ROM Hack Is it possible to remove demos's play counter?

[zekro94]

As the tittle says, I'm curious to see if you can actually remove the limiter since demos are downloaded onto the SD card.(I know that maybe not since the limiter might be an internal feature of the 3ds, thus require nand modifications, hope someone proves wrong) I mean looking at the special demos for smash bros and ORAS they don't have the limiter.I know it's kinda useless to have demos but the thing is, it's not the demos, it's the ability to play them without limit like in psvita and other consoles, it's more about the dick move that nintendo did

 

[FAST6191]

Was it really a dick move? Demos, as opposed to just trailers, have been show to reduce sales and they probably do want to counteract that.

As for the matter at hand... actually I am not sure if the old format everything trick still works. For the proper stuff then yeah you will want a 4.5 3ds, though I am not sure what people have done there at this point as far as having unlimited demos (not so useful when there are full games you can just as easily be playing and most limited demos are not separate stories or something).

 

[Arras]

for most games, 30 demo tries should really be all you need, but whatever. There is no way other than maybe a proper hacked 3DS (in which case you could also just download the full game to try) or a full reformat (not sure about this one).

 

[zekro94]

Full reformat doesn't reset the counter, it's not about having free games, it's more about a restriction yhat shouldn't have been there

 

[FAST6191]

Why shouldn't the restriction have been there?

 

[Jiehfeng]

Tbh, I get bored from playing a demo for more than 5 times. I don't see how you will enjoy playing the same 10 minutes or so gameplay for an unlimited number of times.

 

[Duo8]

Only way to to this is hacking the ROM. There's a flag in exheader for this.

 

[Bug_Checker_]

Spoiler

Content Categories:
This u16 is a collection bit mask flag. Each Category is a group of one or more bit masks.
Specific Bitmask Flags:
Category
Bitmask
Normal 0x0
DlpChild 0x1
Demo 0x2
Contents 0x3
AddOnContents 0x4
Patch 0x6
CannotExecution 0x8
System 0x10
RequireBatchUpdate 0x20
NotRequireUserApproval 0x40
NotRequireRightForMount 0x80
CanSkipConvertJumpId 0x100
TWL 0x8000

Source:
http://3dbrew.org/wiki/Title_list

Spoiler

Auto-Boot Function

When the Home Menu is initially loaded by NS, it checks the gamecard ExeFS:/icon for the auto-boot flag. If the auto-boot flag is set, it will load the application on the cartridge and the home menu will not remain running in the background, or at least not in an operational state. Using software cues to return to the home menu, or sleep menu while in this state, causes a shutdown.
Notable features of demo titles:

• Auto-boot demos generally disable the functionality of the home button.
• The New Super Mario Bros 2 demo, retained the functionality of the home button, and had an timer which triggered the demo to quit after a period of inactivity.

Auto-boot cartridges, can bypass some of the functions of the Home Menu. Auto Booted software:

• Doesn't show usage history in the Activity Log
• Bypasses Parental controls
• Bypasses Forced Game Card Updates
• Bypasses Initial 3DS Setup
• The console does not have a friends list presence.
• Is still subject to region lock(see below).

Region lock is still active, so the home menu will refuse to launch demos with incorrect region lock will not load, displaying "An Error has Occurred". However, game card update partition checks are not done, which allows launching demos that have region free encoding, but have an alternate(or even invalid) region update partition.

Source:
http://3dbrew.org/wiki/Home_Menu

Spoiler

EShop Demos
Overview

These titles have limited uses. For a given unique ID, there can be a maximum of 254 separate demos. Each demo is indexed by the Title ID variation. The legal demo index range: 0x1 - 0xFF.
The maximum play count is stored in the ticket. The current play count for demos is stored in the AM-module System_SaveData.

Source:
http://3dbrew.org/wiki/EShop_Demos

Spoiler

Ticket Data

Offset Size Description
0x0 0x40 Issuer
0x40 0x3C ECC PublicKey
0x7C 0x1 Version (For 3DS this is always 1)
0x7D 0x1 CaCrlVersion
0x7E 0x1 SignerCrlVersion
0x7F 0x10 Encrypted TitleKey
0x8F 0x1 Reserved
0x90 0x8 TicketID
0x98 0x4 ConsoleID
0x9C 0x8 TitleID
0xA4 0x2 Reserved
0xA6 0x2 Ticket title version
0xA8 0x8 Reserved
0xB0 0x1 License Type
0xB1 0x1 Ticket common keyY index, usually 0x1 for retail system titles.
0xB2 0x2A Reserved
0xDC 0x4 eShop Account ID?
0xE0 0x1 Reserved
0xE1 0x1 Audit
0xE2 0x42 Reserved
0x124 0x40 Limits
0x164 0xAC Content Index

• For v0 of the format, see here

• The Ticket Title Version is generally the same as the title version stored in the Title Metadata. Although it doesn't have to match the TMD version to be valid.

• The titlekey is decrypted by using the AES engine with the ticket common-key keyslot where the keyY is one of 6 keyYs loaded via the keyY index stored in the ticket. AES-CBC mode is used where the IV is the big-endian titleID. Note that on a retail unit index0 is a retail keyY, while on a dev-unit index0 is the dev common-key which is a normal-key.(On retail for these keyYs, the hardware key-scrambler is used)

• In demos, the first u32 in the "Limits" section is 0x4, then the second u32 is the max-playcount.

Source:
http://3dbrew.org/wiki/Ticket

 

[cearp]

the number of times you have played a demo is stored in a system save file.
yes, you can edit the ticket of the demo, and you can change the play count (i changed something to 1 aha, or make it unlimited)
BUT - that is not the question.
yes, it would be possible to remove the playcount history, it is stored in nand.
i personally cannot delete files in nand, but i could overwrite it, i was going to test with it in a few days, i have been busy recently with region changing though

i tried added limits to normal apps/game (non demos), but nothing happened.
when i release the update to FunkyCIA, it will remove the limits from Demos (and the set the purchased pieces for each DLC you have to 'all')


--But if I make it, you will need to be on 4.X to run the file. (until we can get code running on 9.x with gateway's new exploit, it might be a while though)

 

[flarn2006]

If you have a hacked 3DS, you might as well just download the full game to try. You can still buy the game if you like it to support the developers.

 

[cearp]

If you have a hacked 3DS, you might as well just download the full game to try. You can still buy the game if you like it to support the developers.

sure, but not every game has been dumped