Hacking Gateway Code Creation Question

[bluedart]

Hello, first-time posting on GBATemp, although I've been lurking for years. (I honestly thought I had an account already, but apparently not!)

Anyway, I've had a Gateway for about three years now and I've just started jumping into code creation recently. I've been playing Pokémon Moon and managed to figure out how to use Gateway's in-game-menu to find and edit memory addresses, which I've been having some decent fun with. After successfully finding and changing some things in game, I'm a bit confused as to how to properly convert them into Gateway codes that work instead of just freezing the game.

I decided to start messing with the Festival Plaza and FC to see if I could. Finding and modifying on-hand FC and total collected FC worked pretty quickly, which surprised me a bit. I also managed to find values for things like Poké Beans in Poké Pelago as well as the byte used to store the amount of scan power remaining in the QR Scanner. (Which ranges from 0-200, at 20 per scan.) Of course those values just reset immediately for whatever reason, so I don't think I can use those for anything. I also found the value for Island Scan Points, and managed to set it to 100, which could be useful. Of course, I still need to figure out how to turn these into actual codes and not just memory locations. I gleamed some info from the guide here, but after all was said and done I still wasn't able to get these codes working. I tried adding the obligatory 'end code' to them just in case, but it didn't do anything. (D2000000 00000000). I also tried changing the first hex on the single-byte code (the scan points one) to 1, which also just crashed. If anyone can help me with this I'd appreciate it.

For anyone who's curious, the 'codes' (the ones that don't work) are right here:

Spoiler

[100,000 FC]
33124D58 000186A0
D2000000 00000000

[500,000 Total Earned FC]
33124D5C 0007A120
D2000000 00000000

[500 Pokepelago Beans]
31443740 000001F4
D2000000 00000000

[Full 10 QR scans]
3039A93C 000000C8
3039A940 000000C8
D2000000 00000000

[100 Island Scan Points]
3313EF33 00000064
D2000000 00000000

My setup is as follows:

Spoiler

Old 3DS (Launch)
SysNAND: 4.1.0-8U
EmuNand: GW3D 11.2.0-35U

SysNAND and EmuNand are unlinked. Gateway is run via the old DS profile exploit.

Pokémon Moon was installed to EmuNAND via encrypted CIA.

 

[DarkFlare69]

The codetypes drop the first digit of the address. For the first one, it thinks your address is "03124D58" and you're doing an "if less than".

The proper way would be to set the starting address to whatever the first digit in your address is followed by 7 0's:
D3000000 30000000
03124D58 00186A0
D2000000 00000000

This shouldn't freeze. Follow this format for all of your codes. If you want, post them here when you're done and I can see if they're right or not

 

[NazoXIII]

Poke Pelago beans is a bit weird, I myself have been trying for days and it seems like no matter what you do to change the value, it stays exactly what it is.
For example, If I tried to change the Pattern Beans, upon leaving the gateway cheat menu, it goes right back to what it was. It also appears to be a pointer code.

 

[Quantumcat]

Poke Pelago beans is a bit weird, I myself have been trying for days and it seems like no matter what you do to change the value, it stays exactly what it is.
For example, If I tried to change the Pattern Beans, upon leaving the gateway cheat menu, it goes right back to what it was. It also appears to be a pointer code.

It might be being calculated from something else

 

[bluedart]

Thank you for the replies. I've managed to get the codes working, at least mostly. The FC codes work properly, as well as the Island Scan code. In addition, I found out how Poké Beans are calculated and stored. Apparently they're all stored in 15 separate bytes for the individual beans themselves, and the product of these values is simply used in Poké Pelago. I managed to make a code that sets all of these values to 99 and it seems to be working properly. As far as the QR scans are concerned I'm not quite sure how they seem to work. The code that locks the byte value to the max of 200 does indeed keep a full 10 scans shown on the top screen, but it doesn't allow additional scans after 10 to occur.

Here are the complete codes for anyone interested.

Spoiler

[250,000 FC]
D3000000 30000000
03124D58 0003D090
D2000000 00000000

[500,000 Total Earned FC]
D3000000 30000000
03124D5C 0007A120
D2000000 00000000

[100 Island Scan Points]
D3000000 30000000
2313EF33 00000064
D2000000 00000000

[99 of All Poke Beans]
D3000000 30000000
C0000000 0000000F
23115490 00000063
DC000000 00000001
20000000 00000063
D1000000 00000000
D2000000 00000000

[Full 10 QR Scans (Shown Only)]
D3000000 30000000
2039A93C 000000C8
D2000000 00000000

On a side note, it takes all of 3 Rainbow Beans to max out a Pokémon's affection in Pokémon Refresh, so that's neat.

 

[Quantumcat]

Thank you for the replies. I've managed to get the codes working, at least mostly. The FC codes work properly, as well as the Island Scan code. In addition, I found out how Poké Beans are calculated and stored. Apparently they're all stored in 15 separate bytes for the individual beans themselves, and the product of these values is simply used in Poké Pelago. I managed to make a code that sets all of these values to 99 and it seems to be working properly. As far as the QR scans are concerned I'm not quite sure how they seem to work. The code that locks the byte value to the max of 200 does indeed keep a full 10 scans shown on the top screen, but it doesn't allow additional scans after 10 to occur.

Here are the complete codes for anyone interested.

Spoiler

[250,000 FC]
D3000000 30000000
03124D58 0003D090
D2000000 00000000

[500,000 Total Earned FC]
D3000000 30000000
03124D5C 0007A120
D2000000 00000000

[100 Island Scan Points]
D3000000 30000000
2313EF33 00000064
D2000000 00000000

[99 of All Poke Beans]
D3000000 30000000
C0000000 0000000F
23115490 00000063
DC000000 00000001
20000000 00000063
D1000000 00000000
D2000000 00000000

[Full 10 QR Scans (Shown Only)]
D3000000 30000000
2039A93C 000000C8
D2000000 00000000

On a side note, it takes all of 3 Rainbow Beans to max out a Pokémon's affection in Pokémon Refresh, so that's neat.

If you do research into this stuff for different games and different items maybe make a webpage or new post about it so people can link to when people ask about Gateway codes or the memory structure of different games.

 

[NazoXIII]

It might be being calculated from something else

Yeah, I can see that now, the game seems to constantly check/compare the sum of the Poke Refresh Beans value then sets it to the Poke Pelago beans address. That's actually pretty clever, it keeps you from just changing the Pelago bean value because it'll just check the total sum again and undo your work.

That's pretty eye opening, I wonder if anything else in the game does that, maybe Items perhaps, I don't doubt nintendo wouldn't want us messing with item quantities, wouldn't want 999x Gold Bottle cap codes running amok.

 

[Quantumcat]

Yeah, I can see that now, the game seems to constantly check/compare the sum of the Poke Refresh Beans value then sets it to the Poke Pelago beans address. That's actually pretty clever, it keeps you from just changing the Pelago bean value because it'll just check the total sum again and undo your work.

That's pretty eye opening, I wonder if anything else in the game does that, maybe Items perhaps, I don't doubt nintendo wouldn't want us messing with item quantities, wouldn't want 999x Gold Bottle cap codes running amok.

I ran into this trying to cheat at Pocket Card Jockey - the hearts at the end of each race weren't manipulable :-(

 

[NazoXIII]

I ran into this trying to cheat at Pocket Card Jockey - the hearts at the end of each race weren't manipulable :-(

And coincidentally, Game Freak made that game too. Looks like they aren't messing around anymore, they're doubling down on their anti cheating measures.
Unfortunately for them that just makes things more interesting.

 

[Quantumcat]

And coincidentally, Game Freak made that game too. Looks like they aren't messing around anymore, they're doubling down on their anti cheating measures.
Unfortunately for them that just makes things more interesting.

 

[bluedart]

Yeah, I can see that now, the game seems to constantly check/compare the sum of the Poke Refresh Beans value then sets it to the Poke Pelago beans address. That's actually pretty clever, it keeps you from just changing the Pelago bean value because it'll just check the total sum again and undo your work.

That's pretty eye opening, I wonder if anything else in the game does that, maybe Items perhaps, I don't doubt nintendo wouldn't want us messing with item quantities, wouldn't want 999x Gold Bottle cap codes running amok.

Yeah, I couldn't have made the code without knowing that. Actually, I'm fairly certain they only did this because it's more efficient, not to screw with the very niche minority that has access to these kinds of things. Either way I ended up resetting after getting that code to work because I didn't really want infinite beans on my save file; I was honestly just curious. Poké Pelago is a neat little diversion every few hours, whereas the Festival Plaza is already so boring that I wanted to cheat just to move it along. Incidentally bright navy blue is an amazing dye color.

Anyway, the only other thing I'd really like to know right now is what determines whether or not you have any QR scans remaining, since I've only managed to find the visual representation of that and not whatever actually controls it. Hopefully it's not a single byte that's changing from 1 to 0 or something. That would suck to find. At the moment I kinda just want to continue playing the game, I'm only just past the part where you get Mudsdale.

 

[NazoXIII]

Yeah, I couldn't have made the code without knowing that. Actually, I'm fairly certain they only did this because it's more efficient, not to screw with the very niche minority that has access to these kinds of things. Either way I ended up resetting after getting that code to work because I didn't really want infinite beans on my save file; I was honestly just curious. Poké Pelago is a neat little diversion every few hours, whereas the Festival Plaza is already so boring that I wanted to cheat just to move it along. Incidentally bright navy blue is an amazing dye color.

Anyway, the only other thing I'd really like to know right now is what determines whether or not you have any QR scans remaining, since I've only managed to find the visual representation of that and not whatever actually controls it. Hopefully it's not a single byte that's changing from 1 to 0 or something. That would suck to find. At the moment I kinda just want to continue playing the game, I'm only just past the part where you get Mudsdale.

Sounds like that's gonna be a royal pain.
I tried my hand at it, figured to start with an unsigned 16 bit search just in case, and after an hour of less than and greater than searches I honestly lost motivation. It really emphasizes the Gateway's lack of searching for other data types... I wouldn't mind being able to search for floats, I'm sure that's what it uses for it.

 

[bluedart]

Okay, so more progress has been made. Not necessarily toward what I wanted, but I did manage to find some other neat things.

I made some codes to control the amount of turns remaining in the battle cafe thing for whatever reason. I also added some button combos to them, mostly to test that I could make codes that way. This is sort of fun. I also made a code for BP since getting it is a royal pain without well-bred Pokémon, and you need to purchase the Destiny Knot for 48 BP to get them. It's a real catch-22.

Spoiler

[5000 BP]
D3000000 30000000
030D90D8 00001388
D2000000 00000000

[L+B to Refill Turns (Cafe)]
DD000000 00000202
D3000000 30000000
230D6EC2 00000000
D2000000 00000000

[L+A to Empty Turns (Cafe)]
DD000000 00000201
D3000000 30000000
230D6EC2 0000000A
D2000000 00000000

And of course, here's some stuff that doesn't work. So I remember playing HGSS a while back and there was only one code I used when I played it. It was the one where you could hold L to view IVs and hold R to view EVs on the summary screen. I started by finding where the values for the pokemon you're currently viewing when you select pokemon on the bottom screen and view your active party. That didn't take too long actually, but unfortunately... Well, changing these values doesn't change what is shown on screen, so I can't seem to progress past this point. Also, I spent a few hours trying to find where IVs and EVs are stored. The only thing I found out is they are not stored as the actual values, which is unfortunate. Any help here would be massively appreciated.

Spoiler

[Stats Show 99 In Summary]
D3000000 30000000
C0000000 00000006
204CDF90 00000063
DC000000 00000004
20000000 00000063
D1000000 00000000
D2000000 00000000

Okay, one last thing. I was messing around and found where some of the values for items are stored. Interestingly enough there's some crazy bitwise shenanigans going on here. A bit confusing since one of the 4 bytes always seems to be 0, but at least I seem to have found where this information is stored. Turns out they use 4 bytes to store one item slot in your inventory, and only use 3 of those. The first byte controls only what the item is, and the second and third bytes control both what the item is and how much of it there is. This number is in multiples of 4 to accommodate their bitwise shenanigans, which is why anyone looking for exact numbers in item count wouldn't have found them.

I didn't really bother with this once I figured out how it worked, since PKHex can do a much better job of this than a code can, but here's the memory location for slot 35 of the Item pocket if anyone is interested: 330D59BC.