //Original code
2: 08EF20CA //Took the mask off and entered new area
3: 087D8BEA //Moved to next map
4: 087D916A //Next map
5: 0915002A //Last recording but massive change.

So we know it's from at least 0x08700000 to 0x09200000

 

[dsrules]

Shit. So we're stuck on pointers then, I guess? I found something odd with Majora's Mask 3D regarding the codes.

If you keep whatever character you are and go into a new map, the code will work. But if you take your mask off, it'll start becoming dynamic. Look at what I recorded below.
1: 0907F4BA //Original code
2: 08EF20CA //Took the mask off and entered new area
3: 087D8BEA //Moved to next map
4: 087D916A //Next map
5: 0915002A //Last recording but massive change.

So we know it's from at least 0x08700000 to 0x09200000

looks like the address always ends with A, if each mask has each own address then that might be easy to solve, but guess not
try email gateway and ask them to write a pointer search tool ?

 

[Errorjack]

looks like the address always ends with A, if each mask has each own address then that might be easy to solve, but guess not
try email gateway and ask them to write a pointer search tool ?

It's not every mask that has it's own address at all, it seems that when you take off your mask, it changes it. Putting the mask back and trying the code again, it doesn't work. Simply changing your form causes it to jump in address.

Gateway doesn't have an email for technical suggestions, just for sales I guess. Maxconsole is the only place for support and I doubt they read it.

 

[dsrules]

It's not every mask that has it's own address at all, it seems that when you take off your mask, it changes it. Putting the mask back and trying the code again, it doesn't work. Simply changing your form causes it to jump in address.

Gateway doesn't have an email for technical suggestions, just for sales I guess. Maxconsole is the only place for support and I doubt they read it.

you could still email them @ sales if you have any suggestions for improvements

 

[Dybbles]

Is there a user here named Dybbles? I would like to talk to him about how he managed to find the address.

Surprise!

Anyway. I easily found the Moon Jump code by using the one made for the Nintendo 64 version. I opened up a memory editor and typed in the address for the N64 version. Then I looked at what the values were for standing still.
"C080" since Gateway can't search for HEX. I went here: http://www.binaryhexconverter.com/hex-to-decimal-converter
and had it converted. I popped in "C080" and it converted that to, "49280" then did a search for 49280. Then I did a back flip and recored the values, I got "C00C" and once again went to the website above and popped in the hex.
It converted it to "49164" then I searched for that and it found it.

Then I looked at what the N64 version of OOT used for the values to Moon Jump. "40CB" since Gateway flips the bytes it turns it to "CB40."

I will take a look at the USA version of Majora's Mask for the Moon Jump. It seems baffling that Majora's Mask would use Dynamic addresses for Link's jumping....

 

[Errorjack]

Surprise!

Anyway. I easily found the Moon Jump code by using the one made for the Nintendo 64 version. I opened up a memory editor and typed in the address for the N64 version. Then I looked at what the values were for standing still.
"C080" since Gateway can't search for HEX. I went here: http://www.binaryhexconverter.com/hex-to-decimal-converter
and had it converted. I popped in "C080" and it converted that to, "49280" then did a search for 49280. Then I did a back flip and recored the values, I got "C00C" and once again went to the website above and popped in the hex.
It converted it to "49164" then I searched for that and it found it.

Then I looked at what the N64 version of OOT used for the values to Moon Jump. "40CB" since Gateway flips the bytes it turns it to "CB40."

I will take a look at the USA version of Majora's Mask for the Moon Jump. It seems baffling that Majora's Mask would use Dynamic addresses for Link's jumping....

Yeah we figure that out out, thanks for sharing. You can actually search by HEX be pressing L when it requests for a value to search. Thanks to your code, we were able to figure it out as well. We need to figure out how to do pointers in general now, hopefully the Gateway team can help us out.

you could still email them @ sales if you have any suggestions for improvements

Yeah I emailed them anyway, thanks!

 

[Dybbles]

I see. No problem, I can't believe Majora's Mask is using using Dynamic addresses for this. Ugghhhh.
We need the Gateway team to allow us to use breakpoints too.

 

[Scarlet]

I see. No problem, I can't believe Majora's Mask is using using Dynamic addresses for this. Ugghhhh.
We need the Gateway team to allow us to use breakpoints too.

Your code works for EUR games too by the way, thanks a bunch! Gonna have a blast messing around with this <3

 

[Errorjack]

I see. No problem, I can't believe Majora's Mask is using using Dynamic addresses for this. Ugghhhh.
We need the Gateway team to allow us to use breakpoints too.

Shit didn't even think about breakpoints. That would be amazing as well.

 

[Localhorst86]

I see. No problem, I can't believe Majora's Mask is using using Dynamic addresses for this. Ugghhhh.
We need the Gateway team to allow us to use breakpoints too.

be sure to email them about this, we don't know if they are really watching this.

 

[Errorjack]

@cearp and @Dybbles we should probably try searching for other codes while we wait for a break on pointers. Do we know where to start with other codes, such as using items anywhere?

 

[dsrules]

I made some Fire Emblem If Special Edition codes if anybody wants to test them. They lock the respective character's HP at 40. From what I can tell, the cheats work in respect to each character's position when the game is first loaded. So on the select units screen, Character 1 is on the top-left, 2 top-middle, 3 top-right, 4 second row left etc. So yeah, feel free to try them and mess with them as you see fit.

Spoiler

[Character 1 Always 40 HP]
D3000000 10000000
26931743 00000028

[Character 2 Always 40 HP]
D3000000 10000000
26931883 00000028

[Character 3 Always 40 HP]
D3000000 10000000
269319C3 00000028

[Character 4 Always 40 HP]
D3000000 10000000
26931B03 00000028

[Character 5 Always 40 HP]
D3000000 10000000
26931C43 00000028

[Character 6 Always 40 HP]
D3000000 10000000
26931D83 00000028

[Character 7 Always 40 HP]
D3000000 10000000
26931EC3 00000028

[Character 8 Always 40 HP]
D3000000 10000000
26932003 00000028

Fire Emblem IF, Awakening address changes depending on how many characters you have or how far you are in the game, I guess