Hacking [Release] NTR Debugger 2 (with source) - the first public real-time debugger for N3DS

[xflamer234]

The Readme file is still the old version. Try bpadd/bpena/bpdis/resume commands.

anytime when i create a cheat plugin it does not work on my 3ds what do i do and can you also show me how do i convert gateway cheats to ntr

 

[Nanquitas]

Most of the gateway code works directly on ntr as they both use virtual memory.
If you up your source file i'll help you find out why it's not working .

 

[RandomUser]

I have been wanting to try out the breakpoint feature of this debugger however I am meet with this:

svc_controlMemory failed: c860180amapRemoteMemory failed: c860180a
protectRemoteMemory failed: d8e007f5
will listen at port 5041

This happens when I try to attach to a Process where a game resides in. Although not sure if I am even doing this properly.

 

[gamer4lif3]

how would i write a code like this in debugger or u cant?

6056B58C 00000000
B056B58C 00000000
50000000 0000FF00
20000090 000000C8
D2000000 00000000

 

[Nanquitas]

What kind of code is that ? Gateshark ?

--------------------- MERGED ---------------------------

I have been wanting to try out the breakpoint feature of this debugger however I am meet with this:

svc_controlMemory failed: c860180amapRemoteMemory failed: c860180a
protectRemoteMemory failed: d8e007f5
will listen at port 5041

This happens when I try to attach to a Process where a game resides in. Although not sure if I am even doing this properly.

What command did you send ?

 

[gamer4lif3]

if u ment me ya its a gateshark code for lego marvel avengers

 

[Nanquitas]

ok.
If you send this:

write(0x0056B61C, (0xC8, 0x00, 0x00, 0x00), pid=0xXX)

it should work if it's the right address. Of course you need to change the XX by the pid of your game

Also be careful as there are no verification from the original code so (you can do it manually by reading the address 0x0056B58C, seems like you need to find 00FF).

 

[gamer4lif3]

hmm didnt work so maybe that gateshark code is wrong. Is this how u read address? got this error when i did the data read address

data(0x0056B58C, 0x0056B58C, filename='data.bin', pid=0x29)null rtCheckRemoteMemoryRegionSafeForWrite failed: d8e007f5

 

[Nanquitas]

Replace the YY by the length (in bytes) you want to read and the XX by the pid.

data(0x0056B58C, YY, pid=0xXX)

ex:

data(0x0056B58C, 4, pid=0x29

 

[DesuIsSparta]

Replace the YY by the length (in bytes) you want to read and the XX by the pid.

data(0x0056B58C, YY, pid=0xXX)

ex:

data(0x0056B58C, 4, pid=0x29

And don't forget to add 1400000 as that address is so low, if you write to that address you're very likely to crash the game. The game's core functions are stored in the earlier bytes, whereas gamedata is stored way later.

 

[Nanquitas]

Not necessarily, often yes as the last region is bigger but i have some code working that are in those kind of address.

--------------------- MERGED ---------------------------

Ah... I know why you think it's not working, it's an unlimited life code.
You can't freeze a value through the debugger, means that every time your life is low, if you send this code you should have full life again but it can't give you the godmode status.

But, you can with a cheat plugin.
I made this one fast and i didn't test it as i don't have the game.
Try it and tell me if it works.

It's a conversion of the codes from Fort42, the usa version.

 

[gamer4lif3]

the max studs 1 works THanks

the unlimited health don't work

 

[Nanquitas]

I'll check my code.

--------------------- MERGED ---------------------------

Okay, i messed up with the pointer address.
Now it should work.

 

[gamer4lif3]

I'll check my code.

--------------------- MERGED ---------------------------

Okay, i messed up with the pointer address.
Now it should work.

thanks!!! all is working woot.

 

[Nanquitas]

Great, Have Fun

 

[RandomUser]

What command did you send ?

Sorry for late reply, I issued this command

attachprocess(0x29)

and that brings up the aforementioned error.
Tried this:

attachprocess(pid=0x29)

doesn't do anything
I guess you have to attach the debugger to the process as a first step to breakpoints a code?
Edit: I have tried this command:

ttachprocess(pid=29)

and it seems to attach:

buf: 07001000, size: 0000e000
recommend pc:
001403cc
recommend lr:
00101759
remotePC: 001403cc
will listen at port 5029

Not sure what to do from here, although I did tried the command "bpadd(0x16D32EC4)" and that dreaded memory error occur.

freeid: 1
rtCheckRemoteMemoryRegionSafeForWrite failed :d8e007f5
init breakpoint failed.

To bad there is no tutorial on how to use breakpoint or it's command set.

 

[Fishguy6564]

Sorry for late reply, I issued this command

attachprocess(0x29)

and that brings up the aforementioned error.
Tried this:

attachprocess(pid=0x29)

doesn't do anything
I guess you have to attach the debugger to the process as a first step to breakpoints a code?
Edit: I have tried this command:

ttachprocess(pid=29)

and it seems to attach:

buf: 07001000, size: 0000e000
recommend pc:
001403cc
recommend lr:
00101759
remotePC: 001403cc
will listen at port 5029

Not sure what to do from here, although I did tried the command "bpadd(0x16D32EC4)" and that dreaded memory error occur.

freeid: 1
rtCheckRemoteMemoryRegionSafeForWrite failed :d8e007f5
init breakpoint failed.

To bad there is no tutorial on how to use breakpoint or it's command set.

I believe breakpoints are only compatible with the memory region that contains the game's code.bin since that's where majority of the asm is stored.

 

[RandomUser]

I believe breakpoints are only compatible with the memory region that contains the game's code.bin since that's where majority of the asm is stored.

I think that explains why I am unsuccessful at breakpoints. Would converting the code from NTR to ARcodes work, Then breakpoint from that?
Although come to think of it, I don't think it is possible to do just that as the 0x16D32EC4 is too big to fit in the memory range after subtracting 0x14000000 from 0x16D32EC4 = 0x02D32EC4
here's the ranges from NTR:
00100000 - 006befff , size: 005bf000
08000000 - 081fffff , size: 00200000
0ffc0000 - 10000fff , size: 00041000
10002000 - 10002fff , size: 00001000
14000000 - 17800fff , size: 03801000

 

[DesuIsSparta]

I think that explains why I am unsuccessful at breakpoints. Would converting the code from NTR to ARcodes work, Then breakpoint from that?
Although come to think of it, I don't think it is possible to do just that as the 0x16D32EC4 is too big to fit in the memory range after subtracting 0x14000000 from 0x16D32EC4 = 0x02D32EC4
here's the ranges from NTR:
00100000 - 006befff , size: 005bf000
08000000 - 081fffff , size: 00200000
0ffc0000 - 10000fff , size: 00041000
10002000 - 10002fff , size: 00001000
14000000 - 17800fff , size: 03801000

Unfortunately sometimes, like you said, the subtraction method doesn't work because your resulting offset is still out of range. What I do in that situation is either try the memory range below the last, or try to find the code myself. I wish there was an easier way, and there might be, but I don't know of one.

 

[Mr.???]

u