Hacking Badge Arcade Cheating with Gateway

[Woody8275]

YEEEESSSS IT finally works

 

[WallK]

That's strange. So this is exactly what you entered? write(0x3286AD3C, (0x04, 0x00, 0x00, 0x00, 0x20), pid=0x??) With your PID of course. I would help you test other things but I don't have an EU 3ds unfortunately.

If you are using Animal Crossing: New Leaf then the pname is GARDEN. Sorry if that wasn't clear. The PIDs aren't always the same so you need to use your own.

write(0x3286AD3C, (0x04, 0x00, 0x00, 0x00, 0x20), pid=0x29)
I have EU N3DS actually. If you can help put breaking N3DS EU GW code for this tool I'll be ethernally grateful

 

[naddel81]

Can I get that cheat app as cia for rxtools somehow?

 

[WallK]

Got it! EU N3DS
write(0x3646AD3C, (0x04, 0x00, 0x00, 0x00, 0x20), pid=0x**)
https://gbatemp.net/threads/badge-arcade-cheating-with-gateway.407588/page-15#post-5953368Used address from this post

 

[Splosionz]

write(0x3286AD3C, (0x04, 0x00, 0x00, 0x00, 0x20), pid=0x29)
I have EU N3DS actually. If you can help put breaking N3DS EU GW code for this tool I'll be ethernally grateful

3286AD3C is for an EU o3ds so that's why it didn't work for you.

Can I get that cheat app as cia for rxtools somehow?

NTR CFW is available >here< and installs with a CIA and is compatible with rxtools.

Got it! EU N3DS
write(0x3646AD3C, (0x04, 0x00, 0x00, 0x00, 0x20), pid=0x**)
Used address from this post

So you got it to work?

YEEEESSSS IT finally works

Excellent!

 

[Woody8275]

you need to use ntr cia and NTR CFW's debugger

Can I get that cheat app as cia for rxtools somehow?

 

[WallK]

So you got it to work?

Yeah! I think addresses gonna change tomorrow, so I need to win all I can today (:

 

[Splosionz]

Yeah! I think addresses gonna change tomorrow, so I need to win all I can today (:

That's great! Glad you got it figured out.

These should all work then if anyone needs them.

Unlock Catcher - NTR Debugger (Sets your plays to 5 regardless of how many you had before)

US N3DS:
write(0x36468C3C, (0x04, 0x00), pid=0x**)

US O3DS:
write(0x32868C3C, (0x04, 0x00), pid=0x**)

EU N3DS:
write(0x3646AD3C, (0x04, 0x00), pid=0x**)

EU O3DS:
write(0x3286AD3C, (0x04, 0x00), pid=0x**)

JP N3DS
write(0x36469ABC, (0x04, 0x00), pid=0x**)

 

[jon2491]

That's great! Glad you got it figured out.

These should all work then if anyone needs them.

Unlock Catcher - NTR Debugger

US N3DS:
write(0x36468C3C, (0x04, 0x00, 0x00, 0x00, 0x20), pid=0x**)

US O3DS:
write(0x32868C3C, (0x04, 0x00, 0x00, 0x00, 0x20), pid=0x**)

EU N3DS:
write(0x3646AD3C, (0x04, 0x00, 0x00, 0x00, 0x20), pid=0x**)

EU O3DS:
write(0x3286AD3C, (0x04, 0x00, 0x00, 0x00, 0x20), pid=0x**)

JP N3DS
write(0x36469ABC, (0x04, 0x00, 0x00, 0x00, 0x20), pid=0x**)

EU O3DS worked!!
Now is there any way to change from 5 to 99 plays?

 

[KaleoOmega]

That's great! Glad you got it figured out.

These should all work then if anyone needs them.

Unlock Catcher - NTR Debugger

US N3DS:
write(0x36468C3C, (0x04, 0x00), pid=0x**)

US O3DS:
write(0x32868C3C, (0x04, 0x00), pid=0x**)

EU N3DS:
write(0x3646AD3C, (0x04, 0x00), pid=0x**)

EU O3DS:
write(0x3286AD3C, (0x04, 0x00), pid=0x**)

JP N3DS
write(0x36469ABC, (0x04, 0x00), pid=0x**)

US O3DS worked too! Fantastic, thank you @Splosionz

Now is there any way to change from 5 to 99 plays?

My thoughts exactly

 

[justinbug2]

how does it work

--------------------- MERGED ---------------------------

where do i find my pid

 

[Splosionz]

EU O3DS worked!!
Now is there any way to change from 5 to 99 plays?

Can someone test if these work for me? You need to have at least one play when you write them and they won't update until you use one of your plays.

99 Plays - NTR Debugger

US N3DS:
write(0x36468C4C, (0x64, 0x00), pid=0x**)

US O3DS:
write(0x32868C4C, (0x64, 0x00), pid=0x**)

EU N3DS:
write(0x3646AD4C, (0x64, 0x00), pid=0x**)

EU O3DS:
write(0x3286AD4C, (0x64, 0x00), pid=0x**)

JP N3DS
write(0x36469ACC, (0x64, 0x00), pid=0x**)

 

[justinbug2]

004000000153500 if my pid is this how do i make it into a 0x*

 

[KaleoOmega]

Can someone test if these work for me? You need to have at least one play when you write them and they won't update until you use one of your plays.

99 Plays - NTR Debugger

US N3DS:
write(0x36468C4C, (0x64, 0x00), pid=0x**)

US O3DS:
write(0x32868C4C, (0x64, 0x00), pid=0x**)

EU N3DS:
write(0x3646AD4C, (0x64, 0x00), pid=0x**)

EU O3DS:
write(0x3286AD4C, (0x64, 0x00), pid=0x**)

JP N3DS
write(0x36469ACC, (0x64, 0x00), pid=0x**)

Working perfectly for US O3DS

 

[justinbug2]

Working perfectly for US O3DS

can you msg me how u got it working?

 

[KaleoOmega]

can you msg me how u got it working?

It's simple, but in short, follow this tutorial from the last page: http://gbatemp.net/threads/badge-arcade-cheating-with-gateway.407588/page-18#post-5959216 )

 

[justinbug2]

i read that didnt help me at all

 

[Splosionz]

004000000153500 if my pid is this how do i make it into a 0x*

That's the title id not the pid. Are you using the NTRClient I posted?

Working perfectly for US O3DS

Great! Thanks for letting me know!

 

[justinbug2]

That's the title id not the pid. Are you using the NTRClient I posted?

Great! Thanks for letting me know!

yes but i dont know how to use it or get the pid

--------------------- MERGED ---------------------------

Unable to read data from the transport connection: A blocking operation was interrupted by a call to WSACancelBlockingCall

--------------------- MERGED ---------------------------

ok i got it all working when do i paste ths write(0x32868C4C, (0x64, 0x00), pid=0x2c) in?

--------------------- MERGED ---------------------------

also how do i actually get in the badge center wont let me

--------------------- MERGED ---------------------------

That's great! Glad you got it figured out.

These should all work then if anyone needs them.

Unlock Catcher - NTR Debugger

US N3DS:
write(0x36468C3C, (0x04, 0x00), pid=0x**)

US O3DS:
write(0x32868C3C, (0x04, 0x00), pid=0x**)

EU N3DS:
write(0x3646AD3C, (0x04, 0x00), pid=0x**)

EU O3DS:
write(0x3286AD3C, (0x04, 0x00), pid=0x**)

JP N3DS
write(0x36469ABC, (0x04, 0x00), pid=0x**)

what does unlock catcher do

 

[Splosionz]

1. Enter the command connect('192.168.1.182', 8000) into NTRClient but using your 3ds' IP in place of mine to connect to your 3ds.
2. Run Badge Arcade from your 3ds
3. After the Badge Arcade has finished loading enter the command listprocess() and look for "pname: CENTER". to the left of that is the pid. Mine shows this, "pid: 0x00000038" meaning my pid is 0x38.
4. After finding the pid you can then go into the Badge Catcher and enter one of the write commands I posted. I have an O3DS so I would enter
write(0x32868C4C, (0x64, 0x00), pid=0x38).

what does unlock catcher do

Unlock Catcher sets your plays to 5 regardless of how many you had before.