I think I've got it programmed, I'll enable it if you are good with it; I figure it'll save you effort of people bugging you for codes.If you're not opposed, I can add a "Curt code" bit to my villager generator.
ROM Hack Discussion Animal Crossing: New Horizons -- Reverse Engineering, Glitches, Bugs, etc. thread!
- Thread starter DesuIsSparta
- Start date
- Views 1,861,411
- Replies 8,475
- Likes 35
Try this one for version 1.2.0:
Code:
[turnip buying at 1 and selling at 990]
04100000 AB2B0B38 00000001
04100000 AB2B0B44 000003DE
04100000 AB2B0B48 000003DE
04100000 AB2B0B4C 000003DE
04100000 AB2B0B50 000003DE
04100000 AB2B0B54 000003DE
04100000 AB2B0B58 000003DE
04100000 AB2B0B5C 000003DE
04100000 AB2B0B60 000003DE
04100000 AB2B0B64 000003DE
04100000 AB2B0B68 000003DE
04100000 AB2B0B6C 000003DE
04100000 AB2B0B70 000003DEEnjoy
I think I've got it programmed, I'll enable it if you are good with it; I figure it'll save you effort of people bugging you for codes.
Go for it.
Though AFAIK the last request was to change the amiibo used, not the villager received; changing the amiibo is a reasonably more complex change.
This is still a work in progress. I'm trying to grab pointer info from the currently selected villager on the Map app in the Nook phone to improve this but in the meantime, here's an eviction cheat:
X corresponds to a villager's index number. It can be 0 - 9. There's no good way to know which villager is which index (unless you load your save in NHSE but then you might as well use that to do the same thing). Some restrictions, only evict one villager a day. Activating them will have them in their packing stage and ready for someone from another town to invite them. They'll move out the next day and leave an empty plot ready for a camper or mystery island villager or villager from someone else's island.
If anyone can help with finding a pointer to villager data via the Map app on the Nook phone, hit me up, Values to look for:
Code:
[Evict Villager X]
400A0000 00000000 0000000X
780A2000 00012AB0
021A0000 AAEB0AF2 00000002
021A0000 AAEB0B24 00000001If anyone can help with finding a pointer to villager data via the Map app on the Nook phone, hit me up, Values to look for:
Code:
Villager 0: HEAP+0xAAE9EBF8
Villager 1: HEAP+0xAAEB16A8
Villager 2: HEAP+0xAAEC4158
Villager 3: HEAP+0xAAED6C08
Villager 4: HEAP+0xAAEE96B8
Villager 5: HEAP+0xAAEFC168
Villager 6: HEAP+0xAAF0EC18
Villager 7: HEAP+0xAAF216C8
Villager 8: HEAP+0xAAF34178
Villager 9: HEAP+0xAAF46C28Cool! And yeah, I saw that, but that wouldn't be too much harder for me to implement, I'd just need to make a big file correlating each villager with an offset from the base amiibo address. That can be a later thing. XD
Very nice!
Wouldn't the villager index simply be the order you invited them? Assuming you haven't had anyone leave quite yet.
The index doesn't shift. If you have 10 villagers, evict villager 2, then get an 11th villager the 11th villager becomes villager 2. After a few evictions and new people moving in it'd be impossible to remember who took who's spot.
Well, yes, but if you haven't kicked any people out yet it would just be in the original order you invited them. I placed their houses in order to visually help me remember the order they're in as well, but I guess most people probably didn't do that.
Given that the first two bytes are the species and variant, you could use a loop and a comparison to go through all the villagers and only evict a specific one defined in the code. Not as elegant as a code that allows you to select from the map, but easier to use and less error-prone than a code based on the index.
I thought of that but then you'd need to know the Species and variant of the character you want to evict which would just lead to everyone and their grandmother asking for an XXX or YYY evict code and we'd have 300+ cheats for to evict every villager.
I didn't find any pointers using the map, so instead I'm going to try searching for a talking pointer. Something like, hold L and talk to a villager to evict them.
I don't know the exact way that the walk thru walls cheat was created, but this is a patch in the exefs region.
You can dump your game's exeFS using nxdumptool or use any other tool to extract your game's contents, but if you want to work with exefs cheats, then you'll need to extract the game's update.
These are the files that will be stored in the exefs
More info on what each of these files does can be found here but a lot of the game's executable contents are going to be that main file.
If you try opening those files in a Hex editor, you'll see a bunch of garbage.
It's because those are the game's binaries, which is compiled code. The switch uses the arm64 instruction set for binaries, so you'll need to understand arm/arm64 in order to start looking at these files.
You'll then want to use an arm64 decompiler, which will take a computer program's binary, and converts it into somewhat readable code. A free one is ghidra and you can use this plugin in order to make decompiling switch binaries a LOT easier.
Another option would be IDA Pro. I think IDA Pro is a lot better to use, but it costs a ton of money. You can find a leak of it somewhere... don't ask me though
If you get IDA Pro, then I recommend you check out nx2elf in order to convert the binary into an .elf file. It will format the binary so that IDA (and probably Ghidra, I haven't used it though) will know what architecture (arm64) this binary is, and it'll help it label some symbols.
Once you finally load it into your decompiler, everything will still look extremely puzzling. This is where the noclip cheat patches
As you can see, the instruction listed there is
Code:
LDR W20, [X0,#0x1380]
PHP:
__int64 __fastcall sub_E95E40(__int64 a1)
{
unsigned int v1; // w20
__int64 v2; // x19
v1 = *(_DWORD *)(a1 + 4992);
v2 = a1;
if ( (unsigned int)((__int64 (*)(void))sub_EC0740)() != 21
&& (unsigned int)sub_EC0740(v2) != 38
&& (unsigned int)sub_EC0740(v2) != 39 )
{
if ( (*(_DWORD *)(v2 + 4072) | 1) == 3 && ((unsigned int)sub_EC0740(v2) == 67 || (unsigned int)sub_EC0740(v2) == 68) )
v1 = 5;
}
else if ( *(_DWORD *)(v2 + 4072) == 1 )
{
v1 = 0;
}
return v1;
}Which, if you either look at the game's binary in a hex editor would be
Don't trust HxD with just the main file alone, as the offsets don't line up... But this is what the offset would look like in memory, if main started at offset 0.
So you can see where the B9538014 came from. It's 14 80 53 B9 (what I have highlighted) backwards, as the Switch's CPU is little endian.
The patch that is written is 12800014 (14 00 80 12), which in arm64, is
Code:
MOV W20, #0xFFFFFFFFHow this was found originally? Reverse engineering. Either the original cheat creator knew how this function worked, or they probably were using a GDB debugger in order to put breakpoints on Animal Crossing, which I really can't figure out how to do that right now.
More information on how to reverse engineer Animal Crossing New Horizons can be found here , Ninji goes pretty in depth on there too, but he's a lot more experienced than me when it comes to reverse engineering, so you should try asking him if you have any more questions related to reverse engineering.
Hope this helps
The Cheats "Walking trough walls (Press L)" and "Speed Up (Press B)" don't work in the latest version. Anyone can help me please?
So it seems there still no free camera mod yet?
--------------------- MERGED ---------------------------
--------------------- MERGED ---------------------------
what version of the game are you on?
How to port exefs cheats to new updates?
You'll need to compare binaries.
I'll look at this cheat for example, because I happen to still have my 1.1.4 binary.
More info on how Atmosphere cheats work is here
But simply put, that cheat broken down means that it's patching 0xE7C920 in the game's binary.
is BD4F1E61, the original instruction.
This looks like it's setting up a parameter to set your velocity?
The Sx registers are floating point registers, and it looks like S1 might be your current velocity and S0 is force?
The psuedocode/C code would look something like this probably...
The path is writing
so instead of loading your current velocity, it's just telling that code that S1 is 3.0, when your normal velocity goes up to 1.0, so it'll just set your velocity to 3.0 - S0.
I'm just explaining how this function works. It's good to know what a exeFS cheat does before trying to port it.
Now onto porting it.
This should be really simple. IDA has a binary search, so go to where the offset of this instruction is on the update's binary file in the hex editor, highlight some bytes, copy it, and do a binary search on the new update's binary.
Each arm64 instruction is 32 bytes long, so you'll probably want to highlight at least 64 byes
You'll then do a binary search on the new update's exeFS to find any bytes. I couldn't find anything, so what must've happened is the function must've been rewritten, or Nintendo changed something that was in that class, so the code was recompiled... Which means that different registers must've been used.
That's no problem. This is why you need to understand how some of the game's code works. If you go to around this area in the exeFS, you should try looking for a function that looks like this:
If you remember earlier, that was how the game handled force?
Well that's a pretty simple function to search for.
You can either do a binary search of that function, or try looking around the exeFS for that function.
I ended up doing a binary search, and ended up finding the offset of this function!
So this should be the offset of the new code
Main + 0xF06FA8
As you can see, the instruction was changed from
to
so it seems like where the game reads the velocity has changed a little.
That's no problem. The hexadecimal representation of this instruction is
BD4F9661 (61 96 4F BD)
Theoretically, this cheat should work:
You'll need to compare binaries.
I'll look at this cheat for example, because I happen to still have my 1.1.4 binary.
Code:
[Movement Speed x3 (Hold B)]
04000000 00E7C920 BD4F1E61 // Writes 0xBD4F1E61 to MAIN + E7C920
80000002 // If B is pressed
04000000 00E7C920 1E211001 // Writes 0x1E211001 to MAIN + E7C920
20000000More info on how Atmosphere cheats work is here
But simply put, that cheat broken down means that it's patching 0xE7C920 in the game's binary.
Code:
LDR S1, [X19,#0xF1C]This looks like it's setting up a parameter to set your velocity?
The Sx registers are floating point registers, and it looks like S1 might be your current velocity and S0 is force?
The psuedocode/C code would look something like this probably...
PHP:
float s1 = *(float*) *playerVelocity + 0xF1C;
float s0 = *force; // ? don't know if this is true or not, but thats what it looks like
if (s1 == s10)
{
s0 = s1 - s0;
if (s0 == s10)
// other code I don't feel like explaining
}
Code:
FMOV S1, #3.0I'm just explaining how this function works. It's good to know what a exeFS cheat does before trying to port it.
Now onto porting it.
This should be really simple. IDA has a binary search, so go to where the offset of this instruction is on the update's binary file in the hex editor, highlight some bytes, copy it, and do a binary search on the new update's binary.
Each arm64 instruction is 32 bytes long, so you'll probably want to highlight at least 64 byes
You'll then do a binary search on the new update's exeFS to find any bytes. I couldn't find anything, so what must've happened is the function must've been rewritten, or Nintendo changed something that was in that class, so the code was recompiled... Which means that different registers must've been used.
That's no problem. This is why you need to understand how some of the game's code works. If you go to around this area in the exeFS, you should try looking for a function that looks like this:
Code:
loc_E7C944 ; CODE XREF: sub_E7C490+49C↑j
.text:0000000000E7C944 B.LE loc_E7C96C
.text:0000000000E7C948 FSUB S0, S1, S0
.text:0000000000E7C94C FCMP S0, S10
.text:0000000000E7C950 CSET W8, LS
.text:0000000000E7C954 FCMP S1, S0Well that's a pretty simple function to search for.
You can either do a binary search of that function, or try looking around the exeFS for that function.
I ended up doing a binary search, and ended up finding the offset of this function!
So this should be the offset of the new code
Main + 0xF06FA8
As you can see, the instruction was changed from
Code:
LDR S1, [X19,#0xF1C]
Code:
LDR S1, [X19,#0xF94]That's no problem. The hexadecimal representation of this instruction is
BD4F9661 (61 96 4F BD)
Theoretically, this cheat should work:
Code:
[Movement Speed x3 (Hold B)]
04000000 00F06FA8 BD4F9661
80000002
04000000 00F06FA8 1E211001
20000000One final thing to add!
You can change the exeFS on the fly while using NoExes.
On the main tab in Noexes, you'll see a whole bunch of "pools" of memory.
If you right click on the one called main, and click on the dissembler part, it'll load you at offset 0 in the game's binary.
Because of ASLR, this offset will always be different, so you'll need to do this every time you reboot your game.
From there, you can use Windows calculator in programmer mode, or you can just google main start address + offset in exefs that you want to patch like this:
And then plug that into the dissembler part,
It'll give you a decompiled look at what the game's code looks like at that address.
If you select the address, you can then change the instruction that you want and click assemble, and it will patch that offset for you.
In this video, I showcase that speed cheat I just ported, but in different speeds.
So yeah, I hope this helps you understand how those cheats work
@macserv or to anyone else who's curious on how it works.
You can change the exeFS on the fly while using NoExes.
On the main tab in Noexes, you'll see a whole bunch of "pools" of memory.
If you right click on the one called main, and click on the dissembler part, it'll load you at offset 0 in the game's binary.
Because of ASLR, this offset will always be different, so you'll need to do this every time you reboot your game.
From there, you can use Windows calculator in programmer mode, or you can just google main start address + offset in exefs that you want to patch like this:
And then plug that into the dissembler part,
It'll give you a decompiled look at what the game's code looks like at that address.
If you select the address, you can then change the instruction that you want and click assemble, and it will patch that offset for you.
In this video, I showcase that speed cheat I just ported, but in different speeds.
So yeah, I hope this helps you understand how those cheats work
@macserv or to anyone else who's curious on how it works.
- No one is chatting at the moment.
-
-
-
-
@
Sonic Angel Knight:
Or, I also heard that if you use flash memory, it can act as more "RAM" at least windows tell me when I stick a flash drive into it. -
-
-
-
-
-
-
-
-
-
-
-
-
-
-
@
K3Nv2:
I can think of the design teams process another joystick and no audio or a joystick and mono audio -
-
-
-
-
-
