Disney Dreamlight Valley [0100D39012C1A000]

D4M28 · Mar 9, 2026

yanling said:
Disney Dreamlight Valley v1.21.0 BID=45FD4E5B488E96F6

Hi all, update of @morarin code using code updater, this is what i get, not all code are tested.

This is 1st time I try to used code updater, any code issue please report & discuss here

Reminder: Before using any cheat codes, be sure to back up your save data. You use cheat codes at your own risk.

Great thanks for the codes just seems the master code doesn't seem to like the game it crashes the game very quick but thank you for trying and thank you for the codes

ChicagoMel · Mar 14, 2026

D4M28 said:
Great thanks for the codes just seems the master code doesn't seem to like the game it crashes the game very quick but thank you for trying and thank you for the codes

Yeah I have the same issue

pspmaster · Mar 28, 2026

morarin said:
It seems il2CppDumper doesn't support the latest version of this game. This makes it extremely difficult for me to create new cheat codes. While I can continue updating existing cheat codes, I'll have to halt work on several new ones I was trying. However, I'm not giving up on creating new cheat codes. Even though I have no programming experience whatsoever, I'm planning to learn from scratch and attempt to update il2CppDumper myself. Honestly, that's a pretty unrealistic goal for me right now, and even if I succeed, it'll likely take a very long time, so please keep your expectations tempered.

many tools can extract the main file from the latest UPD.nsp or UPD.nsz file. for instance the NSGame Manager 13.3.3.22ff or use zzpong cheat code updater . both of the two tools need latest prod.keys file to open latest .nsp or .nsz (22.0.0 or 21.2.0)

D4M28 · Mar 28, 2026

pspmaster said:
many tools can extract the main file from the latest UPD.nsp or UPD.nsz file. for instance the NSGame Manager 13.3.3.22ff or use zzpong cheat code updater . both of the two tools need latest prod.keys file to open latest .nsp or .nsz (22.0.0 or 21.2.0)

We appreciate all you will do thanks for trying we all appreciate it

D4M28 · Apr 14, 2026

Did anyone figure out just the energy from stop going down just needed that one really

biggalactus · May 18, 2026

Anyone get these to work

D4M28 · May 18, 2026

biggalactus said:
Anyone get these to work

Still waiting like you mate

morarin · 2026-06-04T07:30:14+0100

Hello everyone, again

It has been a while. As I mentioned in my previous post, I had completely stepped away from the game. However, the recent update on June 3rd caught my attention, and I decided to boot up Disney Dreamlight Valley for the first time in a long while. To my surprise, it was incredibly relaxing and turned out to be exactly the kind of rest I needed.

To play the game more casually, I generated some codes for myself. At the same time, I noticed that no one had taken over sharing codes since my departure. It honestly made me feel bad to see that the gaming experience had significantly dropped for many of you who used to enjoy the game with them. Because of this, I felt the desire to start sharing my codes with you all again.

So, I am officially lifting my hiatus. To ensure I don't push myself too hard and can maintain a healthy balance, I will only share codes when I have the spare time.

If you wish to use my codes moving forward, please accept the following ground rules:

No guarantee for every version: If I don't have time, I will simply skip updating for that version.
No hotfix updates: I generally will not update codes for minor patches (where the main version number doesn't change).
Priority on low-maintenance codes: My priority will always be codes that can be updated automatically or require very little effort.
Complex codes come last: I will only release the "Unlock All" or "Vanellope" codes if I have extra time.
Longer wait times: Please do not expect updates within a few days of a patch like before.
Radio silence: When I am busy, I will likely go off the grid and be completely unreachable.

I am glad to be back and sharing what I can. I hope my codes help you enjoy the game to the fullest once again!

weilai · 2026-06-04T07:41:26+0100

morarin said:
Hello everyone, again

It has been a while. As I mentioned in my previous post, I had completely stepped away from the game. However, the recent update on June 3rd caught my attention, and I decided to boot up Disney Dreamlight Valley for the first time in a long while. To my surprise, it was incredibly relaxing and turned out to be exactly the kind of rest I needed.

To play the game more casually, I generated some codes for myself. At the same time, I noticed that no one had taken over sharing codes since my departure. It honestly made me feel bad to see that the gaming experience had significantly dropped for many of you who used to enjoy the game with them. Because of this, I felt the desire to start sharing my codes with you all again.

So, I am officially lifting my hiatus. To ensure I don't push myself too hard and can maintain a healthy balance, I will only share codes when I have the spare time.

If you wish to use my codes moving forward, please accept the following ground rules:

No guarantee for every version: If I don't have time, I will simply skip updating for that version.

No hotfix updates: I generally will not update codes for minor patches (where the main version number doesn't change).

Priority on low-maintenance codes: My priority will always be codes that can be updated automatically or require very little effort.

Complex codes come last: I will only release the "Get All" or "Vanellope" codes if I have extra time.

Longer wait times: Please do not expect updates within a few days of a patch like before.

Radio silence: When I am busy, I will likely go off the grid and be completely unreachable.

I am glad to be back and sharing what I can. I hope my codes help you enjoy the game to the fullest once again.

Seeing you appear is like seeing hope. Welcome back.
I'm really looking forward to the cheat codes for version 1.23.0. I'm still on 1.20.11.

morarin · 2026-06-04T12:53:07+0100

{MasterCode}
04000000 054B7BAC 6B1302A8
04000000 072427C0 A9BA7BFD
04000000 072427C4 F9000BFB
04000000 054A97D0 3607F500
04000000 04E521DC 97FFFE41
04000000 04E55FD8 94192236
04000000 04D43240 D10283FF
04000000 04D434B0 D101C3FF
04000000 053973A4 39412268
04000000 053982E4 39412288
04000000 0538BCCC 394092C8
04000000 05382428 B9401F48
04000000 032F4F04 F9406800
04000000 032F4F08 B40002A0
04000000 032F4F0C B9402041
04000000 032F4F10 AA1F03E2
04000000 032F4F14 9400229B
04000000 032F4F18 F9406E60
04000000 032F4F1C B4000200
04000000 032F4F20 AA1F03E1
04000000 04D1C140 2A0003F5
04000000 04D1C1E4 39411108
04000000 04D1C214 7100051F
04000000 04D1C218 1A9F17E8
04000000 04D1C230 54000141
04000000 04D1C234 52800068
04000000 04CFD518 97FAA2AE
04000000 04CFD820 944F6E3C
04000000 04D074E0 A9BB7BFD
04000000 04D07840 D101C3FF
04000000 04D517D8 F8018D00
04000000 04E72380 97D35758
04000000 04E729BC 547135CB
04000000 0537E75C 0B180101
04000000 054D5E4C B9402A78
04000000 054D5E50 0B140316
04000000 053107A4 B94026E8
04000000 053107AC 0B150108
04000000 054A0994 0B180108
04000000 054A0998 F81F03BF
04000000 054A438C 1A89B2B8
04000000 054A4394 1A89B115
04000000 05DCE5B8 2A0303F5
04000000 07EABE90 1A9F17E0
04000000 07EC7264 71000D1F
04000000 07EC7268 1A9F17E0
04000000 058FAFA8 54CA8861
04000000 05DC0D94 5400032D
04000000 05DC427C 6B08013F
04000000 05DC4280 540000AA
04000000 05DC4284 2A1F03E0
04000000 05056C8C 37000140
04000000 05056CC8 54000081
04000000 05057088 B9403108
04000000 050571AC B940016B
04000000 07B15AD8 AA1303E0
04000000 04CAA488 2A1502C8
04000000 054ABDA8 540005E1
04000000 054ABE60 54FFFA60
04000000 054ABDEC 2A180108
04000000 04F28180 1A9F07E0
04000000 04F281AC 52800020
04000000 04F2A010 3707F380
04000000 04F2C07C 36003060
04000000 04F2CC84 9415DD17
04000000 0555ABCC 360014C0
04000000 035DA7D0 17FFF0F4

[R MoveSpeed x2]
04000000 034B29EC 1E204140
04000000 034B29F0 1E204161
04000000 034B29F8 1E204182
80000080
04000000 034B29EC 1E2A2940
04000000 034B29F0 1E2B2961
04000000 034B29F8 1E2C2982
20000000

[EnergyNoDecrease]
04000000 054B7BAC 6B1F02A8

[CurrencyNoDecrease]
04000000 072427C0 52800000
04000000 072427C4 D65F03C0

[R PickupToMax]
04000000 04BA561C B94017FA
04000000 04BA5844 4B19035A
80000080
04000000 04BA561C 2A1B03FA
04000000 04BA5844 2A1F03FA
20000000

[ZL NoConsumeItems]
04000000 04BA5FD0 D10283FF
04000000 04BA5FD4 A9047BFD
04000000 04BA6970 D10243FF
04000000 04BA6974 A9037BFD
80000100
04000000 04BA5FD0 52800020
04000000 04BA5FD4 D65F03C0
04000000 04BA6970 52800020
04000000 04BA6974 D65F03C0
20000000

[ShowAllCraftingRecipe]
04000000 054A97D0 D503201F

[FreeCraft]
04000000 04E521DC 52800000
04000000 04E55FD8 52800020

[CookKeepItems]
04000000 04D43240 D65F03C0
04000000 04D434B0 D65F03C0

[AlwaysCriticalSuccess]
04000000 053973A4 52800028
04000000 053982E4 52800028

[AlwaysBurning]
04000000 0538BCCC 52800028

[AlwaysActivityBonusRewards]
04000000 05382428 52807D08

[EasyFishing]
04000000 032F4F04 F9406660
04000000 032F4F08 AA1F03E1
04000000 032F4F0C 94001B91
04000000 032F4F10 F9406660
04000000 032F4F14 52800001
04000000 032F4F18 AA1F03E2
04000000 032F4F1C 94001B39
04000000 032F4F20 1400000C

[--SectionStart:ForceFishRarity--]
00000000 00000000 00000000
[ForceNormalFish]
04000000 04D1C140 52800035
04000000 04D1C1E4 52800008
04000000 04D1C214 7100051F
04000000 04D1C218 1A9F07E8
04000000 04D1C230 54000140
04000000 04D1C234 52800028

[ForceUncommonFish]
04000000 04D1C140 52800035
04000000 04D1C1E4 52800008
04000000 04D1C214 7100091F
04000000 04D1C218 1A9F07E8
04000000 04D1C230 54000140
04000000 04D1C234 52800048

[ForceRareFish]
04000000 04D1C140 52800035
04000000 04D1C1E4 52800008
04000000 04D1C214 71000D1F
04000000 04D1C218 1A9F07E8
04000000 04D1C230 54000140
[--SectionEnd:ForceFishRarity--]
00000000 00000000 00000000

[EasyGardening]
04000000 04CFD518 52800020
04000000 04CFD820 D503201F

[InfHarvesting]
04000000 04D074E0 D65F03C0
04000000 04D07840 D65F03C0

[InfMiningRock]
04000000 04D517D8 F8018D1F

[EasyUnlockCritter]
04000000 04E72380 52800020
04000000 04E729BC D503201F

[PetFriendshipMax(add)]
04000000 0537E75C 2A1503E1

[MountBondMax(add)]
04000000 054D5E4C 52A00036
04000000 054D5E50 729C6CD6

[FriendshipMax(add)]
04000000 053107A4 52A00028
04000000 053107AC 729C6CC8

[XPMax(add)]
04000000 054A0994 529FD008
04000000 054A0998 72A001E8

[CurrencyMax(add)]
04000000 054A438C 1A89B138
04000000 054A4394 1A89B135

[EasyClaimDuties]
04000000 05DCE5B8 52800035
04000000 07EABE90 52800020
04000000 07EC7264 7100111F
04000000 07EC7268 1A9F07E0
04000000 058FAFA8 D503201F

[ClaimAllAchievements]
04000000 05DC0D94 D503201F
04000000 05DC427C B9007668
04000000 05DC4280 B9009268
04000000 05DC4284 14000004

[--SectionStart:EasyScramblecoin--]
00000000 00000000 00000000
[6Points]
04000000 05056C8C 1400000A
04000000 05056CC8 14000004
04000000 05057088 52800008
04000000 050571AC 528000CB

[12Points]
04000000 05056C8C 1400000A
04000000 05056CC8 14000004
04000000 05057088 52800008
04000000 050571AC 5280018B

[15Points]
04000000 05056C8C 1400000A
04000000 05056CC8 14000004
04000000 05057088 52800008
04000000 050571AC 528001EB

[18Points]
04000000 05056C8C 1400000A
04000000 05056CC8 14000004
04000000 05057088 52800008
04000000 050571AC 5280024B

[21Points]
04000000 05056C8C 1400000A
04000000 05056CC8 14000004
04000000 05057088 52800008
04000000 050571AC 528002AB

[50Points]
04000000 05056C8C 1400000A
04000000 05056CC8 14000004
04000000 05057088 52800008
04000000 050571AC 5280064B
[--SectionEnd:EasyScramblecoin--]
00000000 00000000 00000000

[--SectionStart:GetAllCodes--]
00000000 00000000 00000000
[GetAllClothing]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 528000A1
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllGliders]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 528000E1
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllFacePaint&Hair]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 528001C1
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllTool&Accessory]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 52800161
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllFurniture999]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF57F4
04000000 08CB4120 A9BF5FF6
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 52800081
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A97
04000000 08CB414C F9405E60
04000000 08CB4150 F9401400
04000000 08CB4154 B9401AE1
04000000 08CB4158 AA1F03E2
04000000 08CB415C 971FA979
04000000 08CB4160 52807CE2
04000000 08CB4164 6B000042
04000000 08CB4168 540000AD
04000000 08CB416C AA1303E0
04000000 08CB4170 B9401AE1
04000000 08CB4174 AA1F03E3
04000000 08CB4178 973AA6EE
04000000 08CB417C 110006D6
04000000 08CB4180 6B1502DF
04000000 08CB4184 54FFFE2B
04000000 08CB4188 A8C15FF6
04000000 08CB418C A8C157F4
04000000 08CB4190 A8C17BF3
04000000 08CB4194 AA1303E0
04000000 08CB4198 D65F03C0

[GetAllWallpaper&Flooring]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 52800201
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllPlayerHouse]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BE5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C F000F980
04000000 08CB4130 91264000
04000000 08CB4134 52800021
04000000 08CB4138 90FBF4C8
04000000 08CB413C 9106C108
04000000 08CB4140 D63F0100
04000000 08CB4144 96F7582F
04000000 08CB4148 52800041
04000000 08CB414C 528000A8
04000000 08CB4150 B90013E8
04000000 08CB4154 910043E2
04000000 08CB4158 F000F983
04000000 08CB415C F944C863
04000000 08CB4160 96A70D30
04000000 08CB4164 91008014
04000000 08CB4168 B9401815
04000000 08CB416C 52800016
04000000 08CB4170 F8767A80
04000000 08CB4174 B9401801
04000000 08CB4178 AA1303E0
04000000 08CB417C 52800022
04000000 08CB4180 AA1F03E3
04000000 08CB4184 973AA6EB
04000000 08CB4188 110006D6
04000000 08CB418C 6B1502DF
04000000 08CB4190 54FFFF0B
04000000 08CB4194 A8C25BF5
04000000 08CB4198 A8C153F3
04000000 08CB419C A8C17BE0
04000000 08CB41A0 D65F03C0

[GetAllCompanion]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BE5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C F000F980
04000000 08CB4130 91290000
04000000 08CB4134 52800021
04000000 08CB4138 90FBF4C8
04000000 08CB413C 9106C108
04000000 08CB4140 D63F0100
04000000 08CB4144 96F7582F
04000000 08CB4148 52800181
04000000 08CB414C 52800008
04000000 08CB4150 B90013E8
04000000 08CB4154 910043E2
04000000 08CB4158 F000F983
04000000 08CB415C F9452063
04000000 08CB4160 96A70D30
04000000 08CB4164 91008014
04000000 08CB4168 B9401815
04000000 08CB416C 52800016
04000000 08CB4170 F8767A80
04000000 08CB4174 B9401801
04000000 08CB4178 AA1303E0
04000000 08CB417C 52800022
04000000 08CB4180 AA1F03E3
04000000 08CB4184 973AA6EB
04000000 08CB4188 110006D6
04000000 08CB418C 6B1502DF
04000000 08CB4190 54FFFF0B
04000000 08CB4194 A8C25BF5
04000000 08CB4198 A8C153F3
04000000 08CB419C A8C17BE0
04000000 08CB41A0 D65F03C0

[GetAllMount]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BE5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C F000F980
04000000 08CB4130 9128A000
04000000 08CB4134 52800021
04000000 08CB4138 90FBF4C8
04000000 08CB413C 9106C108
04000000 08CB4140 D63F0100
04000000 08CB4144 96F7582F
04000000 08CB4148 52800181
04000000 08CB414C 52800068
04000000 08CB4150 B90013E8
04000000 08CB4154 910043E2
04000000 08CB4158 F000F983
04000000 08CB415C F9451463
04000000 08CB4160 96A70D30
04000000 08CB4164 91008014
04000000 08CB4168 B9401815
04000000 08CB416C 52800016
04000000 08CB4170 F8767A80
04000000 08CB4174 B9401801
04000000 08CB4178 AA1303E0
04000000 08CB417C 52800022
04000000 08CB4180 AA1F03E3
04000000 08CB4184 973AA6EB
04000000 08CB4188 110006D6
04000000 08CB418C 6B1502DF
04000000 08CB4190 54FFFF0B
04000000 08CB4194 A8C25BF5
04000000 08CB4198 A8C153F3
04000000 08CB419C A8C17BE0
04000000 08CB41A0 D65F03C0

[GetAllMountGear]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 528002A1
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllSkin]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 52800221
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllMotif]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 52800141
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllPhotoFrame]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 52800261
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllCookingRecipe]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 528019A1
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllMemory]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 04CAA488 2A1F03E8
04000000 054ABDA8 D503201F
04000000 054ABE60 17FFFFD3
04000000 054ABDEC 94E020E4
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 528001A1
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0
04000000 08CB417C A9BF07E0
04000000 08CB4180 A9BF0FE2
04000000 08CB4184 96F7581F
04000000 08CB4188 AA1503E1
04000000 08CB418C 96F745D1
04000000 08CB4190 B9406809
04000000 08CB4194 12800008
04000000 08CB4198 5280040A
04000000 08CB419C 4B09014A
04000000 08CB41A0 1ACA2508
04000000 08CB41A4 A8C10FE2
04000000 08CB41A8 A8C107E0
04000000 08CB41AC 171FDF11

[--SectionEnd:GetAllCodes--]
00000000 00000000 00000000

[--SectionStart:FixCodes--]
00000000 00000000 00000000
[SellToTrash]
04000000 04F28180 2A1F03E0
04000000 04F281AC 2A1F03E0
04000000 04F2A010 17FFFF9C
04000000 04F2C07C D503201F
04000000 04F2CC84 52800000

[FixMissionRewards]
04000000 0555ABCC D503201F

[WelcomeVanellope]
04000000 035DA7D0 B4FE1E81
04000000 035DA7D4 155B6677
04000000 08CB41B0 B9402028
04000000 08CB41B4 7100051F
04000000 08CB41B8 54914F41
04000000 08CB41BC A9BF7BF3
04000000 08CB41C0 A9BF57F4
04000000 08CB41C4 A9BF5FF6
04000000 08CB41C8 A9BF67F8
04000000 08CB41CC A9BF6FFA
04000000 08CB41D0 AA0003F3
04000000 08CB41D4 F9400C28
04000000 08CB41D8 B9401914
04000000 08CB41DC 96A48A71
04000000 08CB41E0 96A460AC
04000000 08CB41E4 F9401800
04000000 08CB41E8 2A1403E1
04000000 08CB41EC AA1F03E2
04000000 08CB41F0 9721344C
04000000 08CB41F4 AA0003F4
04000000 08CB41F8 97419E26
04000000 08CB41FC F9400C08
04000000 08CB4200 F9400908
04000000 08CB4204 B9401915
04000000 08CB4208 F9400909
04000000 08CB420C 91008137
04000000 08CB4210 52800016
04000000 08CB4214 6B1502DF
04000000 08CB4218 5400042A
04000000 08CB421C F8767AEA
04000000 08CB4220 F9400D4B
04000000 08CB4224 F940096B
04000000 08CB4228 B9401978
04000000 08CB422C F940096C
04000000 08CB4230 9100819A
04000000 08CB4234 52800019
04000000 08CB4238 6B18033F
04000000 08CB423C 540002CA
04000000 08CB4240 F8797B40
04000000 08CB4244 B9402801
04000000 08CB4248 7100043F
04000000 08CB424C 54000060
04000000 08CB4250 7100083F
04000000 08CB4254 540001C1
04000000 08CB4258 F9403C0D
04000000 08CB425C B94049A1
04000000 08CB4260 71033C3F
04000000 08CB4264 540000A0
04000000 08CB4268 7102303F
04000000 08CB426C 54000101
04000000 08CB4270 528001C1
04000000 08CB4274 14000002
04000000 08CB4278 528001A1
04000000 08CB427C F94019A3
04000000 08CB4280 AA1403E2
04000000 08CB4284 AA1303E0
04000000 08CB4288 96A498CA
04000000 08CB428C 11000739
04000000 08CB4290 17FFFFEA
04000000 08CB4294 110006D6
04000000 08CB4298 17FFFFDF
04000000 08CB429C A8C16FFA
04000000 08CB42A0 A8C167F8
04000000 08CB42A4 A8C15FF6
04000000 08CB42A8 A8C157F4
04000000 08CB42AC A8C17BF3
04000000 08CB42B0 D65F03C0
[--SectionEnd:FixCodes--]
00000000 00000000 00000000

[Update: June 5, 2026]
Fixed: [GetAllPlayerHouse], [GetAllCompanion], [GetAllMount].
Note: The previous versions caused crashes. Please use the new ones.

Note: The required XP points have been updated following the player max level cap increase from 40 to 50 in v1.23.0.

Level	Total XP required to reach level	XP required for next level
30	365,700	25,600
31	391,300	26,400
32	417,700	27,300
33	445,000	28,100
34	473,100	29,000
35	502,100	29,800
36	531,900	30,800
37	562,700	31,500
38	594,200	32,500
39	626,700	33,300
40	660,000	34,300
41	694,300	35,300
42	729,600	36,300
43	765,900	37,300
44	803,200	38,300
45	841,500	39,300
46	880,800	40,300
47	921,100	41,300
48	962,400	42,300
49	1,004,700	43,300
50	1,048,000	—

annieraccoon · 2026-06-04T17:46:14+0100

Using your explanation for the fishing, I was able to update my game codes all except most of the "get all" codes. When time allows for you, a walkthrough of how you made the vanelope cheat, and maybe how you did one of the big "get all" cheats would be extremely helpful if you're up to it. No rush because I have a long drawn out method that works, but it can definitely be easier than I'm making it. Thanks!

morarin said:
View attachment 576477

{MasterCode}
04000000 054B7BAC 6B1302A8
04000000 072427C0 A9BA7BFD
04000000 072427C4 F9000BFB
04000000 054A97D0 3607F500
04000000 04E521DC 97FFFE41
04000000 04E55FD8 94192236
04000000 04D43240 D10283FF
04000000 04D434B0 D101C3FF
04000000 053973A4 39412268
04000000 053982E4 39412288
04000000 0538BCCC 394092C8
04000000 05382428 B9401F48
04000000 032F4F04 F9406800
04000000 032F4F08 B40002A0
04000000 032F4F0C B9402041
04000000 032F4F10 AA1F03E2
04000000 032F4F14 9400229B
04000000 032F4F18 F9406E60
04000000 032F4F1C B4000200
04000000 032F4F20 AA1F03E1
04000000 04D1C140 2A0003F5
04000000 04D1C1E4 39411108
04000000 04D1C214 7100051F
04000000 04D1C218 1A9F17E8
04000000 04D1C230 54000141
04000000 04D1C234 52800068
04000000 04CFD518 97FAA2AE
04000000 04CFD820 944F6E3C
04000000 04D074E0 A9BB7BFD
04000000 04D07840 D101C3FF
04000000 04D517D8 F8018D00
04000000 04E72380 97D35758
04000000 04E729BC 547135CB
04000000 0537E75C 0B180101
04000000 054D5E4C B9402A78
04000000 054D5E50 0B140316
04000000 053107A4 B94026E8
04000000 053107AC 0B150108
04000000 054A0994 0B180108
04000000 054A0998 F81F03BF
04000000 054A438C 1A89B2B8
04000000 054A4394 1A89B115
04000000 05DCE5B8 2A0303F5
04000000 07EABE90 1A9F17E0
04000000 07EC7264 71000D1F
04000000 07EC7268 1A9F17E0
04000000 058FAFA8 54CA8861
04000000 05DC0D94 5400032D
04000000 05DC427C 6B08013F
04000000 05DC4280 540000AA
04000000 05DC4284 2A1F03E0
04000000 05056C8C 37000140
04000000 05056CC8 54000081
04000000 05057088 B9403108
04000000 050571AC B940016B
04000000 07B15AD8 AA1303E0
04000000 04CAA488 2A1502C8
04000000 054ABDA8 540005E1
04000000 054ABE60 54FFFA60
04000000 054ABDEC 2A180108
04000000 04F28180 1A9F07E0
04000000 04F281AC 52800020
04000000 04F2A010 3707F380
04000000 04F2C07C 36003060
04000000 04F2CC84 9415DD17
04000000 0555ABCC 360014C0
04000000 035DA7D0 17FFF0F4

[R MoveSpeed x2]
04000000 034B29EC 1E204140
04000000 034B29F0 1E204161
04000000 034B29F8 1E204182
80000080
04000000 034B29EC 1E2A2940
04000000 034B29F0 1E2B2961
04000000 034B29F8 1E2C2982
20000000

[EnergyNoDecrease]
04000000 054B7BAC 6B1F02A8

[CurrencyNoDecrease]
04000000 072427C0 52800000
04000000 072427C4 D65F03C0

[R PickupToMax]
04000000 04BA561C B94017FA
04000000 04BA5844 4B19035A
80000080
04000000 04BA561C 2A1B03FA
04000000 04BA5844 2A1F03FA
20000000

[ZL NoConsumeItems]
04000000 04BA5FD0 D10283FF
04000000 04BA5FD4 A9047BFD
04000000 04BA6970 D10243FF
04000000 04BA6974 A9037BFD
80000100
04000000 04BA5FD0 52800020
04000000 04BA5FD4 D65F03C0
04000000 04BA6970 52800020
04000000 04BA6974 D65F03C0
20000000

[ShowAllCraftingRecipe]
04000000 054A97D0 D503201F

[FreeCraft]
04000000 04E521DC 52800000
04000000 04E55FD8 52800020

[CookKeepItems]
04000000 04D43240 D65F03C0
04000000 04D434B0 D65F03C0

[AlwaysCriticalSuccess]
04000000 053973A4 52800028
04000000 053982E4 52800028

[AlwaysBurning]
04000000 0538BCCC 52800028

[AlwaysActivityBonusRewards]
04000000 05382428 52807D08

[EasyFishing]
04000000 032F4F04 F9406660
04000000 032F4F08 AA1F03E1
04000000 032F4F0C 94001B91
04000000 032F4F10 F9406660
04000000 032F4F14 52800001
04000000 032F4F18 AA1F03E2
04000000 032F4F1C 94001B39
04000000 032F4F20 1400000C

[--SectionStart:ForceFishRarity--]
00000000 00000000 00000000
[ForceNormalFish]
04000000 04D1C140 52800035
04000000 04D1C1E4 52800008
04000000 04D1C214 7100051F
04000000 04D1C218 1A9F07E8
04000000 04D1C230 54000140
04000000 04D1C234 52800028

[ForceUncommonFish]
04000000 04D1C140 52800035
04000000 04D1C1E4 52800008
04000000 04D1C214 7100091F
04000000 04D1C218 1A9F07E8
04000000 04D1C230 54000140
04000000 04D1C234 52800048

[ForceRareFish]
04000000 04D1C140 52800035
04000000 04D1C1E4 52800008
04000000 04D1C214 71000D1F
04000000 04D1C218 1A9F07E8
04000000 04D1C230 54000140
[--SectionEnd:ForceFishRarity--]
00000000 00000000 00000000

[EasyGardening]
04000000 04CFD518 52800020
04000000 04CFD820 D503201F

[InfHarvesting]
04000000 04D074E0 D65F03C0
04000000 04D07840 D65F03C0

[InfMiningRock]
04000000 04D517D8 F8018D1F

[EasyUnlockCritter]
04000000 04E72380 52800020
04000000 04E729BC D503201F

[PetFriendshipMax(add)]
04000000 0537E75C 2A1503E1

[MountBondMax(add)]
04000000 054D5E4C 52A00036
04000000 054D5E50 729C6CD6

[FriendshipMax(add)]
04000000 053107A4 52A00028
04000000 053107AC 729C6CC8

[XPMax(add)]
04000000 054A0994 529FD008
04000000 054A0998 72A001E8

[CurrencyMax(add)]
04000000 054A438C 1A89B138
04000000 054A4394 1A89B135

[EasyClaimDuties]
04000000 05DCE5B8 52800035
04000000 07EABE90 52800020
04000000 07EC7264 7100111F
04000000 07EC7268 1A9F07E0
04000000 058FAFA8 D503201F

[ClaimAllAchievements]
04000000 05DC0D94 D503201F
04000000 05DC427C B9007668
04000000 05DC4280 B9009268
04000000 05DC4284 14000004

[--SectionStart:EasyScramblecoin--]
00000000 00000000 00000000
[6Points]
04000000 05056C8C 1400000A
04000000 05056CC8 14000004
04000000 05057088 52800008
04000000 050571AC 528000CB

[12Points]
04000000 05056C8C 1400000A
04000000 05056CC8 14000004
04000000 05057088 52800008
04000000 050571AC 5280018B

[15Points]
04000000 05056C8C 1400000A
04000000 05056CC8 14000004
04000000 05057088 52800008
04000000 050571AC 528001EB

[18Points]
04000000 05056C8C 1400000A
04000000 05056CC8 14000004
04000000 05057088 52800008
04000000 050571AC 5280024B

[21Points]
04000000 05056C8C 1400000A
04000000 05056CC8 14000004
04000000 05057088 52800008
04000000 050571AC 528002AB

[50Points]
04000000 05056C8C 1400000A
04000000 05056CC8 14000004
04000000 05057088 52800008
04000000 050571AC 5280064B
[--SectionEnd:EasyScramblecoin--]
00000000 00000000 00000000

[--SectionStart:GetAllCodes--]
00000000 00000000 00000000
[GetAllClothing]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 528000A1
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllGliders]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 528000E1
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllFacePaint&Hair]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 528001C1
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllTool&Accessory]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 52800161
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllFurniture999]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF57F4
04000000 08CB4120 A9BF5FF6
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 52800081
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A97
04000000 08CB414C F9405E60
04000000 08CB4150 F9401400
04000000 08CB4154 B9401AE1
04000000 08CB4158 AA1F03E2
04000000 08CB415C 971FA979
04000000 08CB4160 52807CE2
04000000 08CB4164 6B000042
04000000 08CB4168 540000AD
04000000 08CB416C AA1303E0
04000000 08CB4170 B9401AE1
04000000 08CB4174 AA1F03E3
04000000 08CB4178 973AA6EE
04000000 08CB417C 110006D6
04000000 08CB4180 6B1502DF
04000000 08CB4184 54FFFE2B
04000000 08CB4188 A8C15FF6
04000000 08CB418C A8C157F4
04000000 08CB4190 A8C17BF3
04000000 08CB4194 AA1303E0
04000000 08CB4198 D65F03C0

[GetAllWallpaper&Flooring]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 52800201
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllPlayerHouse]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BE5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C F000F980
04000000 08CB4130 91264000
04000000 08CB4134 52800021
04000000 08CB4138 95FA601E
04000000 08CB413C 96F75831
04000000 08CB4140 52800041
04000000 08CB4144 528000A8
04000000 08CB4148 B90013E8
04000000 08CB414C 910043E2
04000000 08CB4150 F000F983
04000000 08CB4154 F944C863
04000000 08CB4158 96A70D32
04000000 08CB415C 91008014
04000000 08CB4160 B9401815
04000000 08CB4164 52800016
04000000 08CB4168 F8767A80
04000000 08CB416C B9401801
04000000 08CB4170 AA1303E0
04000000 08CB4174 52800022
04000000 08CB4178 AA1F03E3
04000000 08CB417C 973AA6ED
04000000 08CB4180 110006D6
04000000 08CB4184 6B1502DF
04000000 08CB4188 54FFFF0B
04000000 08CB418C A8C25BF5
04000000 08CB4190 A8C153F3
04000000 08CB4194 A8C17BE0
04000000 08CB4198 D65F03C0

[GetAllCompanion]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BE5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C F000F980
04000000 08CB4130 91290000
04000000 08CB4134 52800021
04000000 08CB4138 95FA601E
04000000 08CB413C 96F75831
04000000 08CB4140 52800181
04000000 08CB4144 52800008
04000000 08CB4148 B90013E8
04000000 08CB414C 910043E2
04000000 08CB4150 F000F983
04000000 08CB4154 F9452063
04000000 08CB4158 96A70D32
04000000 08CB415C 91008014
04000000 08CB4160 B9401815
04000000 08CB4164 52800016
04000000 08CB4168 F8767A80
04000000 08CB416C B9401801
04000000 08CB4170 AA1303E0
04000000 08CB4174 52800022
04000000 08CB4178 AA1F03E3
04000000 08CB417C 973AA6ED
04000000 08CB4180 110006D6
04000000 08CB4184 6B1502DF
04000000 08CB4188 54FFFF0B
04000000 08CB418C A8C25BF5
04000000 08CB4190 A8C153F3
04000000 08CB4194 A8C17BE0
04000000 08CB4198 D65F03C0

[GetAllMount]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BE5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C F000F980
04000000 08CB4130 9128A000
04000000 08CB4134 52800021
04000000 08CB4138 95FA601E
04000000 08CB413C 96F75831
04000000 08CB4140 52800181
04000000 08CB4144 52800068
04000000 08CB4148 B90013E8
04000000 08CB414C 910043E2
04000000 08CB4150 F000F983
04000000 08CB4154 F9451463
04000000 08CB4158 96A70D32
04000000 08CB415C 91008014
04000000 08CB4160 B9401815
04000000 08CB4164 52800016
04000000 08CB4168 F8767A80
04000000 08CB416C B9401801
04000000 08CB4170 AA1303E0
04000000 08CB4174 52800022
04000000 08CB4178 AA1F03E3
04000000 08CB417C 973AA6ED
04000000 08CB4180 110006D6
04000000 08CB4184 6B1502DF
04000000 08CB4188 54FFFF0B
04000000 08CB418C A8C25BF5
04000000 08CB4190 A8C153F3
04000000 08CB4194 A8C17BE0
04000000 08CB4198 D65F03C0

[GetAllMountGear]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 528002A1
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllSkin]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 52800221
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllMotif]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 52800141
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllPhotoFrame]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 52800261
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllCookingRecipe]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 528019A1
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0

[GetAllMemory]
04000000 07B15AD8 94467990
04000000 04CAE434 D503201F
04000000 04CAA488 2A1F03E8
04000000 054ABDA8 D503201F
04000000 054ABE60 17FFFFD3
04000000 054ABDEC 94E020E4
04000000 08CB4118 A9BF7BF3
04000000 08CB411C A9BF53F3
04000000 08CB4120 A9BF5BF5
04000000 08CB4124 96A460A3
04000000 08CB4128 AA0003F3
04000000 08CB412C 96F75835
04000000 08CB4130 528001A1
04000000 08CB4134 AA1F03E2
04000000 08CB4138 96F74792
04000000 08CB413C 91008014
04000000 08CB4140 B9401815
04000000 08CB4144 52800016
04000000 08CB4148 F8767A80
04000000 08CB414C B9401801
04000000 08CB4150 AA1303E0
04000000 08CB4154 52800022
04000000 08CB4158 AA1F03E3
04000000 08CB415C 973AA6F5
04000000 08CB4160 110006D6
04000000 08CB4164 6B1502DF
04000000 08CB4168 54FFFF0B
04000000 08CB416C A8C15BF5
04000000 08CB4170 A8C153F3
04000000 08CB4174 A8C17BE0
04000000 08CB4178 D65F03C0
04000000 08CB417C A9BF07E0
04000000 08CB4180 A9BF0FE2
04000000 08CB4184 96F7581F
04000000 08CB4188 AA1503E1
04000000 08CB418C 96F745D1
04000000 08CB4190 B9406809
04000000 08CB4194 12800008
04000000 08CB4198 5280040A
04000000 08CB419C 4B09014A
04000000 08CB41A0 1ACA2508
04000000 08CB41A4 A8C10FE2
04000000 08CB41A8 A8C107E0
04000000 08CB41AC 171FDF11

[--SectionEnd:GetAllCodes--]
00000000 00000000 00000000

[--SectionStart:FixCodes--]
00000000 00000000 00000000
[SellToTrash]
04000000 04F28180 2A1F03E0
04000000 04F281AC 2A1F03E0
04000000 04F2A010 17FFFF9C
04000000 04F2C07C D503201F
04000000 04F2CC84 52800000

[FixMissionRewards]
04000000 0555ABCC D503201F

[WelcomeVanellope]
04000000 035DA7D0 B4FE1E81
04000000 035DA7D4 155B6677
04000000 08CB41B0 B9402028
04000000 08CB41B4 7100051F
04000000 08CB41B8 54914F41
04000000 08CB41BC A9BF7BF3
04000000 08CB41C0 A9BF57F4
04000000 08CB41C4 A9BF5FF6
04000000 08CB41C8 A9BF67F8
04000000 08CB41CC A9BF6FFA
04000000 08CB41D0 AA0003F3
04000000 08CB41D4 F9400C28
04000000 08CB41D8 B9401914
04000000 08CB41DC 96A48A71
04000000 08CB41E0 96A460AC
04000000 08CB41E4 F9401800
04000000 08CB41E8 2A1403E1
04000000 08CB41EC AA1F03E2
04000000 08CB41F0 9721344C
04000000 08CB41F4 AA0003F4
04000000 08CB41F8 97419E26
04000000 08CB41FC F9400C08
04000000 08CB4200 F9400908
04000000 08CB4204 B9401915
04000000 08CB4208 F9400909
04000000 08CB420C 91008137
04000000 08CB4210 52800016
04000000 08CB4214 6B1502DF
04000000 08CB4218 5400042A
04000000 08CB421C F8767AEA
04000000 08CB4220 F9400D4B
04000000 08CB4224 F940096B
04000000 08CB4228 B9401978
04000000 08CB422C F940096C
04000000 08CB4230 9100819A
04000000 08CB4234 52800019
04000000 08CB4238 6B18033F
04000000 08CB423C 540002CA
04000000 08CB4240 F8797B40
04000000 08CB4244 B9402801
04000000 08CB4248 7100043F
04000000 08CB424C 54000060
04000000 08CB4250 7100083F
04000000 08CB4254 540001C1
04000000 08CB4258 F9403C0D
04000000 08CB425C B94049A1
04000000 08CB4260 71033C3F
04000000 08CB4264 540000A0
04000000 08CB4268 7102303F
04000000 08CB426C 54000101
04000000 08CB4270 528001C1
04000000 08CB4274 14000002
04000000 08CB4278 528001A1
04000000 08CB427C F94019A3
04000000 08CB4280 AA1403E2
04000000 08CB4284 AA1303E0
04000000 08CB4288 96A498CA
04000000 08CB428C 11000739
04000000 08CB4290 17FFFFEA
04000000 08CB4294 110006D6
04000000 08CB4298 17FFFFDF
04000000 08CB429C A8C16FFA
04000000 08CB42A0 A8C167F8
04000000 08CB42A4 A8C15FF6
04000000 08CB42A8 A8C157F4
04000000 08CB42AC A8C17BF3
04000000 08CB42B0 D65F03C0
[--SectionEnd:FixCodes--]
00000000 00000000 00000000

Note: The required XP points have been updated following the player max level cap increase from 40 to 50 in v1.23.0.
[TABLE=full]
[TR]
[th]Level[/th][th]Total XP required to reach level[/th][th]XP required for next level[/th]
[/TR]
[TR]
[td]30[/td][td]365,700[/td][td]25,600[/td]
[/TR]
[TR]
[td]31[/td][td]391,300[/td][td]26,400[/td]
[/TR]
[TR]
[td]32[/td][td]417,700[/td][td]27,300[/td]
[/TR]
[TR]
[td]33[/td][td]445,000[/td][td]28,100[/td]
[/TR]
[TR]
[td]34[/td][td]473,100[/td][td]29,000[/td]
[/TR]
[TR]
[td]35[/td][td]502,100[/td][td]29,800[/td]
[/TR]
[TR]
[td]36[/td][td]531,900[/td][td]30,800[/td]
[/TR]
[TR]
[td]37[/td][td]562,700[/td][td]31,500[/td]
[/TR]
[TR]
[td]38[/td][td]594,200[/td][td]32,500[/td]
[/TR]
[TR]
[td]39[/td][td]626,700[/td][td]33,300[/td]
[/TR]
[TR]
[td]40[/td][td]660,000[/td][td]34,300[/td]
[/TR]
[TR]
[td]41[/td][td]694,300[/td][td]35,300[/td]
[/TR]
[TR]
[td]42[/td][td]729,600[/td][td]36,300[/td]
[/TR]
[TR]
[td]43[/td][td]765,900[/td][td]37,300[/td]
[/TR]
[TR]
[td]44[/td][td]803,200[/td][td]38,300[/td]
[/TR]
[TR]
[td]45[/td][td]841,500[/td][td]39,300[/td]
[/TR]
[TR]
[td]46[/td][td]880,800[/td][td]40,300[/td]
[/TR]
[TR]
[td]47[/td][td]921,100[/td][td]41,300[/td]
[/TR]
[TR]
[td]48[/td][td]962,400[/td][td]42,300[/td]
[/TR]
[TR]
[td]49[/td][td]1,004,700[/td][td]43,300[/td]
[/TR]
[TR]
[td]50[/td][td]1,048,000[/td][td]—[/td]
[/TR]
[/TABLE]

D4M28 · 2026-06-04T21:59:30+0100

morarin said:
Hello everyone, again

It has been a while. As I mentioned in my previous post, I had completely stepped away from the game. However, the recent update on June 3rd caught my attention, and I decided to boot up Disney Dreamlight Valley for the first time in a long while. To my surprise, it was incredibly relaxing and turned out to be exactly the kind of rest I needed.

To play the game more casually, I generated some codes for myself. At the same time, I noticed that no one had taken over sharing codes since my departure. It honestly made me feel bad to see that the gaming experience had significantly dropped for many of you who used to enjoy the game with them. Because of this, I felt the desire to start sharing my codes with you all again.

So, I am officially lifting my hiatus. To ensure I don't push myself too hard and can maintain a healthy balance, I will only share codes when I have the spare time.

If you wish to use my codes moving forward, please accept the following ground rules:

No guarantee for every version: If I don't have time, I will simply skip updating for that version.

No hotfix updates: I generally will not update codes for minor patches (where the main version number doesn't change).

Priority on low-maintenance codes: My priority will always be codes that can be updated automatically or require very little effort.

Complex codes come last: I will only release the "Get All" or "Vanellope" codes if I have extra time.

Longer wait times: Please do not expect updates within a few days of a patch like before.

Radio silence: When I am busy, I will likely go off the grid and be completely unreachable.

I am glad to be back and sharing what I can. I hope my codes help you enjoy the game to the fullest once again.

Thank you

morarin · 2026-06-05T06:04:49+0100

annieraccoon said:
Using your explanation for the fishing, I was able to update my game codes all except most of the "get all" codes. When time allows for you, a walkthrough of how you made the vanelope cheat, and maybe how you did one of the big "get all" cheats would be extremely helpful if you're up to it. No rush because I have a long drawn out method that works, but it can definitely be easier than I'm making it. Thanks!

This code was originally made for Vanellope's unlock quest, but strictly speaking, it is not really a "Vanellope-only" code. The actual purpose is more specific:

It forces the two DreamSnaps-related mission objectives to advance even while offline.

The two problematic steps are:

Opening the DreamSnaps menu/page to view the current DreamSnaps information.
Submitting something to DreamSnaps.

Both of these normally require an online connection. If the game is offline, those steps cannot be completed normally. So the point of the code is not to skip Vanellope's whole mission. It is only meant to handle those two online-only DreamSnaps blockers.
If another mission used the same kind of DreamSnaps-related objectives, the same idea could apply there too.

Why I used the tracked mission function
One of the first problems was: how do I tell the code which mission I want to process?
The game can have multiple active missions at the same time, but the player can only track one mission at once. That made the tracking system a convenient entry point. When the tracked activity changes, the game receives information about the newly tracked activity. So I searched dump.cs for a function related to that and found:

Code:

Mdl.Missions.MissionManager$$OnTrackedMissionChanged

In IDA, this function was very small. It basically just branched to:

Code:

Mdl.Missions.MissionManager$$RefreshCurrentFollower

That made it a good hook point:

It runs when the player selects a tracked mission.
The tracked activity is passed as an argument.
If the tracked activity is a mission, the missionId can be read from that argument.
The original function is small, so it is easy to preserve the original behavior.
It was also convenient for a code cave hook.

The missionId itself is not the real filter. It is just a convenient way to get the MissionSlot for the mission the player is currently tracking.

Getting the missionId
The tracked activity object can represent different kinds of tracked activities, not just missions. So the code first checks whether the tracked activity is actually a mission:

Code:

TrackedActivity.activityCase_ == Mission

If it is not a mission, the code just returns to the original behavior. If it is a mission, the code reads the TrackedMission object and gets the missionId from it:

Code:

if trackedActivity.activityCase_ != Mission:
return RefreshCurrentFollower()

missionId = trackedActivity.activity_.missionId

Again, the missionId is only used to find the currently tracked MissionSlot. The code does not depend on a hardcoded Vanellope missionId.

Keeping the original behavior
After getting the missionId, the code still calls the function that the original code was going to call:

Code:

MissionManager.RefreshCurrentFollower()

The hook is not meant to replace the original behavior. It only adds extra logic after the normal tracked-mission update has happened.

Getting the current mission data
Once the code has the missionId, it gets the actual mission data from the profile. The path is roughly:

Code:

MissionManager
-> Profile
-> ProfileWorld
-> GetMissionSlot(missionId, null)

So the code gets the ProfileWorld and calls:

Code:

ProfileWorld.GetMissionSlot(missionId, null)

That returns the MissionSlot for the currently tracked mission.

Walking from the mission to the actual objective
The mission structure is nested. It is roughly:

Code:

MissionSlot
-> CurrentStep
-> SubSteps
-> Objectives
-> ObjectiveData

So the code gets the current step:

Code:

MissionSlot.get_CurrentStep()

Then it loops through the SubSteps, and inside each SubStep it loops through the Objectives. This is why the code has a double loop. The mission itself is not enough. I needed to reach the actual MissionObjective inside the current step.

Filtering the objectives
For each MissionObjective, the code first checks the status. It only handles:

Code:

Ongoing            = 1
ReadyToBeCompleted = 2

Anything else is skipped. Then it checks:

Code:

MissionObjective.Data.customStepCase_

For the DreamSnaps-related blockers, the relevant objective types are:

Code:

MenuAction      = 207
DesignChallenge = 140

In this quest, the MenuAction objective is the DreamSnaps menu/page step, and the DesignChallenge objective is the DreamSnaps submission-related step. So the logic is basically:

Code:

if customStepCase_ == MenuAction:
condition = MenuAction

else if customStepCase_ == DesignChallenge:
condition = ForceSkipDesignChallenge

else:
skip it

The condition values passed to the advance function are:

Code:

MenuAction               = 13
ForceSkipDesignChallenge = 14

This keeps the code focused on the two objective types that were blocking offline progress, instead of force-advancing unrelated mission steps that could have much bigger side effects.

Why I did not skip the whole mission
I did not want to force-complete the whole mission. That would be risky because some quest steps do more than just update the objective text. They can give items, unlock objects, initialize later quest data, or change the world state.
For example, Vanellope's quest includes a step where the player has to place Vanellope's house. If the mission was skipped too far, that step might never initialize correctly. In the worst case, the player could end up unable to place Vanellope's house properly.
That is why I chose to advance only the specific offline-blocking objectives instead of skipping the mission itself.

Why I used CheckForAdvanceStep
This was the part that took the most trial and error. There was also a more direct way to force the mission forward, but it did not trigger all of the events or notifications correctly.
For example, the objective could appear to advance, but later quest logic did not initialize properly. One bad result was that Vanellope's house was not added to the inventory when the quest reached the part where it should be placed. So directly forcing progress was not enough.
Mission progress is not just:

Code:

status = completed

There are other things tied to it:

objective completion handling
step advancement
event dispatch
notifications
UI updates
item or reward handling
next-step initialization

The function I ended up using was:

Code:

Mdl.Missions.MissionManager$$CheckForAdvanceStep

This function takes the condition, the MissionSlot, and the stepName:

Code:

MissionManager.CheckForAdvanceStep(
condition,
missionSlot,
stepName
)

So instead of simply editing the objective status, the code sends the objective through a function that checks and advances the mission step more properly. That made the forced progress work with the required event/notification behavior instead of only changing the visible state.

The workflow
In practice, the workflow was:

Choose a function where the target mission can be identified.
Use the tracked mission argument to get the missionId.
Use that missionId to get the MissionSlot.
From the MissionSlot, get the current step.
Use a double loop to reach the actual MissionObjective.
Filter only the DreamSnaps-related objective types.
Pass the matching condition to CheckForAdvanceStep.

So the code is not really a "complete Vanellope quest" code. It is closer to a targeted workaround for the two DreamSnaps objectives that normally cannot be completed offline.

Code:

// ============================================================================
// WelcomeVanellope
// Target: v1.23.0 [0100D39012C1A800][v3801088][UPD]
// Code Cave Address: 0x7108CB41B0
// ============================================================================

// --- [Block A] Hook (Mdl.Missions.MissionManager$$OnTrackedMissionChanged)
// Address: 0x71035DA7D0
// Original: B Mdl.Missions.MissionManager$$RefreshCurrentFollower (0x71035D6BA0)
0x71035DA7D0    CBZ   X1, 0x71035D6BA0              // If TrackedActivity is NULL, jump to original target
0x71035DA7D4    B     0x7108CB41B0                  // Jump to Code Cave

// --- [Block B] Code Cave (Start: 0x7108CB41B0) ------------------------------
// 1. Initial Type Check
0x7108CB41B0    LDR   W8, [X1, #0x20]               // W8 = TrackedActivity.activityCase_
0x7108CB41B4    CMP   W8, #1                        // ActivityCase == Mission (1)?
0x7108CB41B8    B.NE  0x71035D6BA0                  // If not, jump to RefreshCurrentFollower

// 2. Prologue
0x7108CB41BC    STP   X19, X30, [SP, #-0x10]!
0x7108CB41C0    STP   X20, X21, [SP, #-0x10]!
0x7108CB41C4    STP   X22, X23, [SP, #-0x10]!
0x7108CB41C8    STP   X24, X25, [SP, #-0x10]!
0x7108CB41CC    STP   X26, X27, [SP, #-0x10]!

0x7108CB41D0    MOV   X19, X0                       // X19 = MissionManager*
0x7108CB41D4    LDR   X8,  [X1, #0x18]              // X8 = TrackedActivity.activity_ (TrackedMission*)
0x7108CB41D8    LDR   W20, [X8, #0x18]              // W20 = missionId

// 3. Execute Original Intercepted Call
0x7108CB41DC    BL    0x71035D6BA0                  // Call RefreshCurrentFollower()

// 4. Retrieve ProfileWorld
0x7108CB41E0    BL    0x71035CC490                  // Call MissionManager.get_Profile()
0x7108CB41E4    LDR   X0,  [X0, #0x30]              // X0 = ProfileWorld* (Profile.world_)

// 5. Get MissionSlot
0x7108CB41E8    MOV   W1,  W20                      // Arg 1: missionId
0x7108CB41EC    MOV   X2,  XZR                      // Arg 2: predicate = NULL
0x7108CB41F0    BL    0x7105501320                  // Call ProfileWorld.GetMissionSlot()
0x7108CB41F4    MOV   X20, X0                       // X20 = MissionSlot*

// 6. Get Current MissionStep
0x7108CB41F8    BL    0x7105D1BA90                  // Call MissionSlot.get_CurrentStep()

// 7. Prepare Outer Loop (SubSteps)
0x7108CB41FC    LDR   X8,  [X0, #0x18]              // X8 = MissionStep.subSteps_
0x7108CB4200    LDR   X8,  [X8, #0x10]              // X8 = List<MissionSubStep>
0x7108CB4204    LDR   W21, [X8, #0x18]              // W21 = subStepCount
0x7108CB4208    LDR   X9,  [X8, #0x10]              // X9 = items array
0x7108CB420C    ADD   X23, X9,  #0x20               // X23 = first element address
0x7108CB4210    MOV   W22, #0                       // i = 0

// ===== Outer Loop Start =====
0x7108CB4214    CMP   W22, W21
0x7108CB4218    B.GE  0x7108CB429C                  // Exit outer loop if i >= count

0x7108CB421C    LDR   X10, [X23, X22, LSL #3]       // X10 = MissionSubStep*

// 8. Prepare Inner Loop (Objectives)
0x7108CB4220    LDR   X11, [X10, #0x18]             // X11 = MissionSubStep.objectives_
0x7108CB4224    LDR   X11, [X11, #0x10]             // X11 = List<MissionObjective>
0x7108CB4228    LDR   W24, [X11, #0x18]             // W24 = objectiveCount
0x7108CB422C    LDR   X12, [X11, #0x10]             // X12 = items array
0x7108CB4230    ADD   X26, X12, #0x20               // X26 = first element address
0x7108CB4234    MOV   W25, #0                       // j = 0

// ----- Inner Loop Start -----
0x7108CB4238    CMP   W25, W24
0x7108CB423C    B.GE  0x7108CB4294                  // Exit inner loop if j >= count

0x7108CB4240    LDR   X0,  [X26, X25, LSL #3]       // X0 = MissionObjective*

// 9. Process Objective State
0x7108CB4244    LDR   W1,  [X0, #0x28]              // W1 = MissionObjective.status_
0x7108CB4248    CMP   W1,  #1                       // status == Ongoing (1)?
0x7108CB424C    B.EQ  0x7108CB4258                  // If yes, proceed to logic
0x7108CB4250    CMP   W1,  #2                       // status == ReadyToBeCompleted (2)?
0x7108CB4254    B.NE  0x7108CB428C                  // If neither, skip objective

// 10. Check Custom Step Case
0x7108CB4258    LDR   X13, [X0, #0x78]              // X13 = MissionObjective.Data (MissionObjectiveData*)
0x7108CB425C    LDR   W1,  [X13, #0x48]             // W1 = customStepCase_
0x7108CB4260    CMP   W1,  #207                     // MenuAction (207)?
0x7108CB4264    B.EQ  0x7108CB4278                  // Jump to MenuAction override
0x7108CB4268    CMP   W1,  #140                     // DesignChallenge (140)?
0x7108CB426C    B.NE  0x7108CB428C                  // If neither, skip objective

// DesignChallenge Override
0x7108CB4270    MOV   W1,  #14                      // Condition = ForceSkipDesignChallenge (14)
0x7108CB4274    B     0x7108CB427C

// MenuAction Override
0x7108CB4278    MOV   W1,  #13                      // Condition = MenuAction (13)

// 11. Force Advance Step
0x7108CB427C    LDR   X3,  [X13, #0x30]             // Arg 4 (X3): stepName_
0x7108CB4280    MOV   X2,  X20                      // Arg 3 (X2): MissionSlot*
0x7108CB4284    MOV   X0,  X19                      // Arg 1 (X0): MissionManager*
0x7108CB4288    BL    0x71035DA5B0                  // Call MissionManager.CheckForAdvanceStep()

// Inner Loop Advance
0x7108CB428C    ADD   W25, W25, #1
0x7108CB4290    B     0x7108CB4238

// Outer Loop Advance
0x7108CB4294    ADD   W22, W22, #1
0x7108CB4298    B     0x7108CB4214

// 12. Epilogue
0x7108CB429C    LDP   X26, X27, [SP], #0x10
0x7108CB42A0    LDP   X24, X25, [SP], #0x10
0x7108CB42A4    LDP   X22, X23, [SP], #0x10
0x7108CB42A8    LDP   X20, X21, [SP], #0x10
0x7108CB42AC    LDP   X19, X30, [SP], #0x10
0x7108CB42B0    RET

This is a line-by-line style walkthrough of the final code. I will group repeated patterns, like register save/restore and loop increments, instead of explaining the exact same thing several times.

Block A: Hooking OnTrackedMissionChanged

Original function:

Code:

Mdl.Missions.MissionManager$$OnTrackedMissionChanged

Original behavior:

Code:

B Mdl.Missions.MissionManager$$RefreshCurrentFollower

So originally, this function just jumped directly to RefreshCurrentFollower.

The hook changes it to:

Code:

0x71035DA7D0    CBZ   X1, 0x71035D6BA0
0x71035DA7D4    B     0x7108CB41B0

Code:

CBZ X1, 0x71035D6BA0

means:

Code:

if X1 == 0:
branch to 0x71035D6BA0

Here, X1 is the trackedActivity argument.

So this is:

Code:

if trackedActivity == null:
go to RefreshCurrentFollower

Then:

Code:

B 0x7108CB41B0

jumps to the code cave.

So the hook does this:

Code:

if trackedActivity is null:
run original behavior
else:
jump to custom code

The hook itself only does a null check. The more specific mission check happens at the start of the code cave.

Block B-1: Check whether the tracked activity is a mission

Code:

Code:

0x7108CB41B0    LDR   W8, [X1, #0x20]
0x7108CB41B4    CMP   W8, #1
0x7108CB41B8    B.NE  0x71035D6BA0

This reads:

Code:

trackedActivity.activityCase_

because:

Code:

TrackedActivity.activityCase_ = 0x20

So:

Code:

LDR W8, [X1, #0x20]

means:

Code:

W8 = trackedActivity.activityCase_

Then:

Code:

CMP W8, #1

checks whether the activity case is 1.

In the enum:

Code:

Mission = 1

So this means:

Code:

if trackedActivity.activityCase_ != Mission:
go back to RefreshCurrentFollower

This is needed because TrackedActivity can be Mission, StarPath, Crafting, Duty, Story, Keyhole, etc.

This prevents the code from treating a non-mission tracked activity as a mission.

Block B-2: Prologue / saving registers

Code:

Code:

0x7108CB41BC    STP   X19, X30, [SP, #-0x10]!
0x7108CB41C0    STP   X20, X21, [SP, #-0x10]!
0x7108CB41C4    STP   X22, X23, [SP, #-0x10]!
0x7108CB41C8    STP   X24, X25, [SP, #-0x10]!
0x7108CB41CC    STP   X26, X27, [SP, #-0x10]!

This saves registers on the stack.

The code will use X19-X27 to keep important values while calling other functions.

Important registers used later:

Code:

X19 = MissionManager instance
W20 = missionId first
X20 = MissionSlot later
W21 = SubStep count
W22 = SubStep loop index
X23 = first SubStep element address
W24 = Objective count
W25 = Objective loop index
X26 = first Objective element address
X30 = return address / link register

X0-X7 are commonly used for function arguments and return values, so they can be overwritten by function calls.

X19-X27 are better for keeping values across function calls, but if custom code uses them, it should restore them before returning.

This block does not do mission logic. It just protects registers so the game can continue normally after the code cave returns.

Block B-3: Save MissionManager and read missionId

Code:

Code:

0x7108CB41D0    MOV   X19, X0
0x7108CB41D4    LDR   X8,  [X1, #0x18]
0x7108CB41D8    LDR   W20, [X8, #0x18]

At this point:

Code:

X0 = MissionManager instance
X1 = trackedActivity

First:

Code:

MOV X19, X0

saves the MissionManager instance.

So:

Code:

X19 = MissionManager

LDR X8, [X1, #0x18]

reads:

Code:

trackedActivity.activity_

because:

Code:

TrackedActivity.activity_ = 0x18

The code already checked that activityCase_ is Mission, so activity_ can be treated as TrackedMission.

Then:

Code:

LDR W20, [X8, #0x18]

reads:

Code:

trackedMission.missionId_

because:

Code:

TrackedMission.missionId_ = 0x18

So this block means:

Code:

MissionManager* missionManager = X0;
TrackedMission* trackedMission = trackedActivity->activity_;
int missionId = trackedMission->missionId_;

After this:

Code:

X19 = MissionManager
W20 = missionId

Block B-4: Run the original intercepted call

Code:

Code:

0x7108CB41DC    BL    0x71035D6BA0

This calls:

Code:

MissionManager.RefreshCurrentFollower()

This was the original function that OnTrackedMissionChanged jumped to.

So the custom code does not remove the original behavior. It gets the missionId first, then runs the original tracked-mission behavior.

This helps avoid breaking normal UI/follower/tracking behavior.

Block B-5: Get ProfileWorld

Code:

Code:

0x7108CB41E0    BL    0x71035CC490
0x7108CB41E4    LDR   X0,  [X0, #0x30]

The first instruction calls:

Code:

MissionManager.get_Profile()

The return value comes back in X0.

Then:

Code:

LDR X0, [X0, #0x30]

reads:

Code:

Profile.world_

So after this block:

Code:

X0 = ProfileWorld

Block B-6: Get MissionSlot from missionId

Code:

Code:

0x7108CB41E8    MOV   W1,  W20
0x7108CB41EC    MOV   X2,  XZR
0x7108CB41F0    BL    0x7105501320
0x7108CB41F4    MOV   X20, X0

This prepares arguments for:

Code:

ProfileWorld.GetMissionSlot(missionId, null)

Argument registers:

Code:

X0 = ProfileWorld
W1 = missionId
X2 = null predicate

Then:

Code:

BL 0x7105501320

calls GetMissionSlot.

The result comes back in X0.

Then:

Code:

MOV X20, X0

saves the MissionSlot.

So after this block:

Code:

X20 = MissionSlot

The missionId is only used to get the currently tracked MissionSlot. The real filter later is the objective type, not a hardcoded Vanellope missionId.

Block B-7: Get current MissionStep

Code:

Code:

0x7108CB41F8    BL    0x7105D1BA90

This calls:

Code:

MissionSlot.get_CurrentStep()

At this point, X0 still contains the MissionSlot returned by GetMissionSlot.

The return value comes back in X0.

So after this call:

Code:

X0 = current MissionStep

Conceptually:

Code:

currentStep = missionSlot.CurrentStep

Block B-8: Prepare the outer loop over SubSteps

Code:

Code:

0x7108CB41FC    LDR   X8,  [X0, #0x18]
0x7108CB4200    LDR   X8,  [X8, #0x10]
0x7108CB4204    LDR   W21, [X8, #0x18]
0x7108CB4208    LDR   X9,  [X8, #0x10]
0x7108CB420C    ADD   X23, X9,  #0x20
0x7108CB4210    MOV   W22, #0

Current MissionStep is in X0.

First:

Code:

LDR X8, [X0, #0x18]

reads:

Code:

currentStep.subSteps_

because:

Code:

MissionStep.subSteps_ = 0x18

Then:

Code:

LDR X8, [X8, #0x10]

gets the internal List from the RepeatedField.

Then:

Code:

LDR W21, [X8, #0x18]

gets the list count.

So:

Code:

W21 = subStepCount

Then:

Code:

LDR X9, [X8, #0x10]

gets the internal items array.

Then:

Code:

ADD X23, X9, #0x20

moves from the array object to the first element.

So:

Code:

X23 = address of first SubStep pointer

Finally:

Code:

MOV W22, #0

sets:

Code:

i = 0

So this block prepares:

Code:

for i = 0; i < subStepCount; i++

Block B-9: Outer loop start

Code:

Code:

0x7108CB4214    CMP   W22, W21
0x7108CB4218    B.GE  0x7108CB429C

0x7108CB421C    LDR   X10, [X23, X22, LSL #3]

First:

Code:

CMP W22, W21

compares:

Code:

i with subStepCount

Then:

Code:

B.GE 0x7108CB429C

means:

Code:

if i >= subStepCount:
exit the outer loop

If there are still SubSteps left:

Code:

LDR X10, [X23, X22, LSL #3]

loads:

Code:

subStepItems[i]

`LSL #3` means multiply by 8.

Each object pointer is 8 bytes on 64-bit ARM, so:

Code:

X10 = current MissionSubStep

Block B-10: Prepare the inner loop over Objectives

Code:

Code:

0x7108CB4220    LDR   X11, [X10, #0x18]
0x7108CB4224    LDR   X11, [X11, #0x10]
0x7108CB4228    LDR   W24, [X11, #0x18]
0x7108CB422C    LDR   X12, [X11, #0x10]
0x7108CB4230    ADD   X26, X12, #0x20
0x7108CB4234    MOV   W25, #0

Current MissionSubStep is in X10.

First:

Code:

LDR X11, [X10, #0x18]

reads:

Code:

subStep.objectives_

because:

Code:

MissionSubStep.objectives_ = 0x18

Then:

Code:

LDR X11, [X11, #0x10]

gets the internal List.

Then:

Code:

LDR W24, [X11, #0x18]

gets the objective count.

So:

Code:

W24 = objectiveCount

Then:

Code:

LDR X12, [X11, #0x10]

gets the items array.

Then:

Code:

ADD X26, X12, #0x20

gets the address of the first Objective pointer.

So:

Code:

X26 = address of first Objective pointer

Finally:

Code:

MOV W25, #0

sets:

Code:

j = 0

So this prepares:

Code:

for j = 0; j < objectiveCount; j++

Block B-11: Inner loop start

Code:

Code:

0x7108CB4238    CMP   W25, W24
0x7108CB423C    B.GE  0x7108CB4294

0x7108CB4240    LDR   X0,  [X26, X25, LSL #3]

First:

Code:

CMP W25, W24

compares:

Code:

j with objectiveCount

Then:

Code:

B.GE 0x7108CB4294

means:

Code:

if j >= objectiveCount:
exit the inner loop and go to the next SubStep

If there are still Objectives left:

Code:

LDR X0, [X26, X25, LSL #3]

loads:

Code:

objectiveItems[j]

So:

Code:

X0 = current MissionObjective

This is the point where the code has finally reached an actual MissionObjective inside the current mission step.

Block B-12: Check objective status

Code:

Code:

0x7108CB4244    LDR   W1,  [X0, #0x28]
0x7108CB4248    CMP   W1,  #1
0x7108CB424C    B.EQ  0x7108CB4258
0x7108CB4250    CMP   W1,  #2
0x7108CB4254    B.NE  0x7108CB428C

Current MissionObjective is in X0.

First:

Code:

LDR W1, [X0, #0x28]

reads:

Code:

objective.status_

because:

Code:

MissionObjective.status_ = 0x28

Then:

Code:

CMP W1, #1

checks:

Code:

status == Ongoing

If yes:

Code:

B.EQ 0x7108CB4258

continues to the next logic.

If not, it checks:

Code:

CMP W1, #2

This checks:

Code:

status == ReadyToBeCompleted

If it is neither 1 nor 2:

Code:

B.NE 0x7108CB428C

skips this objective.

So the logic is:

Code:

if status == Ongoing:
continue

else if status == ReadyToBeCompleted:
continue

else:
skip objective

This prevents the code from processing objectives that are not active or already finished.

Block B-13: Read ObjectiveData and customStepCase

Code:

Code:

0x7108CB4258    LDR   X13, [X0, #0x78]
0x7108CB425C    LDR   W1,  [X13, #0x48]

First:

Code:

LDR X13, [X0, #0x78]

reads:

Code:

objective.Data

because:

Code:

MissionObjective.Data = 0x78

Then:

Code:

LDR W1, [X13, #0x48]

reads:

Code:

objective.Data.customStepCase_

because:

Code:

MissionObjectiveData.customStepCase_ = 0x48

So after this:

Code:

X13 = MissionObjectiveData
W1 = customStepCase_

Block B-14: Check for MenuAction or DesignChallenge

Code:

Code:

0x7108CB4260    CMP   W1,  #207
0x7108CB4264    B.EQ  0x7108CB4278
0x7108CB4268    CMP   W1,  #140
0x7108CB426C    B.NE  0x7108CB428C

First:

Code:

CMP W1, #207

checks:

Code:

customStepCase_ == MenuAction

If yes:

Code:

B.EQ 0x7108CB4278

jumps to the MenuAction override.

If not, it checks:

Code:

CMP W1, #140

This checks:

Code:

customStepCase_ == DesignChallenge

If it is neither MenuAction nor DesignChallenge:

Code:

B.NE 0x7108CB428C

skips this objective.

So this block means:

Code:

if customStepCase_ == MenuAction:
use MenuAction condition

else if customStepCase_ == DesignChallenge:
use ForceSkipDesignChallenge condition

else:
skip objective

This is the main filter that keeps the code focused on the two DreamSnaps-related objective types.

Block B-15: Convert customStepCase to CheckForAdvanceStep condition

For DesignChallenge:

Code:

0x7108CB4270    MOV   W1,  #14
0x7108CB4274    B     0x7108CB427C

This means:

Code:

condition = ForceSkipDesignChallenge

For MenuAction:

Code:

0x7108CB4278    MOV   W1,  #13

This means:

Code:

condition = MenuAction

This can be confusing because the customStepCase values and condition values are different.

customStepCase values:

Code:

MenuAction      = 207
DesignChallenge = 140

MissionCompleteStep condition values:

Code:

MenuAction               = 13
ForceSkipDesignChallenge = 14

So the code is converting:

Code:

customStepCase_ -> MissionCompleteStep condition

Block B-16: Call CheckForAdvanceStep

Code:

Code:

0x7108CB427C    LDR   X3,  [X13, #0x30]
0x7108CB4280    MOV   X2,  X20
0x7108CB4284    MOV   X0,  X19
0x7108CB4288    BL    0x71035DA5B0

At this point:

Code:

W1 = condition
X13 = MissionObjectiveData
X20 = MissionSlot
X19 = MissionManager

First:

Code:

LDR X3, [X13, #0x30]

reads:

Code:

MissionObjectiveData.stepName_

because:

Code:

stepName_ = 0x30

So:

Code:

X3 = stepName

Then:

Code:

MOV X2, X20

sets:

Code:

X2 = MissionSlot

Then:

Code:

MOV X0, X19

sets:

Code:

X0 = MissionManager

Then:

Code:

BL 0x71035DA5B0

calls:

Code:

MissionManager.CheckForAdvanceStep(
condition,
missionSlot,
stepName
)

Native argument layout:

Code:

X0 = MissionManager instance
W1 = condition
X2 = MissionSlot
X3 = stepName

This is the actual force-advance call.

It does not directly write:

Code:

objective.status = completed

Instead, it passes the condition to the game's mission-advance check function.

That is why this approach can trigger the required mission events/notifications more properly than a raw status overwrite.

Block B-17: Advance the inner loop

Code:

Code:

0x7108CB428C    ADD   W25, W25, #1
0x7108CB4290    B     0x7108CB4238

This means:

Code:

j++
go back to inner loop start

So after checking one Objective, the code moves to the next Objective in the same SubStep.

Block B-18: Advance the outer loop

Code:

Code:

0x7108CB4294    ADD   W22, W22, #1
0x7108CB4298    B     0x7108CB4214

This means:

Code:

i++
go back to outer loop start

So after all Objectives in one SubStep are checked, the code moves to the next SubStep.

Block B-19: Epilogue / restore registers

Code:

Code:

0x7108CB429C    LDP   X26, X27, [SP], #0x10
0x7108CB42A0    LDP   X24, X25, [SP], #0x10
0x7108CB42A4    LDP   X22, X23, [SP], #0x10
0x7108CB42A8    LDP   X20, X21, [SP], #0x10
0x7108CB42AC    LDP   X19, X30, [SP], #0x10
0x7108CB42B0    RET

This restores the registers saved at the beginning.

It restores them in the reverse order.

Then:

Code:

RET

returns to the caller.

This is cleanup. The code borrowed registers, used them, then restored them before returning.

This section is just some background for reading the code. I am not trying to explain every detail of C#, IL2CPP, or AArch64 here. These are only the parts that matter for understanding this patch.

Class, instance, and field
In dump.cs, a class is basically a type of object.

For example:

Code:

public sealed class TrackedActivity
public sealed class TrackedMission
public sealed class MissionSlot
public sealed class MissionObjective
public sealed class MissionObjectiveData

An instance is an actual object of that class while the game is running.

For example, when the game calls:

Code:

MissionManager.OnTrackedMissionChanged(this, trackedActivity, method)

the trackedActivity argument is an actual TrackedActivity object in memory.

A field is data stored inside that object.

For example:

Code:

private object activity_; // 0x18
private TrackedActivity.ActivityOneofCase activityCase_; // 0x20

This means a TrackedActivity object has:

activity_ at offset 0x18
activityCase_ at offset 0x20

So when the assembly does:

Code:

LDR W8, [X1, #0x20]

it means:

Code:

read a 32-bit value from the object pointed to by X1, at offset 0x20

In this case, X1 is the trackedActivity argument, so this reads:

Code:

trackedActivity.activityCase_

Why offsets matter
dump.cs tells us where fields are located inside each object.

For example:

Code:

// TrackedActivity
activity_     // 0x18
activityCase_ // 0x20

// TrackedMission
missionId_    // 0x18

So the assembly can read them directly with offsets:

Code:

LDR X8,  [X1, #0x18]  // trackedActivity.activity_
LDR W20, [X8, #0x18]  // trackedMission.missionId_

This is one of the main ways dump.cs and IDA are used together.

dump.cs tells you what the fields are.
IDA shows you how the compiled code accesses them.

Function arguments in AArch64
On AArch64, the first few function arguments are usually passed in registers:

Code:

X0 = first argument
X1 = second argument
X2 = third argument
X3 = fourth argument
X4 = fifth argument
...

For an instance method, X0 is usually the instance itself, also called this.

So for something like:

Code:

MissionManager.OnTrackedMissionChanged(trackedActivity)

the native call is roughly:

Code:

X0 = MissionManager instance
X1 = trackedActivity
X2 = MethodInfo pointer

That is why the patch treats X0 as MissionManager and X1 as TrackedActivity.

Instance methods and static methods
This is important when calling functions manually.

For an instance method:

Code:

X0 = this
X1 = first normal argument
X2 = second normal argument
X3 = third normal argument

For a static method:

Code:

X0 = first argument
X1 = second argument
X2 = third argument

So if a function is an instance method and you forget to put the correct object in X0, the game will usually crash.

That is why this patch saves the MissionManager instance early:

Code:

MOV X19, X0

and later puts it back into X0 before calling:

Code:

MissionManager.CheckForAdvanceStep(...)

Registers used in this patch
The important registers are used roughly like this:

Code:

X0  = function argument / return value
X1  = function argument
X2  = function argument
X3  = function argument

X19 = MissionManager instance
W20 = missionId first, then X20 = MissionSlot later
W21 = SubStep count
W22 = SubStep loop index
X23 = SubStep array first element
W24 = Objective count
W25 = Objective loop index
X26 = Objective array first element
X30 = link register / return address

X0-X7 are often overwritten by function calls, so the patch uses X19-X27 to keep important values across calls.

Why registers are saved and restored
The patch saves registers like this:

Code:

STP X19, X30, [SP, #-0x10]!
STP X20, X21, [SP, #-0x10]!
STP X22, X23, [SP, #-0x10]!
STP X24, X25, [SP, #-0x10]!
STP X26, X27, [SP, #-0x10]!

This means the code stores those registers on the stack before using them.

At the end, it restores them:

Code:

LDP X26, X27, [SP], #0x10
LDP X24, X25, [SP], #0x10
LDP X22, X23, [SP], #0x10
LDP X20, X21, [SP], #0x10
LDP X19, X30, [SP], #0x10
RET

So the patch borrows those registers, does its work, and then puts them back before returning.

This is not the main logic of the patch. It is just necessary cleanup so the game can continue normally after the custom code runs.

The first problem was choosing where to hook.

The goal was to process one specific mission, but the game can have many active missions at the same time. So I needed a place where the game already knows which mission the player selected.

The tracked mission system was useful for this.

When the player tracks a mission, the game calls:

Code:

Mdl.Missions.MissionManager$$OnTrackedMissionChanged

In IDA, the original function was extremely small:

Code:

Mdl.Missions.MissionManager$$OnTrackedMissionChanged:
B Mdl.Missions.MissionManager$$RefreshCurrentFollower

So originally, OnTrackedMissionChanged just jumped to RefreshCurrentFollower.

That made it a convenient hook point because:

it runs when the tracked activity changes
the tracked activity is passed as an argument
if the tracked activity is a mission, the missionId can be obtained from that argument
the original function is very small
it is easy to preserve the original behavior

The hook replacement
The hook changes the start of the function to:

Code:

CBZ X1, 0x71035D6BA0
B   0x7108CB41B0

This is only two instructions.

The first one is:

Code:

CBZ X1, 0x71035D6BA0

CBZ means:

Code:

Compare and Branch if Zero

So this means:

Code:

if X1 == 0:
branch to 0x71035D6BA0

X1 is the trackedActivity argument.

So in plain English:

Code:

if trackedActivity == null:
go to RefreshCurrentFollower

The second instruction is:

Code:

B 0x7108CB41B0

That simply jumps to the code cave.

So the hook means:

Code:

if trackedActivity is null:
run the original behavior
else:
go to the custom code cave

Why the first null check is useful
If there is no tracked activity, there is nothing useful for the patch to process.

So the safest behavior is to skip the custom code and return to the original function.

That is what this does:

Code:

CBZ X1, 0x71035D6BA0

This first check is only a basic safety check. The more specific "is this actually a mission?" check happens inside the code cave.

The first check inside the code cave
At the start of the code cave:

Code:

LDR W8, [X1, #0x20]
CMP W8, #1
B.NE 0x71035D6BA0

This reads:

Code:

trackedActivity.activityCase_

The dump.cs field is:

Code:

private TrackedActivity.ActivityOneofCase activityCase_; // 0x20

So:

Code:

LDR W8, [X1, #0x20]

means:

Code:

W8 = trackedActivity.activityCase_

Then:

Code:

CMP W8, #1

compares activityCase_ with 1.

The enum says:

Code:

public const TrackedActivity.ActivityOneofCase Mission = 1;

So this is checking whether the tracked activity is a Mission.

Then:

Code:

B.NE 0x71035D6BA0

means:

Code:

if activityCase_ is not Mission:
go to RefreshCurrentFollower

So the code cave begins like this:

Code:

if trackedActivity.activityCase_ != Mission:
return to the original RefreshCurrentFollower behavior

Why this check is needed
TrackedActivity is not always a mission.

The enum contains several possible activity types:

Code:

None    = 0
Mission = 1
StarPath = 2
Crafting = 3
Duty    = 4
Story   = 5
Keyhole = 6

So without this check, the code could treat StarPath, Crafting, Duty, Story, or Keyhole as if it were a mission.

That would be wrong and could easily crash the game.

So the first real filter is: only continue if the tracked activity is a mission.

Part 1 in plain English
This part of the code does only this:

Hook OnTrackedMissionChanged.
If trackedActivity is null, return to the original function.
Jump to the code cave.
Inside the code cave, read trackedActivity.activityCase_.
If the tracked activity is not a Mission, return to the original function.
Only continue if the player tracked a mission.

At this point, the code has not advanced anything yet.
It has only confirmed that the tracked activity exists and that it is actually a mission.

At the end of Part 1, the code has only confirmed one thing:

Code:

trackedActivity exists
trackedActivity.activityCase_ == Mission

So at this point, it is safe to treat:

Code:

trackedActivity.activity_

as a TrackedMission object.

The next goal is to get the missionId from that TrackedMission.

The relevant dump.cs fields

From TrackedActivity:

Code:

private object activity_; // 0x18
private TrackedActivity.ActivityOneofCase activityCase_; // 0x20

From TrackedMission:

Code:

private int missionId_; // 0x18

So the structure is:

Code:

TrackedActivity
-> activity_      // 0x18
-> activityCase_  // 0x20

TrackedMission
-> missionId_     // 0x18

The code already checked:

Code:

TrackedActivity.activityCase_ == Mission

So now it can read:

Code:

TrackedActivity.activity_

and treat it as:

Code:

TrackedMission*

The actual assembly

This is the relevant part:

Code:

STP X19, X30, [SP, #-0x10]!
STP X20, X21, [SP, #-0x10]!
STP X22, X23, [SP, #-0x10]!
STP X24, X25, [SP, #-0x10]!
STP X26, X27, [SP, #-0x10]!

MOV X19, X0
LDR X8,  [X1, #0x18]
LDR W20, [X8, #0x18]

The register save part was explained earlier, so the important lines here are:

Code:

MOV X19, X0
LDR X8,  [X1, #0x18]
LDR W20, [X8, #0x18]

What X0 and X1 are here

The original function is roughly:

Code:

MissionManager.OnTrackedMissionChanged(
trackedActivity
)

As a native instance method, the arguments are passed roughly like this:

Code:

X0 = MissionManager instance
X1 = trackedActivity
X2 = MethodInfo

So at the start of the function:

Code:

X0 = this MissionManager
X1 = trackedActivity

Saving the MissionManager instance

The first important instruction is:

Code:

MOV X19, X0

This copies X0 into X19.

Since X0 is the MissionManager instance, this means:

Code:

X19 = MissionManager instance

The reason for saving it is simple: X0 will be reused many times as an argument and return-value register.

When the code calls other functions with BL, X0 can be overwritten. So the patch stores the MissionManager instance in X19, a callee-saved register, so it can use it later.

Later, when calling CheckForAdvanceStep, the code needs the MissionManager instance again:

Code:

MOV X0, X19

That puts the saved MissionManager back into X0.

In short: X19 is used as a safe place to keep the MissionManager pointer while the rest of the code calls other functions.

Reading trackedActivity.activity_

The next instruction is:

Code:

LDR X8, [X1, #0x18]

From dump.cs:

Code:

private object activity_; // 0x18

So this reads:

Code:

trackedActivity.activity_

Since X1 is trackedActivity, this means:

Code:

X8 = trackedActivity.activity_

Because Part 1 already confirmed:

Code:

trackedActivity.activityCase_ == Mission

this activity_ object should be a TrackedMission.

So conceptually:

Code:

TrackedMission trackedMission = trackedActivity.activity_;

Reading trackedMission.missionId_

The next instruction is:

Code:

LDR W20, [X8, #0x18]

From dump.cs:

Code:

private int missionId_; // 0x18

So this reads:

Code:

trackedMission.missionId_

Since missionId_ is an int, the code uses W20 instead of X20.

Code:

W20 = trackedMission.missionId_

In C-like pseudocode, these two instructions are:

Code:

TrackedMission* trackedMission = trackedActivity->activity_;
int missionId = trackedMission->missionId_;

Why W20, not X20?

AArch64 has 64-bit X registers and 32-bit W views of the same registers.

For example:

Code:

X20 = full 64-bit register
W20 = lower 32-bit part of X20

missionId_ is an int, so it is a 32-bit value.

That is why the code uses:

Code:

LDR W20, [X8, #0x18]

not:

Code:

LDR X20, [X8, #0x18]

Later, when the code needs to pass missionId as an argument, it uses W20:

Code:

MOV W1, W20

because the function expects an int mission item / mission id value.

What has been obtained at this point

After this block:

Code:

MOV X19, X0
LDR X8,  [X1, #0x18]
LDR W20, [X8, #0x18]

the code has two important values saved:

Code:

X19 = MissionManager instance
W20 = missionId of the tracked mission

Nothing has been advanced yet.

The code has only identified which mission the player tracked.

Calling the original tracked-mission behavior

After getting the missionId, the code calls:

Code:

BL 0x71035D6BA0

This is:

Code:

Mdl.Missions.MissionManager$$RefreshCurrentFollower

This was the original function that OnTrackedMissionChanged was going to branch to.

So the patch does not skip the original behavior.

The flow is:

Code:

read missionId from trackedActivity
call original RefreshCurrentFollower
continue custom logic

This matters because the tracked mission change may also update UI, follower behavior, or other normal game state. The patch should not remove that behavior unless necessary.

Part 2 in plain English

This part of the code does this:

Save the MissionManager instance from X0 into X19.
Read trackedActivity.activity_ from X1 + 0x18.
Because activityCase_ was Mission, treat activity_ as TrackedMission.
Read trackedMission.missionId_ from activity_ + 0x18.
Store that missionId in W20.
Call the original RefreshCurrentFollower function.

At this point, the code knows which mission the player tracked, but it has not found the mission step or objective yet.

That happens in the next part, where the missionId is used to get the MissionSlot and then walk down to the current MissionObjective.

Before explaining the double loop, it is probably better to explain what I mean by RepeatedField and List here.

In dump.cs, the mission step does not directly contain just one substep. It contains this:

Code:

private readonly RepeatedField<MissionSubStep> subSteps_; // 0x18

And each substep does not directly contain just one objective. It contains this:

Code:

private readonly RepeatedField<MissionObjective> objectives_; // 0x18

If you are not familiar with C# or protobuf, the important part is not the exact name RepeatedField.

For this patch, I just treated it as:

a container that holds multiple objects of the same type.

So:

Code:

RepeatedField<MissionSubStep>

basically means:

Code:

a list of MissionSubStep objects

And:

Code:

RepeatedField<MissionObjective>

basically means:

Code:

a list of MissionObjective objects

This is not meant to be a perfect explanation of Google's protobuf RepeatedField. For this patch, the important thing is simply that it behaves like a list of entries.

What a list looks like conceptually

A list is just a group of items arranged in order.

For example:

Code:

Objectives:
[0] MissionObjective
[1] MissionObjective
[2] MissionObjective
[3] MissionObjective

To loop through it, you need two things:

how many items are in the list
where the items start

The first one is the count.

The second one is the item array.

So conceptually, the code needs:

Code:

count = how many objectives exist
items = where the objective pointers are stored

Then it can do:

Code:

for i = 0; i < count; i++:
objective = items[i]

Why count is easy to understand

The List<T>.get_Count function is very simple in IDA:

Code:

LDR W0, [X0,#0x18]
RET

That means the count is stored at:

Code:

list + 0x18

So when the code does:

Code:

LDR W21, [X8, #0x18]

or:

Code:

LDR W24, [X11, #0x18]

it is reading the number of items in the list.

In plain English:

Code:

W21 = number of SubSteps
W24 = number of Objectives

What "items" means

The word "Item" can sound more complicated than it really is.

Here, it just means one entry in the list.

If the list is:

Code:

[ MissionObjective, MissionObjective, MissionObjective ]

then:

Code:

Item[0] = first MissionObjective
Item[1] = second MissionObjective
Item[2] = third MissionObjective

Internally, the list has an array that stores these entries.

On 64-bit, object references are 8 bytes each.

So if the first element starts at some address, the next one is 8 bytes after it, and the next one is another 8 bytes after that.

Conceptually:

Code:

first item address + index * 8

That is what this means:

Code:

LDR X10, [X23, X22, LSL #3]

`LSL #3` means multiply by 8.

So this line means:

Code:

X10 = subStepItems[i]

The same idea is used for objectives:

Code:

LDR X0, [X26, X25, LSL #3]

which means:

Code:

X0 = objectiveItems[j]

Why the code uses +0x20

In IL2CPP, the array object itself has a header before the actual elements.

So the pointer to the array object is not the same as the pointer to the first element.

The actual element data starts after the array header.

In this case, the first element is treated as:

Code:

items array + 0x20

So the code does:

Code:

ADD X23, X9, #0x20

for SubSteps, and:

Code:

ADD X26, X12, #0x20

for Objectives.

In plain English:

Code:

X23 = address of the first SubStep pointer
X26 = address of the first Objective pointer

After that, the code can read each entry by adding index * 8.

The simple mental model

The easiest way to think about it is this:

Code:

RepeatedField<T>
-> internal List<T>
-> count
-> array of item pointers
-> item[0]
-> item[1]
-> item[2]

The code does not need to understand every detail of protobuf.

It only needs to know:

where the count is
where the item array is
where the first item starts
how large each item pointer is

For this code, the useful pattern is:

Code:

list          = repeatedField + 0x10
count         = list + 0x18
items array   = list + 0x10
first item    = items array + 0x20
item[index]   = first item + index * 8

Once that pattern is known, the double loop becomes much easier to read.

It is just:

Code:

for each SubStep in currentStep.SubSteps:
for each Objective in subStep.Objectives:
check this Objective

In Part 2, the code got the missionId from the tracked mission.

The next goal is to use that missionId to get the current mission data, then walk down to the actual MissionObjective.

The structure is not flat. It is:

Code:

MissionSlot
-> CurrentStep
-> SubSteps
-> Objectives
-> MissionObjective

So this part has two jobs:

Get the MissionSlot from the missionId.
Walk through the current step's SubSteps and Objectives.

Getting the MissionSlot

The code first gets the profile:

Code:

BL  0x71035CC490
LDR X0, [X0, #0x30]

The first instruction calls:

Code:

MissionManager.get_Profile()

The return value is in X0.

Then:

Code:

LDR X0, [X0, #0x30]

gets the ProfileWorld from the profile.

After that, the code prepares arguments for:

Code:

ProfileWorld.GetMissionSlot(missionId, null)

The assembly is:

Code:

MOV W1, W20
MOV X2, XZR
BL  0x7105501320
MOV X20, X0

At this point:

Code:

X0 = ProfileWorld
W1 = missionId
X2 = null

After the call returns:

Code:

X0 = MissionSlot

So the code saves it:

Code:

X20 = MissionSlot

The missionId is not used as the main filter. It is only used to obtain the MissionSlot for the mission currently being tracked.

Getting the current step

Next, the code calls:

Code:

BL 0x7105D1BA90

This is:

Code:

MissionSlot.get_CurrentStep()

The MissionSlot class has:

Code:

private int currentStepIndex_; // 0x20
private readonly RepeatedField<MissionStep> missionSteps_; // 0x28

So CurrentStep is basically selected from missionSteps_ using currentStepIndex_.

The original game function also shows this idea. It reads the current step index from the MissionSlot, checks it against the missionSteps count, and then gets the item from the RepeatedField.

So after this call:

Code:

X0 = current MissionStep

How I knew this was a nested repeated-field structure

dump.cs already shows that MissionStep contains a repeated field of MissionSubStep:

Code:

private readonly RepeatedField<MissionSubStep> subSteps_; // 0x18

And MissionSubStep contains a repeated field of MissionObjective:

Code:

private readonly RepeatedField<MissionObjective> objectives_; // 0x18

So the high-level structure is clear:

Code:

MissionStep
-> RepeatedField<MissionSubStep> subSteps_
-> RepeatedField<MissionObjective> objectives_

But dump.cs alone does not fully explain how to access the native memory layout safely from a code cave.

For that, I checked how the game itself handles these fields in IDA.

The useful functions were:

Code:

MissionStep.get_AllObjectives
MissionStep.get_ActiveObjectives
MissionStep.FirstObjectiveOf
MissionSlot.get_CurrentStep

For example, MissionStep.get_AllObjectives uses the MissionStep's subSteps_ field and then applies SelectMany to collect objectives from the substeps.

MissionStep.FirstObjectiveOf also calls get_AllObjectives first, then applies a predicate to find the first matching MissionObjective.

So the idea was not to invent the structure from nothing. I checked how the original game code treats the same fields, then used the same kind of layout knowledge in the code cave.

RepeatedField and List layout

RepeatedField<T> internally contains a List<T>:

Code:

private readonly List<T> list; // 0x0

The List<T> implementation shows the important native offsets.

The Count getter is:

Code:

LDR W0, [X0,#0x18]
RET

So List<T>.Count is at:

Code:

list + 0x18

The Item getter also reads the item array from:

Code:

list + 0x10

and then reads from the array data area.

For an Il2Cpp array, the actual element data starts after the array object header, so the first element is at:

Code:

items + 0x20

Since these are object references, each element is 8 bytes on 64-bit ARM.

So the direct-access pattern is:

Code:

count         = list + 0x18
items array   = list + 0x10
first element = items array + 0x20
element[i]    = first element + i * 8

That is the pattern used by the code cave.

This is why the code uses +0x10, +0x18, +0x20, and LSL #3. LSL #3 means index * 8, because each object pointer is 8 bytes.

Outer loop: SubSteps

After MissionSlot.get_CurrentStep(), X0 contains the current MissionStep.

The code then gets the subSteps_ field:

Code:

LDR X8, [X0, #0x18]

From dump.cs:

Code:

private readonly RepeatedField<MissionSubStep> subSteps_; // 0x18

So this means:

Code:

X8 = currentStep.subSteps_

Then:

Code:

LDR X8, [X8, #0x10]

RepeatedField<T> contains a List<T>, so this gets the internal List<T>.

Then:

Code:

LDR W21, [X8, #0x18]

reads the List count:

Code:

W21 = subStepCount

Then:

Code:

LDR X9, [X8, #0x10]
ADD X23, X9, #0x20
MOV W22, #0

This means:

Code:

X9  = items array
X23 = first element address
W22 = i = 0

So the outer loop is:

Code:

for i in range(subStepCount):
subStep = subSteps[i]

In assembly:

Code:

CMP W22, W21
B.GE exit_outer_loop

LDR X10, [X23, X22, LSL #3]

`X22, LSL #3` means:

Code:

i * 8

So:

Code:

X10 = subStepItems[i]

Inner loop: Objectives

Now X10 is the current MissionSubStep.

The code gets its objectives_ field:

Code:

LDR X11, [X10, #0x18]

From dump.cs:

Code:

private readonly RepeatedField<MissionObjective> objectives_; // 0x18

So:

Code:

X11 = subStep.objectives_

Then it follows the same pattern:

Code:

LDR X11, [X11, #0x10]
LDR W24, [X11, #0x18]
LDR X12, [X11, #0x10]
ADD X26, X12, #0x20
MOV W25, #0

This means:

Code:

objectiveList  = objectives_.list
objectiveCount = objectiveList.Count
objectiveItems = objectiveList._items
firstObjective = objectiveItems + 0x20
j = 0

Then the inner loop is:

Code:

CMP W25, W24
B.GE exit_inner_loop

LDR X0, [X26, X25, LSL #3]

So:

Code:

if j >= objectiveCount:
go to next SubStep

X0 = objectiveItems[j]

At this point, X0 is the actual MissionObjective pointer.

Why the code uses a double loop

The double loop exists because the mission data is nested:

Code:

MissionStep has many SubSteps
Each SubStep has many Objectives

So one loop is not enough.

The outer loop walks:

Code:

MissionStep.SubSteps

The inner loop walks:

Code:

MissionSubStep.Objectives

Only after both loops does the code reach a MissionObjective.

Part 3 in plain English

This part does this:

Use missionId to get the current MissionSlot.
Call MissionSlot.get_CurrentStep() to get the current MissionStep.
Read currentStep.subSteps_.
Use the internal List count and items array to loop through SubSteps.
For each SubStep, read subStep.objectives_.
Use the same List pattern to loop through Objectives.
Put the current MissionObjective pointer in X0.

At the end of this part, the code has not advanced anything yet.

It has only walked down from the tracked mission to each MissionObjective in the current step.

The actual filtering happens in the next part.

At this point, the code has already done the difficult part.

It has:

found the currently tracked mission
got the MissionSlot
got the current MissionStep
looped through SubSteps and Objectives
found a MissionObjective that matches one of the two DreamSnaps-related cases

So now the code needs to actually advance that objective.

This is the part where it calls:

Code:

Mdl.Missions.MissionManager$$CheckForAdvanceStep

Why not just edit the objective status?

A simple approach would be to directly change the objective status.

For example, something like:

Code:

objective.status = Completed

But that is not enough.

Mission progress in this game is not just a number changing from Ongoing to Completed. A mission step can also trigger:

completion events
notifications
UI updates
item giving
next-step initialization
world-state changes

I tried more direct ways to force mission progress, but that caused problems. The objective could appear to advance, but later quest logic did not initialize correctly.

One example was Vanellope's house. The quest could move forward, but the house was not added or initialized correctly afterward.

So the safer approach was to avoid directly overwriting the mission state and instead pass the objective through a game function that already handles mission advancement.

The function used

The function used here is:

Code:

Mdl.Missions.MissionManager$$CheckForAdvanceStep

Conceptually, the call is:

Code:

MissionManager.CheckForAdvanceStep(
condition,
missionSlot,
stepName
)

Since this is an instance method, the native arguments are arranged like this:

Code:

X0 = MissionManager instance
W1 = condition
X2 = MissionSlot
X3 = stepName

That is why the code prepares those registers before the call.

Condition value: MenuAction or ForceSkipDesignChallenge

In Part 4, the code checked:

Code:

MissionObjectiveData.customStepCase_

The two objective types were:

Code:

MenuAction      = 207
DesignChallenge = 140

But these are not the same values passed to CheckForAdvanceStep.

CheckForAdvanceStep expects a MissionCompleteStep condition.

The relevant condition enum is:

Code:

MenuAction               = 13
ForceSkipDesignChallenge = 14

So the code converts the custom step type into the condition value that CheckForAdvanceStep expects.

For DesignChallenge:

Code:

MOV W1, #14

That means:

Code:

condition = ForceSkipDesignChallenge

For MenuAction:

Code:

MOV W1, #13

That means:

Code:

condition = MenuAction

This is an easy place to get confused. customStepCase_ identifies the objective type. The condition value is what CheckForAdvanceStep uses to test or complete that kind of step.

Getting stepName

Once the correct condition is in W1, the code reads the stepName:

Code:

LDR X3, [X13, #0x30]

At this point, X13 is the MissionObjectiveData pointer.

From dump.cs, MissionObjectiveData contains:

Code:

private string stepName_; // 0x30

So this instruction means:

Code:

X3 = objective.Data.stepName_

stepName is passed as the fourth argument.

Passing the MissionSlot

The code already saved the MissionSlot earlier in X20.

So it does:

Code:

MOV X2, X20

That means:

Code:

X2 = MissionSlot

This is the third argument to CheckForAdvanceStep.

Passing the MissionManager instance

The code saved the MissionManager instance at the beginning of the code cave:

Code:

MOV X19, X0

That was done because X0 gets overwritten by function calls.

Now, before calling CheckForAdvanceStep, the code puts the MissionManager instance back into X0:

Code:

MOV X0, X19

So:

Code:

X0 = MissionManager instance

This is important because CheckForAdvanceStep is an instance method. If X0 does not contain the correct MissionManager instance, the call will not work correctly.

The actual call

The final call setup is:

Code:

LDR X3, [X13, #0x30]
MOV X2, X20
MOV X0, X19
BL  0x71035DA5B0

In plain English:

Code:

stepName = objective.Data.stepName_

MissionManager.CheckForAdvanceStep(
condition,
missionSlot,
stepName
)

Where:

Code:

X0 = MissionManager
W1 = condition
X2 = MissionSlot
X3 = stepName

The condition was already set just before this block:

Code:

MenuAction               -> W1 = 13
DesignChallenge           -> W1 = 14

Why this worked better than direct forcing

The important part is that CheckForAdvanceStep is closer to the game's normal manual-completion path.

The MissionSlot class also has functions like:

Code:

CheckManualCompletion(...)
CheckManualCompletionForBringItem(...)
AdvanceStep()

So the mission system already has its own way to check conditions and advance steps.

By calling CheckForAdvanceStep with the right MissionSlot, condition, and stepName, the patch lets the game's mission system do more of the normal work.

That is why it can trigger the required event/notification behavior better than simply changing a status value.

The patch is not just saying "this objective is completed now." It is asking the mission system to process the matching condition for the current mission step.

After the call

After CheckForAdvanceStep returns, the code does not immediately stop the whole loop.

It continues:

Code:

ADD W25, W25, #1
B   0x7108CB4238

That means:

Code:

j++
continue checking objectives

When all objectives in the current SubStep are done, it goes to the next SubStep:

Code:

ADD W22, W22, #1
B   0x7108CB4214

That means:

Code:

i++
continue checking subSteps

So even after one matching objective is processed, the loop structure stays normal.

Restoring registers and returning

At the end, the code restores the registers it saved at the beginning:

Code:

LDP X26, X27, [SP], #0x10
LDP X24, X25, [SP], #0x10
LDP X22, X23, [SP], #0x10
LDP X20, X21, [SP], #0x10
LDP X19, X30, [SP], #0x10
RET

This puts back the saved registers and returns normally.

This is just cleanup. The important work was already done by the CheckForAdvanceStep call.

Part 5 in plain English

This part does this:

Convert the matched objective type into the correct MissionCompleteStep condition.
Read stepName from MissionObjectiveData.
Pass the current MissionSlot.
Pass the MissionManager instance.
Call MissionManager.CheckForAdvanceStep.
Continue the loop normally.
Restore registers and return.

So the final action is not a raw status overwrite.

It is:

Code:

Find the right objective
prepare the condition
call the game's mission-advance check function

That is the main reason this approach works without skipping too much of the quest logic.

This is just the reference material I used while reading the code. The main explanation above is easier to read, but these excerpts show where the offsets and enum values came from.

Code:

// Namespace: Meta
public sealed class TrackedActivity : IMessage<TrackedActivity>, IMessage, IEquatable<TrackedActivity>, IDeepCloneable<TrackedActivity>, IMessageFieldAccessor, IMessageOneofAccessor, IJsonWritableFields // TypeDefIndex: 3751
{
// Fields
private static readonly MessageParser<TrackedActivity> *parser; // 0x0
private UnknownFieldSet *unknownFields; // 0x10
public const int MissionFieldNumber = 1;
public const int StarPathFieldNumber = 2;
public const int CraftingFieldNumber = 3;
public const int DutyFieldNumber = 4;
public const int StoryFieldNumber = 5;
public const int KeyholeFieldNumber = 6;
private object activity*; // 0x18
private TrackedActivity.ActivityOneofCase activityCase*; // 0x20
}

Code:

// Namespace: Meta
public sealed class TrackedMission : IMessage<TrackedMission>, IMessage, IEquatable<TrackedMission>, IDeepCloneable<TrackedMission>, IMessageFieldAccessor, IJsonWritableFields // TypeDefIndex: 3738
{
// Fields
private static readonly MessageParser<TrackedMission> _parser; // 0x0
private UnknownFieldSet *unknownFields; // 0x10
public const int MissionIdFieldNumber = 1;
private int missionId*; // 0x18
}

Code:

// Namespace:
public enum TrackedActivity.ActivityOneofCase // TypeDefIndex: 3749
{
// Fields
public int value__; // 0x0
public const TrackedActivity.ActivityOneofCase None = 0;
public const TrackedActivity.ActivityOneofCase Mission = 1;
public const TrackedActivity.ActivityOneofCase StarPath = 2;
public const TrackedActivity.ActivityOneofCase Crafting = 3;
public const TrackedActivity.ActivityOneofCase Duty = 4;
public const TrackedActivity.ActivityOneofCase Story = 5;
public const TrackedActivity.ActivityOneofCase Keyhole = 6;
}

Code:

// Namespace: Meta.Missions
public sealed class MissionSlot : IMessage<MissionSlot>, IMessage, IEquatable<MissionSlot>, IDeepCloneable<MissionSlot>, IMessageFieldAccessor, IJsonWritableFields, IMissionIdentifier // TypeDefIndex: 6503
{
// Fields
private static readonly MessageParser<MissionSlot> *parser; // 0x0
private UnknownFieldSet *unknownFields; // 0x10
public const int CharacterIdFieldNumber = 1;
private int characterId*; // 0x18
public const int MissionIdFieldNumber = 2;
private int missionId*; // 0x1C
public const int CurrentStepIndexFieldNumber = 3;
private int currentStepIndex_; // 0x20
public const int MissionStepsFieldNumber = 4;
private static readonly FieldCodec<MissionStep> *repeated_missionSteps_codec; // 0x8
private readonly RepeatedField<MissionStep> missionSteps*; // 0x28
}

Code:

// Namespace: Meta.Missions
public sealed class MissionStep : IMessage<MissionStep>, IMessage, IEquatable<MissionStep>, IDeepCloneable<MissionStep>, IMessageFieldAccessor, IJsonWritableFields, IMissionIdentifier // TypeDefIndex: 6421
{
// Fields
private static readonly MessageParser<MissionStep> _parser; // 0x0
private UnknownFieldSet _unknownFields; // 0x10
public const int SubStepsFieldNumber = 1;
private static readonly FieldCodec<MissionSubStep> *repeated_subSteps_codec; // 0x8
private readonly RepeatedField<MissionSubStep> subSteps*; // 0x18
[CompilerGenerated]
private int <StepIndex>k__BackingField; // 0x20
[CompilerGenerated]
private MissionStepData <Data>k__BackingField; // 0x28
internal MissionSlot MissionSlot; // 0x30
}

Code:

// Namespace: Meta.Missions
public sealed class MissionSubStep : IMessage<MissionSubStep>, IMessage, IEquatable<MissionSubStep>, IDeepCloneable<MissionSubStep>, IMessageFieldAccessor, IJsonWritableFields, IMissionIdentifier // TypeDefIndex: 6428
{
// Fields
private static readonly MessageParser<MissionSubStep> _parser; // 0x0
private UnknownFieldSet _unknownFields; // 0x10
public const int ObjectivesFieldNumber = 1;
private static readonly FieldCodec<MissionObjective> *repeated_objectives_codec; // 0x8
private readonly RepeatedField<MissionObjective> objectives*; // 0x18
}

Code:

// Namespace: Meta.Missions
public sealed class MissionObjective : IMessage<MissionObjective>, IMessage, IEquatable<MissionObjective>, IDeepCloneable<MissionObjective>, IMessageFieldAccessor, IJsonWritableFields, IMissionIdentifier, IEquationKeyProvider // TypeDefIndex: 6481
{
// Fields
private static readonly MessageParser<MissionObjective> *parser; // 0x0
private UnknownFieldSet *unknownFields; // 0x10
public const int TargetAmountFieldNumber = 2;
private float targetAmount*; // 0x18
public const int ProgressKeysFieldNumber = 3;
private static readonly MapField.Codec<string, string> *map_progressKeys_codec; // 0x8
private readonly MapField<string, string> progressKeys*; // 0x20
public const int StatusFieldNumber = 4;
private MissionStepStatus status*; // 0x28
...
[CompilerGenerated]
private MissionObjectiveData <Data>k__BackingField; // 0x78
}

Code:

// Namespace: Definitions.Items
public sealed class MissionObjectiveData : IMessage<MissionObjectiveData>, IMessage, IEquatable<MissionObjectiveData>, IDeepCloneable<MissionObjectiveData>, IMessageFieldAccessor, IMessageOneofAccessor, IJsonWritableFields, IMissionStepName, IStepDescriptionsMobile, ICustomStepOwner, IItemSelector, IItemGeneratorOwner, IDataValidation // TypeDefIndex: 9550
{
// Fields
private static readonly MessageParser<MissionObjectiveData> *parser; // 0x0
private UnknownFieldSet *unknownFields; // 0x10
public const int StepDescriptionFieldNumber = 1;
private string stepDescription*; // 0x18
public const int StepDescriptionMobileFieldNumber = 2;
private string stepDescriptionMobile*; // 0x20
public const int ObjectiveIDFieldNumber = 8;
private int objectiveID_; // 0x28
public const int StepNameFieldNumber = 9;
private string stepName_; // 0x30
...
private object customStep_; // 0x40
private MissionObjectiveData.CustomStepOneofCase customStepCase_; // 0x48
}

Code:

// Namespace: Definitions.Items
public enum MissionStepStatus // TypeDefIndex: 9818
{
// Fields
public int value__; // 0x0
[OriginalName("MissionStepStatus_NotStarted")]
public const MissionStepStatus NotStarted = 0;
[OriginalName("MissionStepStatus_Ongoing")]
public const MissionStepStatus Ongoing = 1;
[OriginalName("MissionStepStatus_ReadyToBeCompleted")]
public const MissionStepStatus ReadyToBeCompleted = 2;
[OriginalName("MissionStepStatus_Completed")]
public const MissionStepStatus Completed = 3;
[OriginalName("MissionStepStatus_Confirmed")]
public const MissionStepStatus Confirmed = 4;
[OriginalName("MissionStepStatus_Init")]
public const MissionStepStatus Init = -1;
}

Code:

// Namespace:
public enum MissionObjectiveData.CustomStepOneofCase // TypeDefIndex: 9547
{
// Fields
public int value__; // 0x0
public const MissionObjectiveData.CustomStepOneofCase None = 0;
...
public const MissionObjectiveData.CustomStepOneofCase DesignChallenge = 140;
...
public const MissionObjectiveData.CustomStepOneofCase MenuAction = 207;
...
}

Code:

// Namespace:
public enum MissionCompleteStep.Types.Condition // TypeDefIndex: 1512
{
// Fields
public int value__; // 0x0
[OriginalName("DialogueStart")]
public const MissionCompleteStep.Types.Condition DialogueStart = 0;
[OriginalName("DialogueEnd")]
public const MissionCompleteStep.Types.Condition DialogueEnd = 1;
...
[OriginalName("MenuAction")]
public const MissionCompleteStep.Types.Condition MenuAction = 13;
[OriginalName("ForceSkipDesignChallenge")]
public const MissionCompleteStep.Types.Condition ForceSkipDesignChallenge = 14;
}

Code:

.text:0000007103AF7C40 ; int32_t System_Collections_Generic_List___Il2CppFullySharedGenericType___get_Count(System_Collections_Generic_List_T__o *this, const MethodInfo_3AF7C40 *method)
.text:0000007103AF7C40 System.Collections.Generic.List___Il2CppFullySharedGenericType_$$get_Count
.text:0000007103AF7C40                 LDR             W0, [X0,#0x18]
.text:0000007103AF7C44                 RET

Code:

.text:0000007103AF7D90 ; Unity_IL2CPP_Metadata___Il2CppFullySharedGenericType_o System_Collections_Generic_List___Il2CppFullySharedGenericType___get_Item(System_Collections_Generic_List_T__o *this, int32_t index, const MethodInfo_3AF7D90 *method)
.text:0000007103AF7D90 System.Collections.Generic.List___Il2CppFullySharedGenericType_$$get_Item
.text:0000007103AF7D98                 LDR             W8, [X0,#0x18]
.text:0000007103AF7D9C                 CMP             W8, W1
.text:0000007103AF7DA0                 B.LS            loc_7103AF7DE0
.text:0000007103AF7DA4                 LDR             X9, [X0,#0x10]
.text:0000007103AF7DA8                 CBZ             X9, loc_7103AF7DE8
...
.text:0000007103AF7DC8                 MADD            X9, X11, X10, X9
...
.text:0000007103AF7DD0                 ADD             X1, X9, #0x20 ; src

Code:

// Hook
0x71035DA7D0    CBZ   X1, 0x71035D6BA0
0x71035DA7D4    B     0x7108CB41B0

Code:

// CheckForAdvanceStep call
0x7108CB427C    LDR   X3,  [X13, #0x30]
0x7108CB4280    MOV   X2,  X20
0x7108CB4284    MOV   X0,  X19
0x7108CB4288    BL    0x71035DA5B0

Disney Dreamlight Valley [0100D39012C1A000]

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

New Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Attachments

Active Member

Well-Known Member

Well-Known Member

Similar threads

Popular threads in this forum