Hacking Pokémon X/Y Dumper and Editor

[kyogre123]

Still doesn't change that he has what everyone here is looking for.

There's no point of discussion in this subject, now back on topic, please.

Spoiler

This is why I hate fanbases

 

[Roxas75]

There's no point of discussion in this subject, now back on topic, please.

Spoiler

This is why I hate fanbases

Me too man...
What about that idea of re-sending back the original packet without alter it? Cloning pokemins is at least something.

 

[kyogre123]

Me too man...
What about that idea of re-sending back the original packet without alter it? Cloning pokemins is at least something.

List of things I've tried and haven't panned out:

• Injecting a modified pokemon from the expected pokemon so PID matches.
• Using a pokemon dumped from another trainer so PID matches.
• Changing 2 bits in the pkx so the checksum also matches.

So... what remains?

• In the zero data EAD0 packets, when the header matches, the 16 byte hash is reproduced.

This is a good sign and easily verifiable, indicating the it likely is indeed some type of hash...

BUT unless someone with kernel/ram access can trade what type it is (HMAC-MD5/Truncated SHA1?), we'd be looking at forever in computing hours to try and brute force it.

I'm not sure if the bold part means that he used an original received packet without any alteration.

 

[Roxas75]

I think he intends to have replaced a pkx with another trainer one to make the PID match.
If i find a way to inject packets on windows i can at least try something. I cannot find any useful tool so i trued tomcode in c++ an UDP protocol injector, and the packets are exatly 989 bytes, i can see them from wireshark. But the game ignores them, lol. I'm too new in this things. maybe the problem is that i'm arp sproofing the connection to get the 3ds packets.

 

[Ra1d]

How do you use the dumper,so what do I do,connect my 3ds to my router,run as admin dumper and wonder trade ?

 

[WulfyStylez]

How do you use the dumper,so what do I do,connect my 3ds to my router,run as admin dumper and wonder trade ?

You need your 3DS traffic running through your computer one way or another. If you have a laptop, you can use hostednetwork or Connectify. If you're on a desktop, some USB wifi dongles can be used to the same end, I think.

 

[FAST6191]

How do you use the dumper,so what do I do,connect my 3ds to my router,run as admin dumper and wonder trade ?

There is a video a few pages back.

You can get things done if you connect your 3ds to the router but it can be a pain if you are not familiar with networks at a low level (and I guess you are not) so I would avoid it unless you really need to do that way. Most people that just want it easy will set up a hotspot (various tools http://www.mypublicwifi.com/publicwifi/en/index.html looks like a reasonable start) on the PC by using a spare wireless card (or their existing wireless and then using a wire to connect to the router) and connecting their 3ds to that new wireless hotspot.
Once that is up if you do the trades then you can view the data coming in (it should be 989 in size but various things can happen to make it bigger). Depending upon the viewing tool you are using then you either have to slice the data out of the packet or just feed the relevant packet to the tool for some of the newer ones by the looks of things.

 

[Ra1d]

You need your 3DS traffic running through your computer one way or another. If you have a laptop, you can use hostednetwork or Connectify. If you're on a desktop, some USB wifi dongles can be used to the same end, I think.

I tried with router,it didn't work,I'll try usb tethering.

I tried the full method with wireshark and stuff,but it didn't detect my wireless adapter for some reason(in Wireshark).

 

[kyogre123]

I tried with router,it didn't work,I'll try usb tethering.

I tried the full method with wireshark and stuff,but it didn't detect my wireless adapter for some reason(in Wireshark).

I don't know why Wireshark wouldn't detect your virtual hostpot.

About the dumper, you need to connect your 3DS to a router, that same router to your PC (via ethernet) and your PC to a modem with internet connection. If you are willing to use an smartphone, it could replace the modem apparently (maybe you already stated that but I'm not into smartphones so I'm not sure).

 

[Ra1d]

I don't know why Wireshark wouldn't detect your virtual hostpot.

About the dumper, you need to connect your 3DS to a router, that same router to your PC (via ethernet) and your PC to a modem with internet connection.

That's what I did and for some reason when I search "Local Area Connection" for packets,filtering my 3DS's mac address,it finds some but it says : "Destination : Broadcast (ff:ff:ff:ff:ff:ff)",not sure why,all protocols are either ARP/DHCP or XID and the bytes captured are either 342 or 60 xD

And I've seen that video tutorial and it's nothing like in that tutorial for me.

 

[RubenPikachu]

Alright I have made my pkx editor with at least decent stuff for the time being, if anyone wants to test it, here it is https://dl.dropboxusercontent.com/u/87538979/Pikaedit XY Beta.zip

Requirements: Windows XP or later with .NET Framework 4 installed
WinPcap http://www.winpcap.org/install/default.htm

I'm sure it will help if you are trying to save a custom pkx to test stuff

Edit: You don't need to decrypt the pkx file, just load it as a .pkx file (change the file extension if needed), the editor will decrypt it if the data is encrypted

 

[WulfyStylez]

Alright I have made my pkx editor with at least decent stuff for the time being, if anyone wants to test it, here it is https://dl.dropboxusercontent.com/u/87538979/Pikaedit XY Beta.zip

Requirements: Windows XP or later with .NET Framework 4 installed

I'm sure it will help if you are trying to save a custom pkx to test stuff

Have you tested the shiny check on X and Y pokemon? From what I've heard, they're calculated differently this time around. (That or it was an endianness thing.)

 

[RubenPikachu]

Have you tested the shiny check on X and Y pokemon? From what I've heard, they're calculated differently this time around. (That or it was an endianness thing.)

No, I haven't figured out how it is done, currently it will not mark correctly if the pokemon is shiny or not...

 

[someonewhodied]

what are the item values above and below blazikenite? Just wondering if smealum jumped right to the end of the item list instead of searching around the megastones values.

 

[RubenPikachu]

what are the item values above and below blazikenite? Just wondering if smealum jumped right to the end of the item list instead of searching around the megastones values.

I obtained the item values for all mega stones through capturing packets with the pokemon holding them, here is the list

Spoiler

656 Gengarite
657 Gardevoirite
658 Ampharosite
659 Venusaurite
660 Charizardite X
661 Blastoisinite
662 Mewtwonite X
663 Mewtwonite Y
664 Blazikenite
665 Medichamite
666 Houndoominite
667 Aggronite
668 Banettite
669 Tyranitarite
670 Scizorite
671 Pinsirite
672 Aerodactylite
673 Lucarionite
674 Abomasite
675 Kangaskhanite
676 Gyaradosite
677 Absolite
678 Charizardite Y
679 Alakazite
680 Heracronite
681 Mawilite
682 Manectite
683 Garchompite
684 ????
685 ????
686 Roseli Berry

 

[Flurry]

Couldn't you assume that the blank ones are Latiosite and Latiasite? I guess you're waiting for definite confirmation, though.

If you want to consider a different icon.

 

[RubenPikachu]

Couldn't you assume that the blank ones are Latiosite and Latiasite? I guess you're waiting for definite confirmation, though.

If you want to consider a different icon.

True, I would prefer confirmation, it could be done if you could inject a pkx holding one once injection is completed...
It would be great to change icon since the current one was from BW2, thanks!

 

[Zaneris]

I'm not sure if the bold part means that he used an original received packet without any alteration.

Yes it does, blocking a packet and injecting it back on its way works fine, so it's not an issue with the injection method... In fact my dumper is actively doing that.

 

[popeel1]

the editor is pretty sick, and thanks for including the pokemon in pkx format

 

[RubenPikachu]

It seems that pkx decrypted using codemonkeys' editor have some problems with some values (like a fennekin with OT language value of 0x89!)
I would recommend that you use encrypted files, just change the file extension to pkx, the editor will decrypt them if the data is encrypted