Atmosphere's GDB

[TomSwitch]

Atmosphere 1.2.3 started to support GDB.
This is a tool for game hacking only. Unless you are a cheat creator this is of no interest (except maybe more cheats will be coming due to tool improvement).

This version of edizon se is only tested on Atmosphere 1.2.4. You can switch between using GDB or dmnt (cheatVM) while on the same game session.
When GDB is attached to the game edizon se won't work. You need to detach GDB to use edizon se.

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

To install copy the contents of edizon.zip to the root of your sd card.
If you have installed 3.8.25c before please delete /atmosphere/contents/010000000000000D/exefs.nsp

Pointer searcher se is updated to support use case with GDB

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

Breeze and Zing works normally when GDB is not attached.

To use GDB you need to detach dmnt. Use edizon se (ZL+B) to detach dmnt. (if you use profile to launch edizon se you have to enable "no auto attach" option)

 

[Eiffel2018]

Atmosphere 1.2.4
Software break-points, hardware break-points, hardware watch-points, and hardware single-step are all supported/implemented

Is there any example for using that?

 

[Eiffel2018]

I'm a newbie to devkitA64 and GDBstub
Just found out how to use this new feature by Atmosphere



First of all, this line should be added
enable_standalone_gdbstub = u8!0x1

After upgrade the newest version of NOEXES / Edizon SE, reboot the atmosphere

Then, I need to find out an useful address
e.g. Health = 0x571C477C40
or you can get an address from an existing noexes expression e.g. [[[[[main+04586C90]+B8]+B8]]+C0]+40

1. Install devkitPro from members only
2. Open CMD and type C:\devkitPro\devkitA64\bin\aarch64-none-elf-gdb.exe
3. Type: target extended-remote 192.168.1.94:22225
4. Type: info os processes
5. Type: attach 135 <<< 135 is your game process ID
6. Type: x 0x571C477C40 <<<< show the Health now
7. Type: x/u 0x571C477C40 <<<< show the Health in unsign Decimal number instead of Hex
8. Type: set {int}0x571C477C40 = 100 <<<< set the current Health to 100
9. Type: watch *0x571C477C40 <<<< set a breakpoint with that address (finding what address to write this address)
10. Type: c / continue
11. I get the following:
Thread 2 "MainThread" hit Hardware watchpoint 1: *0x571C477C40
Old value = 100
New value = 90
0x00000004b58fc3a4 in ?? ()

12. Type: monitor get mapping 0x00000004b58fc3a4
I get
0x04b5404000 - 0x04b7d9bfff r-x Code ---- [0, 0]
By calculation, 0x04b58fc3a4-0x04b5404000 = 0x4F83A4 , that is main+4F83A4
13. Open the IDA pro, the commands there

14. Finally Type: detach << and exit the GDB

 

[Eiffel2018]

OMG
I connect the IDA PRO to SWITCH directly!












It need to rebase the original elf



the main address is always end with 4000, (or you can get the main address from noexes)


detach from process, and rebase

attach to process again

now, I can trace the code step by step

 

[TomSwitch]

For those who don't use IDA pro or maybe some project that is easy enough that don't need IDA pro
https://sourceware.org/gdb/download/onlinedocs/gdb/Set-Watchpoints.html

 

[jhmiller]

The new Edison SE (3.8.25) allows me to search and create bookmarks, but does not allow me to add cheats from bookmarks or freeze values.
I can only do searches.

I have activated gdb in the system_settings.ini.
I have also changed to the new noexes.
Do I need to do something else?
Or at the moment we can only do searches with the gdb activated?

 

[patjenova]

Atmosphere 1.2.3 started to support GDB.
With GDB enable there will be no dmnt (no cheatVM) at least for now.
This is a tool for game hacking only. Unless you are a cheat creator this is of no interest (except maybe more cheats will be coming due to tool improvement).

Here is a quick hack of edizon se. Do not download unless you want to use GDB with edizon se.

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

Here is a quick hack to noexes sysmodule. No reason to install this unless you want to enable GDB.

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

Here is pointer searcher se updated to ignore no dmnt

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

Breeze and Zing requires dmnt and won't work when GDB is enabled.

I am very new to GDB. Basically starting from scratch. I will post what I learn here.

Where do you place the new noexs sysmodule?

 

[Jericoss]

what is this program? or at least what mean GDB. Thanks

 

[Eiffel2018]

Where do you place the new noexs sysmodule?

I put that members only in members only

 

[Eiffel2018]

what is this program? or at least what mean GDB. Thanks

There are many software can connect GDB server
Here is the one suggest by atmosphere



I'm trying to find the one like cheat engine.
testing this one now

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

 

[Jericoss]

There are many software can connect GDB server
Here is the one suggest by atmosphere
View attachment 283507


I'm trying to find the one like cheat engine.
testing this one now

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

Oh , there are a tutorial from this?
this program, look for what cheats?
sorry i dont know the program and I a make some questions.
Thank you for your response.

 

[jhmiller]

@Jericoss From what I understand, with this we can put breakpoints and see what memory location is calling that address.
Then, in the IDA, modify that call.
If this works as I hope, we can do tricks directly in MAIN, without needing the pointers !!!

For example, in Labyrinth Legend:
I have looked for the address where life is stored.
Then I have put a break to see who calls that address.
As soon as my life has dropped because an enemy has attacked me, I have been able to see the address: 14C5378
With that information I have gone to the IDA and there was a STR there. I have changed it for a NOP and now life does not go down.
Ok, it doesn't go up either, but I'm just starting out

And the best of all is that I no longer have to be looking for pointers and without having to reset until I see which pointer is still working.
With this I am sure that it ALWAYS works and to anyone since I am modifying the MAIN.

 

[Jericoss]

@Jericoss From what I understand, with this we can put breakpoints and see what memory location is calling that address.
Then, in the IDA, modify that call.
If this works as I hope, we can do tricks directly in MAIN, without needing the pointers !!!

For example, in Labyrinth Legend:
I have looked for the address where life is stored.
Then I have put a break to see who calls that address.
As soon as my life has dropped because an enemy has attacked me, I have been able to see the address: 14C5378
With that information I have gone to the IDA and there was a STR there. I have changed it for a NOP and now life does not go down.
Ok, it doesn't go up either, but I'm just starting out

ok, all that is new for me but if you get it later (or someone do a tutorial) show me to know how we can make cheats in MAIN.
And what I need to learn (ASM termins)
Thank you.

 

[Eiffel2018]

Oh , there are a tutorial from this?
this program, look for what cheats?
sorry i dont know the program and I a make some questions.
Thank you for your response.

it is difficult to install, I failed on my WSL environment, maybe I'll try it on my old iMac

 

[patjenova]

it is difficult to install, I failed on my WSL environment, maybe I'll try it on my old iMacView attachment 283523

didn't ida pro debugger worked for you?

 

[Eiffel2018]

didn't ida pro debugger worked for you?

It works, but I am finding a tools like cheat engine that work with GNU debugger

 

[Eiffel2018]

Trying this one https://www.gdbgui.com/
a tool for using like IDA PRO

May be I will try ARM GDB debugger in VS Code later

 

[Eiffel2018]

IDA PRO is the best DBGstub client for atmosphere, I believe


After adding the memory region manually, I do not need to rebase the elf or calculate the main address, it show correctly,

Type: get info at the GDB moniter window

I can get the address of main, 0x4f22404000 - 0x4f23f57fff i.e. Century-p4.nss <-- the module name

Then I add a region for it, mark down the Starting and Ending address. The Base address can be calculate by Start address (just remove the last zero)

Now, the main address can be show.


for more clearly, you can press c at the addresses ended with 0/4/8/C, then the code will be show.


Here is a head of a function, you can press P

if the function is small enough, it can be generated a diagram by pressing Space


You can add more regions by this method
e.g. heap, stack, sdk, etc


However, some section need to find by a command: get mappings

e.g. CodeData

CodeData use Main address, they are the pointer start
So, the base address for CodeData section should be the same as that of Main



Finally, you can get a clear address in the register / stack windows

 

[Eiffel2018]

From now, it is not necessary to extract the exefs by hactool, and get the main or main.elf

First start IDA PRO with empty project. (press Go at startup)


Choose Debugger > Attach > Remote GDB debugger

Type in your switch IP and port number 22225


Press Debug options and then tick the options you need


Choose "Set specific options" and set CPU as ARM64 (AArch64)

After pressing 2 OK, you need to select which process ID to attach (always the last one)

Now the game will suspend


You may set the memory regions (or Program segments) first
(for details, read the last post )



Now, you can add a watch point.
Press G at the Hex View and type the address found by NOEXE / EdizonSE

You may found that you can't. The address cannot go there!

To solve it, you can calculate by subtract the Heap, or adjust the Base address of Heap region to 0

Now, I can reach there by typing Heap:26E9774DE8 (for easy to read, press 4 at HexView)

Before adding the break point, we need to examine is it a valid address for changing Health.

Press F2 and try to edit it, Press F2 again when finish editing.


Press F9 to start the game, and then Suspend again to stop the game


Oh, the memory was changed back as before!


Nevermind, we can trace the real one with this address.

Press INS at breakpoints windows or you can choose Add Watch from Menu


The Location is typed automatically (it always the same as what you pointed at HexView)
Tick the Settings: Enable & Hardware ; and tick the Actions: Break & Trace
Uncheck the Read in Hardware breakpoint mode, and then set the Size to 4 ( or 8 for Double / Long)


Now Press F9 again and play until the game stop automatically.

It break (stop) immediately!
That address value is for display purpose I believe, so it refresh every second.

The PC register stop at here


I roll up and press c to get more details of compiled code

You may notice W9 is the value store on the address I get

Mouse over onto [X0, #0x28], it is that address of breakpoint


Can I mouse over onto [X9, X11], and get the address for which W9 copy from?

The anwser is No, since W9(X9) is changed at the line before
So, I need to set another breakpoint prior to 0x72C910,
point to there and right click to set an execution trace

Press F9 / F8 / F4 etc until PC locate at 0x72C910 then you can get the address of real health value by mouse over onto [X9, X11],.

OMG, atmosphere occur an error and need to reboot now.
So, the tutorial will stop at here

=============

If I was lucy enough, I may continue set a break point at the address of real health value,
The game will not stop immediately after pressing F9, it will stop until the player hurt.
Then I will get the correct address for "player does not hurt"

Press CTRL+ALT+K to replace the STR instruction as NOP
(if your IDA PRO does not been installed keystone / Keypatch , or you may use D503201F, it stands for nop)

04000000 <address> D503201F
An invincible cheat is created.

 

[TomSwitch]

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

I made a small change with this version. Now it can work with dmnt present too, just toggle no auto attach off to use cheatVM