Hacking [Tutorial]How to break the game limit on red button Sky3DS cartridges

[SleepingGuru]

alright, more tomorrow then. i'll hold off making a topic with our findings till were all done.

update: to play the games that auto cycle past themself, press and hold the red button for about 5 seconds. press a twice to run the next game. (when you hold the red button, it won't load the next game till you release, and pressing A will run it for you when it loads instead of cycling past itself)

i did what you said, when the 11th game was visible on my home screen i held the red button and press a
it load fine as do 12th and so on, but the cartridge keeps flashing on top, how do i stop it?

 

[johnbus]

i did what you said, when the 11th game was visible on my home screen i held the red button and press a
it load fine as do 12th and so on, but the cartridge keeps flashing on top, how do i stop it?

Out of curiosity, does it just flash on the home screen, or does it flash non-stop even after selecting a game and playing it?

 

[SleepingGuru]

Out of curiosity, does it just flash on the home screen, or does it flash non-stop even after selecting a game and playing it?

Before no blue led visible from top, until the game starts with the 3ds logowhile holding it down and pressed a, i cycled through the games i had 4 on sd card worked fine, so on second sdcard i just had the lone 11th game inserted it kept skipping on itself until i did what dawn bomb stated and it worked
only thing im wondering is on the first method it says the roms after 10 should say NO under eeeprom my 11th says "YES"

 

[Arithmatics]

alright, more tomorrow then. i'll hold off making a topic with our findings till were all done.

update: to play the games that auto cycle past themself, press and hold the red button for about 5 seconds. press a twice to run the next game. (when you hold the red button, it won't load the next game till you release, and pressing A will run it for you when it loads instead of cycling past itself)

Interesting find you have there. totally ninja'd my entire operation because that's what I was planning to do once my Sky3DS arrives but no worries. Atleast we'll have more testers once it actually does come to me.

btw, I don't think there's a need to make a new thread to discuss how it works. IIRC the mods are considering splitting hacking/homebrew to it's ds equivalents so more threads = much more of a hassle.

No worries, if anything does come up with how template.txt works then I'll just update this thread and turn it into "The Definitive Sky3DS thread" which includes how to bypass the game limit and whatnot. Which is my ultimate goal.


EDIT:

third time is the charm

http://www.mediafire.com/download/b28duz9vz4x4mve/2TEMPLATE.zip

So is this basically you changing EVERY value necessary to "F8" "98" straight up? nothing else? There's a problem with this because once a new template.txt file is uploaded on sky3ds' website, you'll have to repeat the process. Or am I right in assuming that you're working on a batch file that will automatically change the required values which means we'll simply have to run it on each new template.txt that's released instead of having to CTRL+F it one by one?

 

[Redsmeg]

Has anyone successfully ran Bravely Default or DK Returns (both euro) as cracked?
I couldn't get either to run unless they weren't cracked and had Eeprom yes.
I'd be interested if anyone gets cracked versions of any region to run.

I'm wondering if it has something to do with size as they are both 4gb games.
I can get everything else to run fine.

I had an experience trying to get Animsl Crossing New leaf (EUR) working... I had a bit of back and forth with Sky themselves and they couldn't help. One thing i tried was original diskwriter and its included template... That worked.. It also gave a no eeprom which I have only just noticed.
so has something been changed in original template to newer one? Ill have to go look when I get the chance.

 

[Arithmatics]

I had an experience trying to get Animsl Crossing New leaf (EUR) working... I had a bit of back and forth with Sky themselves and they couldn't help. One thing i tried was original diskwriter and its included template... That worked.. It also gave a no eeprom which I have only just noticed.
so has something been changed in original template to newer one? Ill have to go look when I get the chance.

AFAIK Diskwriter can write with any template you feed it. The only changes are based on functionality (added reformat, write faster, etc.)

Taking a look at CTR-P-EGDP (Animal crossing Europe) in the latest template.txt (12/12/2014) it has 2 blocks.

In the earliest one available (bundled with original diskwriter) There's only 1 block.

I noticed in the later ones with 2 blocks the main block yields No EEPROM ("F8" "98"). Not sure how this ties in.

But yes, changes were conclusive. Can you try with the latest 12/12 template.txt? http://filetrip.net/dl?qINZNJx304 and see if it works.

We still don't exactly know how template.txt is used in burning roms to microSD so baby steps I guess

 

[Redsmeg]

AFAIK Diskwriter can write with any template you feed it. The only changes are based on functionality (added reformat, write faster, etc.)
But yes, changes were conclusive. Can you try with the latest 12/12 template.txt? http://filetrip.net/dl?qINZNJx304 and see if it works.

We still don't exactly know how template.txt is used in burning roms to microSD so baby steps I guess

I tried latest template originally and had no luck.
Do you mean to try latest template and original diskwriter?

 

[dawnbomb]

alright i'm awake.

@Arithmatics unfortunatly, yes i did it by hand. and for a good reason. you unfortunally cannot use CTRL+F or run a batch file to get the end result. the 20% of them that arn't F8 00 90 are a REALLY wide varity of stuff, everything from similuar stuff like 7F 02 09 to really off hexes like 4B 27 84. (thankfully i used a program to give rainbow text, so the 6th and 8th hex codes were always the same color making them easy to see. but you would have to know about all 50-150 hex codes to run a batch on every single one. this basically means, that while a batch would fix alot of it, i would STILL have to manually change the entire template afterward for all the other hex strings.

that said, it only took me about two hours to do it by hand, and legit 80% is just F8 00 90 to start with. the bottom 5% has some variance, from there 65% up the list is literally a solid wall of F8 00 90, then from there the rest is varied all the way to the top of the document. you could run a batch on F8 00 90, to save a buncha work, and i don't mind releasing manual templates fixing all these hex values. a batch could cut my work time to more like 20 minutes of manual editing. (and i even ate and helped someone with their own problem during my 2 hours of hex edits.)

anyway, if there are games where there is another copy of F8 00 90 that isn't meant to be edited, those games would get screwed by the batch file. anyway someone could match a batch file that HIGHLIGHTS the F8 00 90 strings, and i can go through and look (yes, i promise i'll do it manually) and see if there is any instances of the string being used outside of the second hex line, and i'll write down their CTR-P codes, for us to take a closer look at.

and, honestly, even if you did get the other 50-150 hex strings for every other posibility, before making a batch change them all, you would need to confirm that none of the hex strings your about to have a batch change for you appear anywhere, ANYWHERE, other then the second hex line of each games CTR-P code, INCLUDING the 80% of F8 00 90 strings.

@SleepingGuru Do you mean the cartrage itself keeps flashing its light? i...well, i would have no idea how to fix that. again, just another great reason to just simply not have more then 10 games at once. just remove games, then add others.

@redsmeg as i said earlier, games larger then 2.1 GB will not work with this template i made. i know, for a FACT, that EVERY game larger then 2.1GB does NOT use the F8 00 98 string to save to itself. in other words, the game won't save normally, nor will they save to sd, so they just plain won't save. for these, its much better to manually convert them. so doesn't even bother trying old writer with new template, unless you change the template youself.

i'm actually going to test this in the next few minutes myself, but for the ones giving the error for under 3+ gigs. anyway, its also highly likly, any game above 2.1 GB, reguardless of it saying yes or no eeprom will insta crash. this is because it can't save to eeprom, or to sd, (ignore it saying no eeprom, that just means its not saving in eeprom, it doesn't mean yes to saving on sd technically). so it just doesn't save, because the F8 00 98 string is only for 2.1 and lower size games. the reason this causes a auto crash, is because a VERRRRY large amount of games, instantly try to make a save structure or system files, for like your options menu and what not, the moment they are turned on. persona Q is an example, but there are TONS of these examples.

@anyone seriously tho, if someone could make a batch file to somehow just highlight, or otherwise make extremely obvious, like changing the font color, of all F8 00 90 text strings in any template file, so i can manually check them, that would be great. seriously, go do it, right now, go....GO!

in final news, i just woke up, so i'll be up the next 18 hours for all your questions and tests.

 

[philipx99]

It seem that latest template and diskwriter have issue with Animal Crossing New Leaf games. And ACNL Game have issue loading at "EEprom=Yes". Try using old writer (Sky3DS DiskWriter [11/06/2014]) with the old template included at SKy3ds website.

1) Delete any existing old ACNL from your sky3ds card using the latest writer (Sky3DS DiskWriter V1.04 [12/09/2014]) from sky3ds website.

2) Switch to the old writer (Sky3DS DiskWriter [11/06/2014]) with the old template included and write the ACNL game (Game to be burned should not be trimmed or backup by diskwriter) to the sky3ds card. The game do not need to be hack by sky3dsctool from sky3ds website. It seem that the old template already set to put the game in "Eeprom=No" after write complete using old writer.

3) Once ACNL writing is completed. Insert the sky3ds card in your console and power on.

4) When you switching to the 11 game. Look at the screen of your 3ds to see your game starting to switch. Wait until the ACNL game appear. Once appear, without any delay hold on to the red button for 5 second and then release. The blinking light will flashes non stop but your ACNL game will remain without automatically switching to the next game. Now click "A" button to launch the ACNL game without any issue. Remember when you end the game, make sure you save and press home and close the app. The blinking light will still flash non stop which prevent you from skipping to the next game. One method I try is to enter setting and from setting exit out back to home screen by pressing "X" button and it will switch to the next game. The game work for me and save still remain.

5) Remember only use the old writer and template for this ACNL train loading fix.

 

[dawnbomb]

i sniped you

can someone upload the 1.3 writer? the site's download button does not work (its just a unclickable image) looks like they took it down. (this may also be a secret warning, so stop people from using 1.3 to write in games like bravery default and pokemon x, maybe because of some huge bug.)

by the way, guys on the previous page whos name i can't see or remember who made this topic. you contacted sky 3ds to have them link to this right? mind doing me a direct favor? can you contact them, and ask them to release a writer that allows us to see if EEPROM = no or yes before you write it to the micro sd.


finally, because 1.3 is down. i tested 1.2 and got some VERY INTERESTING RESULTS. first, 1.2 has a different CTR-P code for pokemon X. this is very interesting. also after adding it, i could not get to iit, only the game before it. then i noticed both PX, and the game i was selecting before Px were deleted. also the card bugged out and said it had 0 MB free left. i decited to reformat it. but its interesting. i suppose the moral is to not fuck with disk writer 1.2 but untill someone provides me a link to 1.3 i'm going to continue testing. worst that happens is i nuke the micro sd a few more times i guess.

update: so..many..things... 1.2 is hell, so many bugs, all i have to say is never use 1.2 ...why am i even doing this, i should just wait for someone to post 1.3, or wait for them to release a 1.5 with the eeprom yes no feature i requested.

 

[ChrisRX]

So far there doesn't seem to be any fancy things that need to be done to save game progress. I have noticed that if I add more than 10 games to the cart (I had 13) when I press the red button to select the next game it works fine - until I get to the 11 game. Then it shows the ROM, skips to the next, then the next, then back to ROM #1. Can't play 11 - 13.

I have the same issue. I couldn't work around it with any amount of holding down the red button or any other combination

alright i'm awake.

@Arithmatics unfortunatly, yes i did it by hand. and for a good reason. you unfortunally cannot use CTRL+F or run a batch file to get the end result. the 20% of them that arn't F8 00 90 are a REALLY wide varity of stuff, everything from similuar stuff like 7F 02 09 to really off hexes like 4B 27 84. (thankfully i used a program to give rainbow text, so the 6th and 8th hex codes were always the same color making them easy to see. but you would have to know about all 50-150 hex codes to run a batch on every single one. this basically means, that while a batch would fix alot of it, i would STILL have to manually change the entire template afterward for all the other hex strings.

that said, it only took me about two hours to do it by hand, and legit 80% is just F8 00 90 to start with. the bottom 5% has some variance, from there 65% up the list is literally a solid wall of F8 00 90, then from there the rest is varied all the way to the top of the document. you could run a batch on F8 00 90, to save a buncha work, and i don't mind releasing manual templates fixing all these hex values. a batch could cut my work time to more like 20 minutes of manual editing. (and i even ate and helped someone with their own problem during my 2 hours of hex edits.)

anyway, if there are games where there is another copy of F8 00 90 that isn't meant to be edited, those games would get screwed by the batch file. anyway someone could match a batch file that HIGHLIGHTS the F8 00 90 strings, and i can go through and look (yes, i promise i'll do it manually) and see if there is any instances of the string being used outside of the second hex line, and i'll write down their CTR-P codes, for us to take a closer look at.

and, honestly, even if you did get the other 50-150 hex strings for every other posibility, before making a batch change them all, you would need to confirm that none of the hex strings your about to have a batch change for you appear anywhere, ANYWHERE, other then the second hex line of each games CTR-P code, INCLUDING the 80% of F8 00 90 strings.

@SleepingGuru Do you mean the cartrage itself keeps flashing its light? i...well, i would have no idea how to fix that. again, just another great reason to just simply not have more then 10 games at once. just remove games, then add others.

@redsmeg as i said earlier, games larger then 2.1 GB will not work with this template i made. i know, for a FACT, that EVERY game larger then 2.1GB does NOT use the F8 00 98 string to save to itself. in other words, the game won't save normally, nor will they save to sd, so they just plain won't save. for these, its much better to manually convert them. so doesn't even bother trying old writer with new template, unless you change the template youself.

i'm actually going to test this in the next few minutes myself, but for the ones giving the error for under 3+ gigs. anyway, its also highly likly, any game above 2.1 GB, reguardless of it saying yes or no eeprom will insta crash. this is because it can't save to eeprom, or to sd, (ignore it saying no eeprom, that just means its not saving in eeprom, it doesn't mean yes to saving on sd technically). so it just doesn't save, because the F8 00 98 string is only for 2.1 and lower size games. the reason this causes a auto crash, is because a VERRRRY large amount of games, instantly try to make a save structure or system files, for like your options menu and what not, the moment they are turned on. persona Q is an example, but there are TONS of these examples.

@anyone seriously tho, if someone could make a batch file to somehow just highlight, or otherwise make extremely obvious, like changing the font color, of all F8 00 90 text strings in any template file, so i can manually check them, that would be great. seriously, go do it, right now, go....GO!

in final news, i just woke up, so i'll be up the next 18 hours for all your questions and tests.

The easiest way I found to do it was to record a macro in notepad++ and then select to run the macro "until the end of the file"

 

[philipx99]

I have the same issue. I couldn't work around it with any amount of holding down the red button or any other combination

When you are about to switch to the 11 game, the blue light will start to blink continuously and it will stop once the 11 games appear on the homescreen. You will realise the blue light will blink again and immediately before it switch to the next 12 game, quickly hold on the red button for 5 second and if successfully the blue light will blink continuously but this time is slow. Highlight the game and press "A" button. and it will load the game. It work for me.

 

[dawnbomb]

update, 1.2 is truly the face of a demon. i'm not using it, even to fix the bravery default/new leaf/pokemon x/ect bug. i'll wait for someone to link me a download of 1.3 (you guys can upload your 1.3 to mediafire) or for 1.5. also why the hell is 1.2 so bad that the options menu won't even load. like give me a freakin break, geez.

ChrisRX i don't know how make macros or batch files from nothing but my own code, i always use program assistance or something else. one of you, as i said in bold earlier, please go make some file to run on a template to change all F8 00 90 strings to, say, another color. then i'll use it and look through to see if there if a batch auto change file would change anything on some games its not meant to. (and that would be unaccepable, and why i don't want to have a font color change first, so it can be checked manually)

also, they released a new template today. literally today. (yesterday for some people). i'll test it if it fixes the bug. thankfully there is literally no major released in the past time, other then persona Q, and thats on the template i provided. and there are no major releases for 2 months. but we should still get this rolling guys. so please, a font color change file for me to run on the template please~

also, if possible, make it also underline, and bold the text, and make the color a vivid purple, or red. much easier on my eyes.

edit: here again is the link to my shiny new template from yesterday, should have no eeprom on almost all roms by default, again, roms bigger then 2.1GB will be unlikly to work. but very few 3ds roms are bigger then that http://www.mediafire.com/download/b28duz9vz4x4mve/2TEMPLATE.zip

i just finished looking through the default template, someone made me a batch. and its totally okay, not a single string of F8 00 90 is anywhere where its not supposed to be, this means we can just use a batch in the future templates to replace all. we will still have to do the other 20% manually tho...

in other news, i have no intent to do it manually again for awhile, there is literally only shovelware from now till february, so new templates will be useless compared to mine. ..we could still use a new writer tho, one without the new leaf/pokemon x / bravery default bug and with the ability to see if eeprom is yes or no before writing the rom to the sd.

incase anyone cares, we still gotta do those two tests on the games themselfs i said a page or two back, involving saves and the scrolling past the rom bug. those are the last things left.

by the way, i don't know myself, but games like say fantasy life, or fire emblem have DLC, is it possible to get a rom with the DLC included? or do you have to get it via E shop? (in otherwords, if you have a rom and don't want to update, can i not get new DLC unless i update and e shop, or is it possible to get a digital rom with the DLC on it? also is it affected by the type of DLC, IE on cart DLC vs actual download dlc? i think cart dlc could maybe be done without hitting eshop, if anyone knows that would be great, just another thing to test)

edit: seriously tho guys, anyone got a 1.3 writer?

 

[donkeymilk]

... ability to see if eeprom is yes or no before writing the rom to the sd....

I'm not sure I understand this. The latest version and the version 1.0 I just used both have a column that states whether the game will use EEPROM. What am I missing?


UPDATE: I PM'd you about v1.03.

So far, no combination of DiskWriter versions, template file edits, conversions, et al. have fixed the looping issue. I'm using Tetris as a test, and the only ROM on the cart, and it constantly loops no matter what I do. Holding the red button and press A is not an acceptable solution considering that the blue light constantly flashes while the cart is being played.

 

[dawnbomb]

I'm not sure I understand this. The latest version and the version 1.0 I just used both have a column that states whether the game will use EEPROM. What am I missing?

it states that from reading your micro sd card. right now, without writing, or to make it even easier, without any sd card to put it onto. you can't tell if eeprom is yes or no. the writer only tells you AFTER it puts the game on the micro sd. their is no way to get a 'preview' of what it will look like before putting it on the micro sd.

as it stands now, you gotta put the game on the micro, and if eeprom = yes for some dumb reason, you gotta wait for the transfer to finish, then delete the game, then fix the template, then transfer the game to the micro sd AGAIN. ..or you can pull the micro out when its being copied the first time, but i bet we all know thats a big no no. so you literally gotta transfer it twice fully if you mess up.

what i want, is it to read the rom, and tell you that info, before asking if you want to write it to the sd card. kinda like how you mount a iso and get info off it before installing. as it is now, it installs first, and tells you the info later.

 

[donkeymilk]

it states that from reading your micro sd card. right now, without writing, or to make it even easier, without any sd card to put it onto. you can't tell if eeprom is yes or no. the writer only tells you AFTER it puts the game on the micro sd. their is no way to get a 'preview' of what it will look like before putting it on the micro sd.

as it stands now, you gotta put the game on the micro, and if eeprom = yes for some dumb reason, you gotta wait for the transfer to finish, then delete the game, then fix the template, then transfer the game to the micro sd AGAIN. ..or you can pull the micro out when its being copied the first time, but i bet we all know thats a big no no. so you literally gotta transfer it twice fully if you mess up.

what i want, is it to read the rom, and tell you that info, before asking if you want to write it to the sd card. kinda like how you mount a iso and get info off it before installing. as it is now, it installs first, and tells you the info later.

Ok, I'm with ya now. That would certainly make things easier.

Sadly, my cart lost its cherry when I accidentally loaded ACNL on the cart and it was EEPROM "YES"...

 

[dawnbomb]

thats fine. the eeprom yes save bug is only for those where it says yes. in other words, all the YES saves will get corrupted at the same time when you add the 11th yes.

but, that all can be literally ignored. the eeprom and the sd are diffrent save locations. the eeprom can corrupt saves all it wants. if a game says eeprom no, it still will work, because its save location it totally different. just remove new leaf eeprom yes, and replace it with new leaf eeprom no.

anyway, i imagine you didn't understand what i meant in my request untill the moment you tried new leaf and got a yes, and suddenly it hit you like a brick what i was asking for, lmao.

 

[Arithmatics]

i just finished looking through the default template, someone made me a batch. and its totally okay, not a single string of F8 00 90 is anywhere where its not supposed to be, this means we can just use a batch in the future templates to replace all. we will still have to do the other 20% manually tho...

in other news, i have no intent to do it manually again for awhile, there is literally only shovelware from now till february, so new templates will be useless compared to mine. ..we could still use a new writer tho, one without the new leaf/pokemon x / bravery default bug and with the ability to see if eeprom is yes or no before writing the rom to the sd.

incase anyone cares, we still gotta do those two tests on the games themselfs i said a page or two back, involving saves and the scrolling past the rom bug. those are the last things left.

My Sky3DS is arriving tomorrow. Since you've covered most of what I wanted to test, I'll just test the scrolling issue. As for emailing Sky3DS, I doubt that they'd release the source code for the DiskWriter program seeing as if Nintendo got a hold of it, It would increase their understanding of how it works and that will definately prove to be a thorn in our sides.

Instead I recommend we compile a complete "what to change" list and email them and ask them to include it in the next iteration of DiskWriter.

As for your hand-made no EEPROM template, can anyone test and see if it would still work if you manually copy/paste entire blocks of new values from the latest template.txt and add them to the top or does it specifically depend on each position of each value?

Because if it works, we can just take dawnbomb's base template.txt, then simply scan the latest template.txt and just copy, paste and edit what's new into dawnbomb's template.txt which would completely reduce the 20% manual labour to just 1~5%. Since they usually only add 3~7 games per revision anyways.

That way we can have our own completely modified template.txt that should theoretically only require red button Sky3DS users to run the ROM through the cracking tool and also eliminate the need for a batch file. I can set up a document workspace that anyone with permission can edit to add modified values imediately as each template.txt is released. Then all you have to do is just download the latest revision, then use it alongside DiskWriter. voilà no game limit.

As for the 2gb+ games, we'll eventually solve it one way or another.

 

[donkeymilk]

As for the 2gb+ games, we'll eventually solve it one way or another.

This has alluded me. Super Smash Brothers works flawlessly and it's >2GB. I'm not sure what issues others are seeing. If I could get games like ACNL and Tetris to quit wanting to skip, I'd be pretty satisfied right now.

I just want to get the kinks out before xmas. Someone is getting a swell gift... Super Mario special edition 3DS XL and Sky3DS or Gateway - whoever comes through first.

 

[johnbus]

If anyone is still looking for DiskWriterV103, I may know an interesting source to get it. See, instead of ordering an official Sky3DS, I ordered a clone called R5SDHC. They have their own website that hasn't updated their DiskWriter as often as Sky3DS, so the newest one they have is V1.03. I'm not sure if it has been modified in any way, but it may be just what you need:

http://r5sdhc.com/DiskWriterV103.rar