Hacking Badge Arcade Cheating with Gateway

[Localhorst86]

@montalvoe Since my code did work for you, can you tell me details about your system? O3DS/N3DS, sysnand, emunand? Since I do not have a US device I can not really help debug this

 

[Xenon Hacks]

TRY THIS

N3DS US

[Unlock Catcher L+UP]
DD000000 00000240
D3000000 32868C3C
00000000 00000004
D0000000 00000000

Still doesn't work you guys must not be very good at this stuff

 

[Garro]

Try

O3DS US
[Unlock Catcher L+UP]
DD000000 00000240
D3000000 32C22D4C
20000000 00000004
D2000000 00000000

Doesn't seem to do anything, I'm pressing Up+L while in the real catcher, it just scrolls to the left set.

Ok I managed to make this work, I used the search cheat and got the value for the real tries, which in my case was 32868C4C, so I changed the cheat to

DD000000 00000240
D3000000 32C22D4C
20000000 00000004
D2000000 00000000

And now it works, it resets the tries to 4. My console is an US o3DS on Emunand 10.3. Thanks for the cheat Local c:

 

[Localhorst86]

Ok I managed to make this work, I used the search cheat and got the value for the real tries, which in my case was 32868C4C, so I changed the cheat to

DD000000 00000240
D3000000 32C22D4C
20000000 00000004
D2000000 00000000

And now it works, it resets the tries to 4. My console is an US o3DS on Emunand 10.3. Thanks for the cheat Local c:

wait, so 32868C4C is the address for the 03DS? THat's why it wont work on @Xenon Hacks N3DS, then. 32868C4C is the number of plays, 32868C3C the Unlock for the o3ds.

@Xenon Hacks since I don't know any of the offsets for the US N3DS, I can't really help you, sorry. My bad.

EDIT: Apparently that's what I get for guessing your addresses, then

 

[Xenon Hacks]

wait, so 32868C4C is the address for the 03DS? THat's why it wont work on @Xenon Hacks N3DS, then. 32868C4C is the number of plays, 32868C3C the Unlock for the o3ds.

@Xenon Hacks since I don't know any of the offsets for the US N3DS, I can't really help you, sorry. My bad.

So then how do I make the cheat file myself

 

[Localhorst86]

So then how do I make the cheat file myself

By replacing the XXXXXXXX with the proper address. But since I do not own a US N3DS, I can not find the address myself. What we need is either the address for the number of practice or real plays, then we can calculate the unlock offset.

DD000000 00000240
D3000000 XXXXXXXX
20000000 00000004
D2000000 00000000

 

[marksteele]

If no one else can get that I can get it tomorrow for sure

 

[Xenon Hacks]

By replacing the XXXXXXXX with the proper address. But since I do not own a US N3DS, I can not find the address myself. What we need is either the address for the number of practice or real plays, then we can calculate the unlock offset.

DD000000 00000240
D3000000 XXXXXXXX
20000000 00000004
D2000000 00000000

and I do that how?

 

[Localhorst86]

and I do that how?

If you have 5 practice plays, go to the practice grabber, do a new (!) search for the exact value 5.

Play a game. When the game is finished and the counter goes to four, search for the exact value 4.

Repeat, search for value 3. By now you should have 2 or 3 remaining hits in the hit list. If not, repeat once more.

If you have only 2 or 3 remaining hits, write down the numbers in the hitlist on a piece of paper for safety. Press A and change the value of the first hit to 12 or whatever.

Play another game. If you now have 17 plays, congrats. You got the address for the practice plays. Post that here.

 

[dsrules]

I guess he didn't noticed o3ds address is in 32xxxxxx and n3ds address is in 36xxxxxx

 

[Xenon Hacks]

I guess he didn't noticed o3ds address is in 32xxxxxx and n3ds address is in 36xxxxxx

So do you have a code for the real catcher? Even if it gives me 1 play when I use it I would be grateful.

 

[dsrules]

So do you have a code for the real catcher? Even if it gives me 1 play when I use it I would be grateful.

sorry man, I don't have n3ds
just do what the others said, search in Free Plays, the number of Plays left is the number you search as Exact Value

 

[Xenon Hacks]

sorry man, I don't have n3ds
just do what the others said, search in Free Plays, the number of Plays left is the number you search as Exact Value

I'm out of free plays for the day. Question does this value change every day?

 

[Localhorst86]

I'm out of free plays for the day. Question does this value change every day?

No every day, no. It used to be identical for five days in a row and only changed when they added brand new badges and the bunny told us about it.

 

[chemistryfreak]

The code works fine, interesting to know that it is simply one 0x10 addresses down to the real plays. since the offset between the trial plays and real plays seems to be always 0x3BA110, we can assume the unlock address is 0x3BA111 down from the number of practice plays.

Now all we need to do is find the pointer in the RAM dump that points to that address.

Hey any idea how I can calculate the unlock play address for JP O3DS?

The practice play value is 32C2A5DC
The real play value is 32849ACC

Thanks in advance!

 

[Godson777]

@Localhorst86 and @Xenon Hacks, after enough derping around with my cousin, we were able to grab the address for the practice counter on US n3DS.

36822D5C

Will return with the real plays soon.

 

[Xenon Hacks]

@Localhorst86 and @Xenon Hacks, after enough derping around with my cousin, we were able to grab the address for the practice counter on US n3DS.

36822D5C

Will return with the real plays soon.

I love you no homo

--------------------- MERGED ---------------------------

Hoping to see you back with real plays since I can't get into practice.

 

[Godson777]

Found the address for real plays.

36468C4C

So to recap:

Practice: 36822D5C
Real: 36468C4C

Whoo, glad I was able to help out some people! :3

 

[Xenon Hacks]

Found the address for real plays.

36468C4C

So to recap:

Practice: 36822D5C
Real: 36468C4C

Whoo, glad I was able to help out some people! :3

So an example would be
[What do I press and what does it do? ]
DD000000 00000240
D3000000 36468C4C
00000000 00000004
D0000000 00000000

for real plays on a US N3DS

 

[Godson777]

So an example would be
[What do I press and what does it do? ]
DD000000 00000240
D3000000 36468C4C
00000000 00000004
D0000000 00000000

for real plays on a US N3DS

L+Up, as for what it does, I believe it tricks the game into thinking you bought legit plays. I'm not entirely sure, I haven't used the code, so I can't really say.