Hacking GATEWAY ULTRA v3.6 PUBLIC BETA

[osm70]

Isn't gw launcher encrypted?

It's obfuscated. I am not sure about encryption.



Those 3 lines were the only thing that I mannaged to read.

 

[shadyninja94]

Not sure if someone already mention this but, when searching for a particular value if you (lightly tap) the left shoulder button you then an input a hex decimal values instead.

Just a little tidbit I found, thought I would share.......

 

[Datalogger]

...
Why not fix new eshop user manual crashes? i've heard of this nor have I experienced it

This is a well documented issue with Gateway and all new eShop titles.
It started out showing up on Japanese eShop only, but now has spread to all regions.

Most people don't notice because it works fine in CFW and/or because the User Manuals are being stripped off the games because of this problem.

Only Gateway has a problem with this because they don't handle Manuals correctly as does CFW.

For example, try to launch the User Manual from eShop Sonic 2 3D or eShop Pokemon Picross on a N3DS with a Gateway.
(be prepared for a hard-lockup/crash.)

Here's one thread about it. There are others.
Newer japanese games seems to be not working on installing or playing without NTR plugins...

I don't expect Gateway to fix this or care about it.
They are only creating another NDS/DSI preservation mess by having all of these games get released without User Manuals, no big deal...

 

[Asia81]

Need a little bit of help.
I tried to search the gold cheat with Mario&Luigi Paper Jam Bros EUR.

With 2 RAM Dumps and Cheat Engine, I found the adress for gold:
http://image.noelshack.com/fichiers/2015/52/1450968407-1.png

So I did a new .txt in the cheat folder (0004000000132800.txt), for the first line I written:
[Gold9999]00099D2C 0000270F
9999 is 270F in hex.
When I use the cheat in-game, the game freeze, but I always have the music (need to power-off...).

 

[Deleted-236924]

The gateway page has these offset codes:
D3000000 XXXXXXXX – set offset to immediate value
DC000000 XXXXXXXX – Adds a value to the current offset

I wonder what the difference is realistically ?

Let's say you're playing Mario and you are changing the amount of Coins you have.

Set offset to immediate value, if you set it to 00000009 it would change the amount of coins to have to 9.
Adds value to current offset, if you set it to 00000009 it would add 9 coins to what you already have.

Basically the first one replaces while the second one adds.

 

[Asia81]

Let's say you're playing Mario and you are changing the amount of Coins you have.

Set offset to immediate value, if you set it to 00000009 it would change the amount of coins to have to 9.
Adds value to current offset, if you set it to 00000009 it would add 9 coins to what you already have.

Basically the first one replaces while the second one adds.

are you answering to me?

 

[Deleted-236924]

I am answering to the person I quoted. >.>

 

[Asia81]

sry xD

 

[Deleted-236924]

Nope, nothing done. Just a reboot so I can rename the first dump to "NAND-1.bin".

I don't think it's a GW issue, it does it in Decrypt9 too.

My uneducated guess is that some data changes within nand whenever it gets powered on, possibly something to do with date and time? Nand dumps made directly with a hardmod would be identical every time (as long as your nand mod is properly done) because the console is never actually booted every time.
Maybe the 3DS changes some stuff when it boots idk.

For example it looks like this whole block differs between the two dumps I just made:

Spoiler

But there are also way more other differences if you search for more differences, it can't possibly be just time and date stuff.

I think best bet would be to ask on Decrypt9 thread because they know more about nand dumps than we do, they may be able to tell us why some data changes between every nand dump.

 

[dsrules]

The gateway page has these offset codes:
D3000000 XXXXXXXX – set offset to immediate value
DC000000 XXXXXXXX – Adds a value to the current offset

I wonder what the difference is realistically ?

Does anyone else find searching for codes locks the 3DS a lot ? Mine has locked quite a few times.

D3 is set the start address
DC is add to the address (increase the address by) use with Cxxxxxxx for repeatings codes Like All Items cheat

Need a little bit of help.
I tried to search the gold cheat with Mario&Luigi Paper Jam Bros EUR.

With 2 RAM Dumps and Cheat Engine, I found the adress for gold:
http://image.noelshack.com/fichiers/2015/52/1450968407-1.png

So I did a new .txt in the cheat folder (0004000000132800.txt), for the first line I written:
[Gold9999]00099D2C 0000270F
9999 is 270F in hex.
When I use the cheat in-game, the game freeze, but I always have the music (need to power-off...).

you mean two ram dumps using RAM Dumper? the address in those dumps doesn't match the real code address

 

[Asia81]

Yeah, using gw's ram dumper.
And how could I do it?

 

[DarkFlare69]

Yeah, using gw's ram dumper.
And how could I do it?

just dump the ram twice!

 

[Asia81]

I did it directly in-game!
But need to do it on the PC, for save the code...

just dump the ram twice!

It's what I did...
Have 2221 Gold.
RAM Dump
Sell something.
Have 2236 Gold
RAM Dump.

Open in Cheat Engine.

 

[dsrules]

Yeah, using gw's ram dumper.
And how could I do it?

in other words, the RAM Dumper is useless for now, use the Cheat Finder to search

I thought the same but D3000000 freezes the game.
Because of that, I looked at the gateway site for the other offsets and found DC000000 and tried it and the code worked for me.

the code address is less than 0fffffff so Dtype is not really needed
you are using the 32bit codetype (pokes to 4 8bit address) instead of 8bit, that might be the reason it freezes

 

[DarkFlare69]

I did it directly in-game!
But need to do it on the PC, for save the code...


It's what I did...
Have 2221 Gold.
RAM Dump
Sell something.
Have 2236 Gold
RAM Dump.

Open in Cheat Engine.

congratulations!

 

[Asia81]

Ok, I found the adress.
Actually it's easy
007BB1C4 0000270D (9997 Gold

 

[shiondelibra]

Please make a quick tutorial, as active cheat on .cia. why not look like the Y in .CIA games, thanks.

 

[dsrules]

Ok, I found the adress.
Actually it's easy
007BB1C4 0000270D (9997 Gold

way too easy hahaha

Please make a quick tutorial, as active cheat on .cia. why not look like the Y in .CIA games, thanks.

the same way you active on .3ds

 

[Asia81]

BTW, how to use a button activator?
I can't understand how it work.
Something like Press L+R for use the code.

 

[OuahOuah]

Open the GW menu with SELECT then UP and activate ingame menu.
Launch your CIA game then press correct buttons.