Hacking GATEWAY ULTRA v3.6 PUBLIC BETA

[shadowofdarkness]

Yes you're right.
I did initial search before I entered the serial code and before I got to the wondercard,
the second search was when I get to the splash screen (with selection hovering at no, so that I won't accidentally collect it when exiting Gateway AR menu).
.
I'll try to do as per you suggested, seeing as this isn't going to be easy. Thanks ><

My best suggestion would be for test cases start a event that is easily reproducible like a Wi-Fi or Nintendo Zone one then
backup save
do the event
extract the wc6
restore the save to before the event
get to the splash screen
dump as much memory as possible
on a computer find a way to search in the ram dump for the wc6 data by opening the wc6 in another hex editor and copying a big block of the wc6 data into the search of the ram dump.

Note so the data matches up try to make sure both have the same date and if available on that Pokemon the same gender. So the data you search for will match.

alternative
For searching your way on the 3DS my only tips to look for and known values like the "wonder card id" and TID or SID of the event Pokemon which you can probably find through Project Pokemon if someone has already contributed the wc6 file.

 

[Queno138]

-snip-

I've actually tried with Ram dumping first,
but I can't see anything that is a related to a wondercard.

Heck, I tried looking for "Jirachi" or "Christmas" [as text, cause they show up in WC6 as text as well] (cause I'm using a serial code to find the Christmas Present Jirachi) and I get no hits on Hex Editor,
so I'm assuming that whatever I'm looking for, it may be encrypted in the ram.

 

[shanefromoz]

Could someone please explain the mode setting when changing between Gateway mode and Classic Sysnand mode?

 

[shadowofdarkness]

I've actually tried with Ram dumping first,
but I can't see anything that is a related to a wondercard.

Heck, I tried looking for "Jirachi" or "Christmas" [as text, cause they show up in WC6 as text as well] (cause I'm using a serial code to find the Christmas Present Jirachi) and I get no hits on Hex Editor,
so I'm assuming that whatever I'm looking for, it may be encrypted in the ram.

Then best guess is to search for know values like the wonder card id (145) or trainer id (12015) for that wonder card

 

[OuahOuah]

When you change to sysnand you can launch cartridge and not ROM. Like booting on sysnand without completely rebooting the 3DS

 

[Binebina87]

Could someone please explain the mode setting when changing between Gateway mode and Classic Sysnand mode?

With Gateway mode you can play your .3ds with the red Gateway card and on classic mode you can play your original 3ds Games (prior to the update you had to reboot your 3ds everytime)


I was wondering if it is somehow possible to convert NTR cheats (cheat.plg) to Gateway cheats (so I dont have to boot up NTR CFW)? (opening cheat.plg in an Hex Editor or notepad just shows jibber jabber :-) )

 

[cearp]

Just use SD managment and edit your cheats while on PC

i wrote that i can't use it, it doesn't work well with mac for some reason. i think i read it is because mac has a bad implementation of samba.
i read that some guy got it working on linux, so yeah just mac being annoying i think

 

[Asia81]

Yes and No.
You can use the search engine (in-game), once you found your adress for something (like gold), you can write it a txt for further use, add a button activator...

yeah it is a little annoying that i have to remove the sd card to add cheats, but no big problem...
i'm on a mac so i can't use the micro sd wireless transfer i will get some ftp homebrew 3dsx

If you're on a .cia, you can remove the GW Card immediately and re-insert it (just after create and edit your txt file), there will be no problems.
On a .3ds, no need to reboot, but yeah you have just to close the game.

 

[Slade.AU]

it's not possible to use the menu to searh for cheats, and then save them the game's cheat list?
we have to manually write down the addresses, or manually add them in the cheat menu right?

Yes, that's right. You need to write them into a text file manually, then copy it to the micro SD card in the red Gateway card.
It's a pain, but it does serve a purpose in that it forces you to exit a game every now and again to ensure you save your progress properly.

 

[cearp]

If you're on a .cia, you can remove the GW Card immediately and re-insert it (just after create and edit your txt file), there will be no problems.
On a .3ds, no need to reboot, but yeah you have just to close the game.

reinsert the gw card sd card?
i thought the cheat text files were stored on the main system sd card?

(but ramdumps are on the gw sd card i think i read?...)

 

[Asia81]

ram dump and txt cheat file are stored on the micro sd used by the gw card (where you have your roms .3ds)

 

[marksteele]

I'm curious as to if we can use this to add plays in the badge arcade. I assume the plays themselves are stored sever-side but I assume it only checks in with the server for purchases or at the app launch so.....

 

[julian20]

Btw. It isnt possible to edit your coin value on mk7 online.

 

[urherenow]

I wonder if they detect it every time without fail, or only randomly.

It will take a while for them to make an update for 3.6, but I was never able to brick with 3.5.1, so...

gateway still works on 8.xx so no point in upgrading it to 9.2. just get a retail cart with 9.2 if you're really desperate.

Menuhax.

Yea...not sure where/who said this. Are you referring to sysnand only or emunand as well? I have updated emunand using a retail cartridge.

Because emunand uses firmlaunchax, so GW/CFW doesn't really care that you just messed up your native_firm. Try booting into a devmode emunand though... You'll have a black screen brick. Same if you tried flashing that emunand to sysnand.

Is there something wrong with this versions nand dump feature or is it normal to have different nand dump sha1 hashes after dumping it twice?

The only way to get the same hash twice is to dump it twice in a row with a hard mod. The time, for one, is kept track of in NAND for some reason. Copy your emunand, then inject it again a couple of hours later... Your time will be off...

Why not fix n3ds higher emunand

Because nobody has found the keys for 9.6>? Even after someone gets those, they would need to find a vulnerability to exploit.

 

[Jiro2]

Am I the only one which GW's language changer feature doesn't work?
I tested with the Inazuma Eleven GO2 games (which are Multi5) and putting them in English (standard language is Spanish), and I don't see changes on the language.
Same with the Pokemon Mystery Dungeon, same settings.

I haven't been able to get it to work either. I tried Pokemon Mystery Dungeon and Pokemon X and I know Pokemon X has multiple languages.

 

[3DSPoet]

Hello, all! So I've been running Gateway 3.51 on my 2DS using a DWTwo Plus for about a month now with no problems. I tried the 3.6 and now my 2DS is bricked with the 08 BootRom error (which I've heard is Gateway's doing...) Irritation and frustration aside, is there a way to fix this? I've googled and searched here, finding multiple threads, but none that are straight tutorials or written explicitly for the 2DS. If y'all could direct me to something I've missed or maybe message me with some info, that'd be awesome! I've got the NAND backup, but most of what I'm seeing is talking about a hard mod. Any help is appreciated!

 

[gamesquest1]

Hello, all! So I've been running Gateway 3.51 on my 2DS using a DWTwo Plus for about a month now with no problems. I tried the 3.6 and now my 2DS is bricked with the 08 BootRom error (which I've heard is Gateway's doing...) Irritation and frustration aside, is there a way to fix this? I've googled and searched here, finding multiple threads, but none that are straight tutorials or written explicitly for the 2DS. If y'all could direct me to something I've missed or maybe message me with some info, that'd be awesome! I've got the NAND backup, but most of what I'm seeing is talking about a hard mod. Any help is appreciated!

None of the old guides will be 2ds specific as the old brick code only worked on 4.x consoles so not the 2ds.......but basically you will need to perform a 2ds hardmod and then follow the rest of the guide that references 3ds's the process should be the same regardless it's only the hardmod pinout that differs

 

[alantgw]

reinsert the gw card sd card?
i thought the cheat text files were stored on the main system sd card?

(but ramdumps are on the gw sd card i think i read?...)

btw Hex editor is there..
so you don't really need to remove and reinsert if you just want to edit the value in some cases

 

[BASgamer]

is there any way in a loop to also change the value to write to the address in a loop code? trying to find which values are unused items so they can be removed to fix moneychilds code

D3000000 00000000
C0000000 0000005B
280D4D00 00000063 <-- want to start it at 99 then decrease it by one for each loop
DC000000 00000002
D1000000 00000000
D0000000 00000000

so at 80D4D00 it would write 63(99 in dec)
at 80D4D02 it would write 62(98 in dec)
at 80D4D04 it would write 61(97 in dec)

 

[dsrules]

is there any way in a loop to also change the value to write to the address in a loop code? trying to find which values are unused items so they can be removed to fix moneychilds code

D3000000 00000000
C0000000 0000005B
280D4D00 00000063 <-- want to start it at 99 then decrease it by one for each loop
DC000000 00000002
D1000000 00000000
D0000000 00000000

so at 80D4D00 it would write 63(99 in dec)
at 80D4D02 it would write 62(98 in dec)
at 80D4D04 it would write 61(97 in dec)

D4000000 XXXXXXXX – Adds XXXXXXXX to the data register
didn't try it on gw , but
you could try google nds action replay D4000000 for examples
or after you found the address, use the in game Hex Editor to edit each address one by one with different values