Hacking Pokémon X/Y Dumper and Editor

[ElYubiYubi]

Guys,I can confirm that the dumper is getting blocked by Nintendo,every time I'm trying to conduct a wonder trade with dumper open,it disconnects me from the internet,I did the wireshark method just fine.At first I thought i was paranoid,but if I'm even trying to connect to the internet(in-game) with dumper open,it won't let me,only when I close it,and If I got to the wonder trade window,open the dumper and then conduct a trade,it disconnects me.

But at least I can do the long method with the dongle.

There you have it guys. Told ya this Wonder Trade method was too risky

 

[kyogre123]

I believe you misunderstood me, this still currently isn't possible.

Packet injection is easy, we just can't get the 3DS to accept the packets due to the hash.
It could be anything with any type of secret key on who knows what data...

HMAC-MD5
HMAC-SHA1 Truncated
AES-CBC
AES-CTR

Any encryption cracking experts are welcome to assist =P

Woah, I don't know if cracking the save file of the game would be easier than this

 

[WulfyStylez]

We cannot inject any modified pokemon right now. If you want to test your packet editing for if/when you can inject, try capturing the packet with your normal editing/MITM tools and sending it back without editing it in any way. This works if your environment's set up right.

I'm not particularly optimistic about getting these checksums cracked. I imagine we might have to just wait till the 3DS is properly hacked and we can decrypt the cart and look at the code that handles them.

 

[Zaneris]

We cannot inject any modified pokemon right now. If you want to test your packet editing for if/when you can inject, try capturing the packet with your normal editing/MITM tools and sending it back without editing it in any way. This works if your environment's set up right.

I'm not particularly optimistic about getting these checksums cracked. I imagine we might have to just wait till the 3DS is properly hacked and we can decrypt the cart and look at the code that handles them.

Nor am I optimistic... there's a lot of optimistic people following the same steps I took, but eventually coming to realize the exact same roadblock.

 

[ElYubiYubi]

I'm telling you the best & easiest way would be cracking the SaveFile. Somebody can take a look at the SaveEditors I posted a few pages back.

Or unless someone can make Smea share his work...

 

[MangekyoSharingan]

It must have something to do with a integrity check value in the code. It would help if we could get the sniffed packages of two trainers during the same exchange, and the same extraction of the same pokemons getting back to their owner again.
That way we could get a pattern on which values depend on the pokemon, wich ones on the trainer&DS
If we could repeat the operation after that, we could separate the time variables and other ones that are independent on the pokemon and trainer... Volunteers? xD

 

[kyogre123]

I'm telling you the best & easiest way would be cracking the SaveFile. Somebody can take a look at the SaveEditors I posted a few pages back.

Or unless someone can make Smea share his work...

I'm telling you the easiest way would be calling Nintendo and ask them for the SC.

Spoiler

Pointless advice is pointless.

 

[WulfyStylez]

I'm telling you the best & easiest way would be cracking the SaveFile. Somebody can take a look at the SaveEditors I posted a few pages back.

Or unless someone can make Smea share his work...

Smea's work is the mset hack. You could go make your own hack based off of it if you'd like.
As for savegames: http://3dbrew.org/wiki/Savegames
Not happening any time soon. They've been protected for a while, and 6.0.0+ games buffed up that protection.

 

[artillerycannons]

Hey, there. As long as we're going to try to figure out what causes shininess, here are four of mine and one the person who I was showing mine to over trade to get the data flashed at me (his is the ambipom): http://www.mediafire.com/?zwwaryiynoftoki

Best of luck.

 

[kyogre123]

It must have something to do with a integrity check value in the code. It would help if we could get the sniffed packages of two trainers during the same exchange, and the same extraction of the same pokemons getting back to their owner again.
That way we could get a pattern on which values depend on the pokemon, wich ones on the trainer&DS
If we could repeat the operation after that, we could separate the time variables and other ones that are independent on the pokemon and trainer... Volunteers? xD

Someone at ProjectPokemon traded the same copy of one Pokemon (clones) three times and the packets were different, if that's what you're asking.

 

[RubenPikachu]

Hey, there. As long as we're going to try to figure out what causes shininess, here are four of mine and one the person who I was showing mine to over trade to get the data flashed at me (his is the ambipom): http://www.mediafire.com/?zwwaryiynoftoki

Best of luck.

I have found out how a pkx is shiny, it uses offset 0x18-0x1B (I'm not sure how the game generates it but acts as a unsigned integer for shiny check), ID and SID
Like the PID in Gen 5, divide this seed into 16 bit parts, let s1 be the upper part and s2 the lower part

If (id^sid^s1^s2)<=8 then the pokemon is shiny (yes, including the 8, I have a shiny magikarp that makes this equal to 8)

 

[ElYubiYubi]

Smea's work is the mset hack. You could go make your own hack based off of it if you'd like.
As for savegames: http://3dbrew.org/wiki/Savegames
Not happening any time soon. They've been protected for a while, and 6.0.0+ games buffed up that protection.

https://powersaves3ds.maximummemory.com/

 

[MangekyoSharingan]

Someone at ProjectPokemon traded the same copy of one Pokemon (clones) three times and the packets were different, if that's what you're asking.

yes, thats it, ty xD The incoming pokemon was always the same one? If so, we are fucked!

 

[artillerycannons]

I have found out how a pkx is shiny, it uses offset 0x18-0x1B (I'm not sure how the game generates it but acts as a unsigned integer for shiny check), ID and SID
Like the PID in Gen 5, divide this seed into 16 bit parts, let s1 be the upper part and s2 the lower part

If (id^sid^s1^s2)<=8 then the pokemon is shiny (yes, including the 8, I have a shiny magikarp that makes this equal to 8)

I just checked this on my chandelure -- id^sid^s1^s2 (BitXor[31843,47503,7938,56034]) = 12. So the chances of getting a shiny HAVE increased, looks like? (It's a friend safari lampent.)

 

[WulfyStylez]

https://powersaves3ds.maximummemory.com/

Just because we can read/write saves doesn't mean we can do anything with them. They're still pretty safely encrypted. Plus this won't work with flash-based saves, probably.

 

[ElYubiYubi]

Just because we can read/write saves doesn't mean we can do anything with them. They're still pretty safely encrypted. Plus this won't work with flash-based saves, probably.

https://powersaves3ds.maximummemory.com/download/user-guide/powersaves3ds-user-guide.pdf

And there's another SaveEditor that let you Hex Edit the Saves

 

[Nurio]

There you have it guys. Told ya this Wonder Trade method was too risky

I highly highly highly doubt Nintendo even noticed the guy using the dumper, much less being able to cut off his internet from afar on *only* his computer, but no other device on the network.
The far far far more likely explanation is that the dumper is causing an issue with his network driver or something along those lines.

 

[ElYubiYubi]

This product, I do not think it will do what you think it does.

You're welcome to pick one up and report though.

I will try to get one this week. But there's already a Temper who has it. He posted a few pages back.

 

[RubenPikachu]

I just checked this on my chandelure -- id^sid^s1^s2 (BitXor[31843,47503,7938,56034]) = 12. So the chances of getting a shiny HAVE increased, looks like? (It's a friend safari lampent.)

It could be that the formula would be id^sid^s1^s2 < 16... I would need a shiny with this calculation equal to 15 to prove it...

 

[Nurio]

What exactly does the syntax "a^b^c^d" even mean? As a mathematician, it looks like "to the power of", but I'm sure that's not right in this context...