Homebrew How do I get started with cheat code making?

FAST6191

Techromancer
Editorial Team
Joined
Nov 21, 2005
Messages
36,798
Trophies
3
XP
28,321
Country
United Kingdom
Make some cheat codes.

Though more seriously it is more or less the same between all devices
https://web.archive.org/web/20080309104350/http://etk.scener.org/?op=tutorial
It is for the GBA but should be similar enough to anything you see anywhere.

Learn to make those sorts of codes and then you can come back and learn to hardpatch them ( https://web.archive.org/web/20120813230516/http://crackerscrap.com/docs/dshooking.html ) or fiddle with the binary (which you can in turn deploy as a cheat if you really want).

Might also want to learn about slide codes and pointers
https://doc.kodewerx.org/hacking_nds.html

If you want a bit more of a challenge and basic infinite life, ammo, consumables and whatnot is getting harder figure out an inventory code for something (including how to find say a starting town item and then use that to get the fun rare end game stuff) and a stats cheat in either an RPG or a tactics game.
There are plenty of other things you can look at, and do it to enough games and you will start to notice patterns and tricks you can exploit to narrow things down but I will leave that for a while. ROM hacking (guide in my signature) might also be worth looking into.
 

banjo2

gamer
OP
Member
Joined
May 31, 2016
Messages
2,344
Trophies
1
Location
society
Website
youtube.com
XP
5,125
Country
United States
Make some cheat codes.

Though more seriously it is more or less the same between all devices
https://web.archive.org/web/20080309104350/http://etk.scener.org/?op=tutorial
It is for the GBA but should be similar enough to anything you see anywhere.
I've done simple stuff (like max score, infinite reinforcements, etc) in other games, with Cheat Engine and ArtMoney but I've never done it with emulated games, so I guess I already understand as far as day 1.

I don't have an emulator setup, though. Which emulator do you suggest? How do I set it up?
 

FAST6191

Techromancer
Editorial Team
Joined
Nov 21, 2005
Messages
36,798
Trophies
3
XP
28,321
Country
United Kingdom
Most emulators that are not the PS1 or N64 are usually "extract emulator to directory, run emulator", maybe you also have to configure controls. Some might occasionally support a BIOS or a firmware but will usually have workarounds for that one. Any cheat menu is usually well within the usual paradigm ( https://xkcd.com/627/ ) for computer use/fixing.
There are tools that reach out and touch memory of another program a la artmoney. In emulator world you will probably then first encounter emuhaste ( https://www.emucr.com/2012/03/emuhaste-v40.html ). For many systems it can represent the best option for cheats (if you find a megadrive/genesis emulator with a good cheat search and debugger please do share) but for the GBA and DS at least its usefulness varies as they have long had good options.
In theory some of the emulator frontend projects could do something useful but I usually find them wanting on a lot of things (both in drama created, approach to source code, and resulting features/abilities/ease of use) so avoid them.
For general emulators then https://www.emulator-zone.com/ is frequently outdated but usually serves as a good jumping off point.
Some also like to look at what the tool assisted speedrun community are doing at any given point for when your entire hobby revolves around memory manipulation, observation and checking things there to do further actions with you tend to have some good tools for it. Don't know what exists for the DS though.

For the DS for cheats and hacking purposes these days I would probably go with

Desmume mainly for cheats.
http://desmume.org/
There are a few forks like the 3d higher resolution render option ( https://gbatemp.net/threads/hi-resolution-ds-emulation.364549/ ), some even doing stuff for hackers (see https://gbatemp.net/threads/unofficial-desmume-build-unused-memory-finder-tool.349332/ ) but vanilla is good stuff even so.

no$gba. Does great cheats, its debug options, which went free a while back, are best in class as well (desmume can interface with GDB but eh).
http://problemkaputt.de/gba.htm#debug (the base version does have some good cheat stuff though).
It is also responsible for the main hardware document for the GBA and DS
http://problemkaputt.de/gbatek.htm
Some like to flank it with no$zoomer but if you are after cheats then yeah, and personally it never really did much for me.

melonds may join it one day and has some aspirations towards debugging.
http://melonds.kuribo64.net/

I already mentioned enhacklopedia but for the sake of linking it again https://doc.kodewerx.org/hacking_nds.html

https://gbatemp.net/threads/crackers-ds-trainer-maker-tutorial.44410/ also makes a nice addition.

There are some older emulators with some measure of debugging options but probably skip them today.

Some also spend some time learning C and C++. Earlier I mentioned stats hacking. Spend time learning C arrays ( https://www.tutorialspoint.com/cprogramming/c_arrays.htm ) and you will then probably come to understand why you would be either looking for a character by character stats value "list", or have each character's attack stat next to each other, followed by def all next to each other somewhere else... as well as why list was in quotes back there. Not to mention pointers, which would be covered probably long before you got to arrays, would also have some more grounding. You could limit it to data structures and data types to know why things are going to be certain things on given systems (8 bit systems tend to use 8 bit values, 16 then 16...) and that would also lead into basic assembly.
https://www.romhacking.net/documents/361/ is for the GBA and for the command line (if you follow along with it try to do it in no$gba) but a useful trick to have in making cheats as tracing and launching off button commands. as well as why http://www.fceux.com/web/help/fceux.html?TraceLogger.html (fcuex is for the NES and represents the gold standard of such things that are not the PC, and I don't think there is such a tool/equivalent formally for the DS but you can fake it) is useful when finding a simple flag to say mimic the effects of a "no monsters" potion/equip where you can't just search-repeat-search-repeat as easily*, or better yet mimic a flag when the equip takes up a valuable equip slot and simply giving someone the equip limits them in another way.
It is for the PC but I went a bit further into some other things here the other day https://gbatemp.net/threads/how-do-i-make-pointers-in-cheat-engine.565789/
Basically thinking like a programmer and always asking "if I was making this how would I do this?" as well as "what clues can I see from the game itself as to what might be going on underneath it all?" is rather useful when you are manipulating a program/efforts of a programmer -- know your enemy and all that.

*For https://gbatemp.net/threads/castlevania-portrait-of-ruin-us-undub-cheat.367014/ I did indeed do that with a bunch of savestates and if options to back out at there then those too. If you have to wait 10 minutes for something to wear off then that is a rather longer affair, possibly rather more complicated as well.

Programming is a rather big leap to start out with so you might also like to try to replicate a complicated cheat -- if your basic infinite money or something cheat is not a one or two line affair and is not a "press to add 1000" (which may itself be a workaround to a problem**) type deal then you probably have some fun anti cheat protection to handle. Either understand what it is that it is doing, or starting from the position that you know it is going to be a fun one (but not reading the cheat to get the answers as it were) then see if you can make one too.

**have infinite time and anything based on time won't happen, press to refill time is a different matter entirely. Have infinite health and anything based on health like a must lose boss battle may break, alternatively you might enjoy fighting/farming a boss and it is an easy way to return their health without making it infinite and undefeatable. Set your gold at 1000 and something that costs 1001 is now out of reach. No monsters is great but always no monsters might be boring and leave you underlevelled...
 

FAST6191

Techromancer
Editorial Team
Joined
Nov 21, 2005
Messages
36,798
Trophies
3
XP
28,321
Country
United Kingdom
Why are you using it? Desmume, no$gba and various GBA emulators have better options for most things here than emuhaste provides. Emuhaste and external programs are great for PC games, and provide a workable engine than basic or none but ultimately most internal cheat searches exceed them.

Also few seconds of searching
http://i486.mods.jp/ichild/download/emulator-cheet-program-emuhaste
 
  • Like
Reactions: banjo2

banjo2

gamer
OP
Member
Joined
May 31, 2016
Messages
2,344
Trophies
1
Location
society
Website
youtube.com
XP
5,125
Country
United States
This is a lot more difficult than I thought it would be, and I already knew it wouldn't be easy.

One of the first things I tried was changing my username to something not allowed (over 10 characters or having only spaces). I was able to achieve this with Cheat Engine, but that's not the goal of course, I have to do this within the emulator, right?

I don't think you can search strings like in Cheat Engine, though. Maybe I just glossed over something as I did yesterday, but I don't understand how you could find something like this.

However, I decided to try something simple: I went into a match, searched my health value in RAM Search, found it, and locked it at 98. My first cheat code! Even though it has probably been made dozens of times before:
020DA7EE 00000062

A lot of this is overwhelming for me, especially the stuff on the crackerscrap page. Maybe I'm just failing to grasp all of this or skipping important information, but I feel that I'm starting at chapter 4 if you know what I mean. Do you have any suggestions?

On a positive note, while writing this, apparently I was 1-hit-killed in-game, making my camera enter the post-death state but I could still control the character at the same time. That was interesting ^_^
 

FAST6191

Techromancer
Editorial Team
Joined
Nov 21, 2005
Messages
36,798
Trophies
3
XP
28,321
Country
United Kingdom
Why not do a hex search in a RAM dump/savestate (assuming it is an uncompressed savestate -- some emulators do that).

Equally text is not always ASCII or something common that you might search with a basic hex editor for -- games, or at least consoles, are often all about that custom text encoding. This is going into ROM hacking territory though, even more so as I will occasionally use name input (character name entry, high score tables and the like) to figure out how the text in a given game works (annoyingly it is often different to the main game text but still a potential option). If it is a game in English, and to a lesser extent other European languages, then you do have the option to do relative search as well https://www.romhacking.net/utilities/513/
It is a reasonable thing to try for the GBA and DS and beyond but is by no means assured. Anything older... good luck there but not impossible.

I should also note that many games will have a value that determines the length of the name inputted (helps if you have a character someone named Tim and another someone named Timothyson to not have a bunch of ugly looking space after the former to allow it to fit the latter). Said length value might also lead to an exploit for some things; if it normally expects 10h at most and as only the text entry will do that it will "never" be more then you come along and whack FFh as a length you now might have a nice few bytes to do something fun with.

For the most part for names I will make a savestate. Enter a name and press go (sometimes a game won't commit anything to memory or the memory that matters until you start the game/press go), start the search, load the savestate, enter another name and then start comparing things to see what changed despite being a theoretically identical game at that point. The game may or may not save the afterwards as well, if not then time to edit saves instead which is another area though also the same as cheat making in many ways (indeed some consider it an extension of it).
Nice one in realising that the name entry screen is normally the gatekeeper for entry and editing things outside it will allow you to have fun names. For practical purposes I tend to only find name editing like that be good for people downloading saves from the internet and finding things customised, some cheats/save editors/downloaded saves will add a value to a name to mark someone as such, and while using a Japanese save on an English language game (or vice versa) might have greater problems than that it is still occasionally just the Japanese encoding is not supported on the English game and if you can fix that for someone then good for you and it might well be doable with a cheat.

Cracker's various guides are high level stuff. Keep on making basic cheats and getting comfortable with some of the more exotic types there (other than anti cheat making something you can simply repeat having something change dozens of times to search every time is pretty easy, making things change flags* or say do a multiplier is a different matter) before you start hardcoding your own stuff manually (a few months after that was all initially done he made DSATM which will do it all for you automatically) and playing with the ROMs at that level.

*this is the no monsters stuff and things like it. Either on or off or maybe with a few values depending upon the nature of the potion (reduced rate vs none vs only high level vs only low level) and maybe with a massive cooldown. Harder to search for that one though still possible. Multipliers are usually either rewards for a job well done and basically a flag or you find the value and do a shift on it; shift in binary/hex maths is a bit like multiplying or dividing by 10 in that you shift the decimal point as it were around and rather than do any kind of real maths, however being binary which is based around 2 (indeed it is called base 2) it is why you tend to see a x2,x4,x8,x16,x32... or 0.5x, 0.25x, 0,125x... progression rather than anything in between. Older cheat devices on older consoles might not have a shift but it is usually available on the newer stuff.

Rarely see infinite health have that effect any more. In some ways it speaks to some suspect coding on the part of the developers but in others it presumably would not have been a problem under "normal" conditions. Such things however are one of the reasons why some cheats will be of the form press button to refill health or have infinite health potions.
Three things to consider, and pointers as well (some games will have things change location between rounds/boots depending upon what goes where.
1) What saw this happen. If the game has an instakill function that bypasses health then that can mean you have some other things to consider or approaches to take.
2) If you did the hack right at the start of the game (game in which you can gain levels/stats) then you might have picked a too low value if a late game enemy will one shot that. Usually see this one more for people making mana cheats (too little to cast an end game spell), ammo cheats (though this is more infinite reloading happens) or money cheats but health is somewhat up there for this. Main thing people try first is max value for the cheat rather than whatever the value it ended up as in the search.
3) Whether it is actually some kind of anti cheat. I was once fiddling with one of the GBA final fantasy ports I think it was. Anyway usual lose some health and search, lose some and search... routine made a nice thing that held the number at whatever. However the game used another value elsewhere to do health but that value I found to determine whether I could use a potion or not (full health, not necessary to use sort of thing) which made it even worse. Pointers are not necessarily anti cheat measures (there are valid coding reasons for something to be somewhere else) but fall under a similar banner.

The way most RAM based cheat engines work is every vblank (a thing that happens in most consoles 60 times a second regardless of what else is going on) the cheat engine will have something added that twiddles the memory in question (or checks and twiddles if you have a button activator or some condition). If however the game does all its calculations after the memory has been twiddled and before it gets done again, or maybe in something that happens elsewhere, you might find yourself troubled. If you still want something and refill health is not an option then this is where cracker's guides and approaches come in more handy -- you presumably already know the location of the health so instead you start up a debugger and look for anything that checks this value (break on read of the health value being a good start), here you will probably have an instruction sequence that grabs it, compares it (does it equal or maybe equal to or less than 0) and then acts accordingly and you change it so this does not return the "you are dead" result. Traditionally this sort of mod would have been done on a game genie (why they often have far more radical effects as you are literally editing the game's behaviour, can be easily patched into a ROM where hardpatching cheats was more of a thing on the GBA on up, and why there are generally so few of them when you browse cheat databases) but the DS copies its binary to RAM to run so you can edit that instead with cheats if you so desire and still have the fun of editing assembly code instead.

Also for others playing along it seems kodewerx is down again. Not sure if for good this time but in general if you do a search of enhacklopedia you will generally find a mirror somewhere and archive.org should have a copy of the relevant details as well.
http://bsfree.org/hack/index.html
https://gamehacking.org/wiki/EnHacklopedia
some of it is on the wiki here as well. Probably should grab the lot and maybe start updating it again as well (some of it is a bit old and some of it could stand to be expanded upon as well)
 
  • Like
Reactions: banjo2

banjo2

gamer
OP
Member
Joined
May 31, 2016
Messages
2,344
Trophies
1
Location
society
Website
youtube.com
XP
5,125
Country
United States
Somehow, I was able to create the name cheat code:
022587EC 000000xx

This changes the first character of the name to the specified hex character, and the second, third, etc characters can also be changed. I haven't tested on real hardware yet, though.

This was an interesting and more positive experience compared to the last few times, thankfully. My day hasn't been the best for me, but this cheered me up ^_^


I see why "press button to add health" is used: If the cheat code is turned on before starting a match, it forces you to spawn before you're supposed to, so you get softlocked in the intro camera (at least in the standard battle mode) and will crash if killed. It probably wouldn't work well if you fell out of bounds, with the way that it is.
 

FAST6191

Techromancer
Editorial Team
Joined
Nov 21, 2005
Messages
36,798
Trophies
3
XP
28,321
Country
United Kingdom
Emulators and real hardware mostly work the same way for most purposes. If you start fiddling with hardware level things then an inaccurate emulator might have something work that would not on hardware. The main issue tends to be dynamic allocation of memory (program says give me 50 bytes to do something with, if the last thing to say give me ? bytes had not returned the memory after it was done then that 50 bytes might change between runs) aka what pointer codes mostly are there to handle (the other then mostly being times the devs deliberately move things around memory).

Anyway if refill codes are not for you and you don't want to have to play assembly hacker to mess with the game's underlying logic about dying/health management then you have two main options
1) Simple button code to turn it on in the game. Have to remember to turn it on, turn it off and otherwise manage it but a viable option if you can handle it. Most will do this more for things that may crash when the game is loading up but be fine otherwise.
2) You have the code figure out it is in a suitable period to turn it on. Something, somewhere in the memory will be a given value or a given range of values when in presumably battle in this case but not when outside it. For the DS and other higher end cheat options (older hardware and lesser emulators/flash carts might be more limited here) you can then have it check one bit of memory and then execute the following codes. Find one that knows when things are on (and possibly if ring out is a problem then also responds to that). It need not be related to the thing you are tackling with the code (if there is a match timer then great, if it is something else entirely but the between bout thing sees another bit of code loaded that makes the difference then great).
 
  • Like
Reactions: banjo2

banjo2

gamer
OP
Member
Joined
May 31, 2016
Messages
2,344
Trophies
1
Location
society
Website
youtube.com
XP
5,125
Country
United States
I wanted to remove part of the background in menus, so I found where in the memory that part is stored. I found a value that will remove it (as in, manually changing the value in the memory viewer), but when I made it as an AR/cheat code, it doesn't work. That part of memory seems to be completely unchanged.
The code is:
0400000E 00000013

Did I miss something about modifying this part of the memory?
 
Last edited by banjo2,

FAST6191

Techromancer
Editorial Team
Joined
Nov 21, 2005
Messages
36,798
Trophies
3
XP
28,321
Country
United Kingdom
Yeah most cheats are aimed at the normal use parts of memory. 04000000h and up (E in this case being http://problemkaputt.de/gbatek.htm#gbalcdvideocontroller . General map http://problemkaputt.de/gbatek.htm#dsmemorymaps . 13 hex then presumably shuffling it all the way to the back ) control the system and are trickier to manipulate with a basic cheat -- emulators might allow it but in hardware is harder. Depending upon what one it is then it might work but most would probably attack it with an assembly instruction from the ROM (which you can put there, or more accurately in the ARM9/ARM7 binary loaded into memory as part of the normal process of it running, with a cheat).

That or hack the game instead. Find the offending part of the menu and make it transparent/matching colours, or if it is shared with something you want to keep then find the mapping for it and edit that instead.
 
  • Like
Reactions: banjo2

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    K3Nv2 @ K3Nv2: https://youtube.com/shorts/WOppJ92RgGU?si=KE79L6A_3jESsGQM