Hacking Badge Arcade Cheating with Gateway

[mungry]

make sure your 3ds battery dosent go in the red or you might need to catch the badges again

Trust me, I got it plugged in!

 

[Splosionz]

you need to unlock the catcher first with this
write(0x3286AD3C, (0x04, 0x00, 0x00, 0x00, 0x20), pid=0x??)
this is for EUR Old3ds

I updated them. That one will work still but part of the code is useless. Here are all of them so far.

Spoiler

Unlock Catcher - NTR Debugger (Sets your plays to 5 regardless of how many you had before)

US N3DS:
write(0x36468C3C, (0x04, 0x00), pid=0x**)

US O3DS:
write(0x32868C3C, (0x04, 0x00), pid=0x**)

EU N3DS:
write(0x3646AD3C, (0x04, 0x00), pid=0x**)

EU O3DS:
write(0x3286AD3C, (0x04, 0x00), pid=0x**)

JP N3DS
write(0x36469ABC, (0x04, 0x00), pid=0x**)

99 Plays - NTR Debugger

US N3DS:
write(0x36468C4C, (0x64, 0x00), pid=0x**)

US O3DS:
write(0x32868C4C, (0x64, 0x00), pid=0x**)

EU N3DS:
write(0x3646AD4C, (0x64, 0x00), pid=0x**)

EU O3DS:
write(0x3286AD4C, (0x64, 0x00), pid=0x**)

JP N3DS
write(0x36469ACC, (0x64, 0x00), pid=0x**)

30 Plays- NTR Debugger

US N3DS:
write(0x36468C4C, (0x1f, 0x00), pid=0x**)

US O3DS:
write(0x32868C4C, (0x1f, 0x00), pid=0x**)

EU N3DS:
write(0x3646AD4C, (0x1f, 0x00), pid=0x**)

EU O3DS:
write(0x3286AD4C, (0x1f, 0x00), pid=0x**)

JP N3DS
write(0x36469ACC, (0x1f, 0x00), pid=0x**)

 

[siFippo]

Tried that piece of code but with


3286AD3C

Client said finished. Nothing happened ):

Well, as your signature suggests your using a N3DSXL, so you cannot use the offset I posted, since it only works on EUR o3DS. Check some of the posts in the last 2 pages of this thread, if I remember correctly there is one currently working for N3DS.

EDIT: Nevermind, I haven't seen that the issue's already resolved

 

[KJ1]

Is there any way to unlock the themes section?

 

[marksteele]

Is there any way to unlock the themes section?

people are still hard at work on that one!

 

[KJ1]

people are still hard at work on that one!

Oh okay, thanks for the quick reply man, really appreciated!
Eagerly waiting for it....

 

[naivegirl2411]

people are still hard at work on that one!

Oh okay, thanks for the quick reply man, really appreciated!
Eagerly waiting for it....

Why do you need to unlock the theme shop btw? If you download the themes and use CHMM you can have all the badge arcade themes? Unless its part of a trophy unlock?

 

[KJ1]

Why do you need to unlock the theme shop btw? If you download the themes and use CHMM you can have all the badge arcade themes? Unless its part of a trophy unlock?

Yeah you are right..

 

[WallK]

I updated them. That one will work still but part of the code is useless. Here are all of them so far.

Spoiler

Unlock Catcher - NTR Debugger (Sets your plays to 5 regardless of how many you had before)

US N3DS:
write(0x36468C3C, (0x04, 0x00), pid=0x**)

US O3DS:
write(0x32868C3C, (0x04, 0x00), pid=0x**)

EU N3DS:
write(0x3646AD3C, (0x04, 0x00), pid=0x**)

EU O3DS:
write(0x3286AD3C, (0x04, 0x00), pid=0x**)

JP N3DS
write(0x36469ABC, (0x04, 0x00), pid=0x**)

99 Plays - NTR Debugger

US N3DS:
write(0x36468C4C, (0x64, 0x00), pid=0x**)

US O3DS:
write(0x32868C4C, (0x64, 0x00), pid=0x**)

EU N3DS:
write(0x3646AD4C, (0x64, 0x00), pid=0x**)

EU O3DS:
write(0x3286AD4C, (0x64, 0x00), pid=0x**)

JP N3DS
write(0x36469ACC, (0x64, 0x00), pid=0x**)

30 Plays- NTR Debugger

US N3DS:
write(0x36468C4C, (0x1f, 0x00), pid=0x**)

US O3DS:
write(0x32868C4C, (0x1f, 0x00), pid=0x**)

EU N3DS:
write(0x3646AD4C, (0x1f, 0x00), pid=0x**)

EU O3DS:
write(0x3286AD4C, (0x1f, 0x00), pid=0x**)

JP N3DS
write(0x36469ACC, (0x1f, 0x00), pid=0x**)

99 and 30 play don't wanna work for me
Ok, was too fast to type. Need to spend one play first. Thank you!

 

[justinbug2]

please update the codes for today

 

[aos10]

I updated them. That one will work still but part of the code is useless. Here are all of them so far.

Spoiler

Unlock Catcher - NTR Debugger (Sets your plays to 5 regardless of how many you had before)

US N3DS:
write(0x36468C3C, (0x04, 0x00), pid=0x**)

US O3DS:
write(0x32868C3C, (0x04, 0x00), pid=0x**)

EU N3DS:
write(0x3646AD3C, (0x04, 0x00), pid=0x**)

EU O3DS:
write(0x3286AD3C, (0x04, 0x00), pid=0x**)

JP N3DS
write(0x36469ABC, (0x04, 0x00), pid=0x**)

99 Plays - NTR Debugger

US N3DS:
write(0x36468C4C, (0x64, 0x00), pid=0x**)

US O3DS:
write(0x32868C4C, (0x64, 0x00), pid=0x**)

EU N3DS:
write(0x3646AD4C, (0x64, 0x00), pid=0x**)

EU O3DS:
write(0x3286AD4C, (0x64, 0x00), pid=0x**)

JP N3DS
write(0x36469ACC, (0x64, 0x00), pid=0x**)

30 Plays- NTR Debugger

US N3DS:
write(0x36468C4C, (0x1f, 0x00), pid=0x**)

US O3DS:
write(0x32868C4C, (0x1f, 0x00), pid=0x**)

EU N3DS:
write(0x3646AD4C, (0x1f, 0x00), pid=0x**)

EU O3DS:
write(0x3286AD4C, (0x1f, 0x00), pid=0x**)

JP N3DS
write(0x36469ACC, (0x1f, 0x00), pid=0x**)

thanks , i updated the OP with this information and this link.

 

[ness151]

please update the codes for today

US n3ds
For real plays:
32a63680 000000xx
336a1848 000000xx

 

[HappyzLife]

Any news for user without a gateway?

 

[WallK]

Any news for user without a gateway?

Are you kidding me? Read like 10 posts up

 

[HappyzLife]

Are you kidding me? Read like 10 posts up

I don't understand, have I to install ntr cfw? But I have a o3ds, so i can't, i've rxTools.
(excuse me, i'm not understanding...)
EDIT: Ok, now i've ntr, i'm trying to hax badge arcade

 

[justinbug2]

US n3ds
For real plays:
32a63680 000000xx
336a1848 000000xx

i meant for ntr but thanks?

 

[DarkunderdoG]

.

 

[noctis90210]

I updated them. That one will work still but part of the code is useless. Here are all of them so far.

Spoiler

Unlock Catcher - NTR Debugger (Sets your plays to 5 regardless of how many you had before)

US N3DS:
write(0x36468C3C, (0x04, 0x00), pid=0x**)

US O3DS:
write(0x32868C3C, (0x04, 0x00), pid=0x**)

EU N3DS:
write(0x3646AD3C, (0x04, 0x00), pid=0x**)

EU O3DS:
write(0x3286AD3C, (0x04, 0x00), pid=0x**)

JP N3DS
write(0x36469ABC, (0x04, 0x00), pid=0x**)

99 Plays - NTR Debugger

US N3DS:
write(0x36468C4C, (0x64, 0x00), pid=0x**)

US O3DS:
write(0x32868C4C, (0x64, 0x00), pid=0x**)

EU N3DS:
write(0x3646AD4C, (0x64, 0x00), pid=0x**)

EU O3DS:
write(0x3286AD4C, (0x64, 0x00), pid=0x**)

JP N3DS
write(0x36469ACC, (0x64, 0x00), pid=0x**)

30 Plays- NTR Debugger

US N3DS:
write(0x36468C4C, (0x1f, 0x00), pid=0x**)

US O3DS:
write(0x32868C4C, (0x1f, 0x00), pid=0x**)

EU N3DS:
write(0x3646AD4C, (0x1f, 0x00), pid=0x**)

EU O3DS:
write(0x3286AD4C, (0x1f, 0x00), pid=0x**)

JP N3DS
write(0x36469ACC, (0x1f, 0x00), pid=0x**)

sorry for being a noob, but can i ask u how to use ntr debugger?
i hope these cheats will be converted to plg file soon for easy use... thanks...

 

[Splosionz]

sorry for being a noob, but can i ask u how to use ntr debugger?

i hope these cheats will be converted to plg file soon for easy use... thanks...

This is the quick tutorial I used to learn the very basics of NTR's Debugger. Not sure who wrote it though so I'm unable to give any credit.

Spoiler: Quick NTR Debugger Tutorial

1. Play 3ds with NTR CFW for the game ACNL (with wireless switch on)
2. Check the IP address of the 3ds (e.g.192.168.1.10)
3. Run ntrclient application on Windows PC
4. Execute the following command:

connect('192.168.1.10', 8000)

5. After the connection is establish, you could see the list of process by using command:

listprocess()

6. One of them is the ACNL game of interest (in this case the process name is GARDEN, and has pid # 0x25)
7. Then you could check the memory layout, for example:

memlayout(0x25)

null
valid memregions:
00100000 - 00b6efff , size: 00a6f000
08000000 - 08073fff , size: 00074000
0ffc0000 - 10000fff , size: 00041000
10002000 - 10002fff , size: 00001000
14000000 - 174dcfff , size: 034dd000
1f000000 - 1f5fffff , size: 00600000
1ff50000 - 1ff57fff , size: 00008000
1ff70000 - 1ff77fff , size: 00008000
1ff80000 - 1ff81fff , size: 00002000
1ffad000 - 1ffaefff , size: 00002000
end of memlayout.

8. I could dump the biggest one and see whether the savegame file is in that part (i.e. finding
garden.dat file (extracted by using savefiler 3ds application) content inside this memory data
dump file, data.bin):

data(0x14000000, 0x34DD000, filename='data.bin', pid=0x25)

9. garden.dat actually starts at offset 0x01FB7E80 in that data.bin file, so now we could try finding
the location of the pocket slots of the first player by changing the content in the first slot of the
pocket multiple times and dump those data.bin for each change. In this case, I could see the offset
is 0x1FBEAD0 (or 0x15FBEAD0 after taking into consideration that data.bin starts at 0x14000000 in
the memory of pid 0x25).

10. Now, we could use command to put a bag of 99,000 bells in that first slot of pocket:

write(0x15FBEAD0, (0x12, 0x21, 0x00, 0x00), pid=0x25)

11. Profit

Hope this clarifies.

Cheers.

 

[justinbug2]

what the new adress codes for today? also can u update daily? for plays btw