Breeze beta 94

[TomSwitch]

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

Fixed a conditional key bug affecting the edit cheat menu.
Now automatically save cheat to file when returning to the cheat menu after successfully assembling an ASM cheat.
Fix gen2 catch address being zero if you quit Breeze and return.

Changed the location of the ARM32 version.
\switch\breeze.nro can be deleted, the new version is located elsewhere so there won't be two breeze in hbmenu

beta94d
Gen2 fork is now at 0.13g, new version needed and
will required a reboot to use gen2 menu.
Double watch buffer size. Support stack that has
less than 100 entries.
Fixed search progress bar bug.



Beta94b is released. Release note has full description of everything that is new in 94 until this point.

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

sorry I messed up the update to p2 release and it ended up with p1 in the zip, breeze.zip in this release has been removed.

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

Do not update if you don't find these features exciting.

 

[dsrules]

is this a more accurate way of getting the x30 value for separate player and enemy?

 

[TomSwitch]

is this a more accurate way of getting the x30 value for separate player and enemy?

This is when X30 got corrupted by a bl in the current function. When ever there is a bl X30 will be with the address that is +4 of the bl. Game function will push X30 to stack if there is any bl in the function. Normally you can easily see those bl by just going a few page up

Post automatically merged: Sep 13, 2024

Here is some action with the new feature on

Yars Rising​

Found HP, set watch,




found instruction see that this instruction was called with different stack configuration to access our hero hp
Set instruction watch, see that there is 8 hits. Do the normal x30 watch and can see that all of them won't narrow down to only hero

Now try the new feature and set X30 alternative to stack with offset 1

We can see there is a caller that access everything and there is a caller that access only our hero

Set watch on caller and capture X0


If after more test this is the one unique to our hero we can then either see how X0 relates to the hero hp or do a stack match which is a small variant from the X30 match brute force method.
The X0 captured can be used for other purpose if the structure pointed to it has other interesting values
From pointer search it is likely that HP is [[X0+48]+38] deep enough and not too deep to be interesting

[Breeze beta94 p1 Yars Rising 1.0.891299 TID: 01007EA01E00A000 BID: 28E6F0436FCA2D90]
[hp asm]
04000000 02677E50 BD403800
04000000 02677E50 14A1512C
04000000 04ECC300 A9376BF9
04000000 04ECC304 18000159
04000000 04ECC308 F94007FA
04000000 04ECC30C 53103F5A
04000000 04ECC310 6B1A033F
04000000 04ECC314 54000061
04000000 04ECC318 BD405000
04000000 04ECC31C BD003800
04000000 04ECC320 BD403800
04000000 04ECC324 A9776BF9
04000000 04ECC328 175EAECB
04000000 04ECC32C 64700000

stp x25, x26, [sp,#-0x90]
ldr w25,e
ldr x26, [sp,8]
lsl w26,w26,16
cmp w25, w26
b.ne original
ldr s0, [x0, #0x50]
str s0, [x0, #0x38]
original: {original}
ldp x25, x26, [sp,#-0x90]
return: b code1+4
e:.word 0x64700000

[hp asm2]
04000000 0209246C D63F0120
04000000 0209246C 14B8E7B1
04000000 04ECC330 A9376BF9
04000000 04ECC334 F9402419
04000000 04ECC338 B940533A
04000000 04ECC33C B9003B3A
04000000 04ECC340 A9776BF9
04000000 04ECC344 D63F0120
04000000 04ECC348 1747184A

STP X25, X26, [SP,#-0x90]
ldr x25, [x0,0x48]
ldr w26, [x25,0x50]
str w26, [x25,0x38]
return:
LDP X25, X26, [SP,#-0x90]
blr x9
b code1+4

Can be further shorten by three opcodes by change b to bl and blr to br
[hp asm2 v2]
04000000 0209246C 94B8E7B1
04000000 04ECC330 A9376BF9
04000000 04ECC334 F9402419
04000000 04ECC338 B940533A
04000000 04ECC33C B9003B3A
04000000 04ECC340 A9776BF9
04000000 04ECC344 D61F0120

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

 

[ranma99vn]

Hi Tom
is that [sp,8] will always use for get value of stack 1,2 or 3? or is it [sp,#0x8]?
with ldr x25, [x0,#0x48] is this your just pick a close by the hp location?
thanks for the toturial

 

[TomSwitch]

Hi Tom
is that [sp,8] will always use for get value of stack 1,2 or 3? or is it [sp,#0x8]?
with ldr x25, [x0,#0x48] is this your just pick a close by the hp location?
thanks for the toturial

The number is how far down the stack. New version will give you the offset to use. It's *8. The number besides the pointer is how far down SP a pointer into main code space is found

ldr x25, [x0,#0x48] is because I know it is [[X0+48]+38], not part of the flow I have shown, I did pointer search earlier

 

[ranma99vn]

The number is how far down the stack. New version will give you the offset to use. It's *8. The number besides the pointer is how far down SP a pointer into main code space is found

Thanks Tom i will mess around with it

 

[TomSwitch]

This is the result for watching HP.

When she was alone only one unique case


If you break with IDA pro you should see this case as it is the only case, check the stack to see if it match.
You should see those pointers 1 line down from SP, 3 lines down from SP and 26 lines down from SP

 

[ranma99vn]

View attachment 457786
This is the result for watching HP.

When she was alone only one unique case
View attachment 457787

If you break with IDA pro you should see this case as it is the only case, check the stack to see if it match.
You should see those pointers 1 line down from SP, 3 lines down from SP and 26 lines down from SP

Thanks Tom now i understand the number before those stack now

 

[TomSwitch]

The gen2 fork released earlier has a bug. I have replace the one in beta94 p2 with the bug fix.

GDB was broken and will crash your Switch if you use GDB.

 

[dsrules]

This is when X30 got corrupted by a bl in the current function. When ever there is a bl X30 will be with the address that is +4 of the bl. Game function will push X30 to stack if there is any bl in the function. Normally you can easily see those bl by just going a few page up

Post automatically merged: Sep 13, 2024

Here is some action with the new feature on

Yars Rising​

Found HP, set watch,

View attachment 457684
View attachment 457690

found instruction see that this instruction was called with different stack configuration to access our hero hp
Set instruction watch, see that there is 8 hits. Do the normal x30 watch and can see that all of them won't narrow down to only hero
View attachment 457682
Now try the new feature and set X30 alternative to stack with offset 1
View attachment 457679
We can see there is a caller that access everything and there is a caller that access only our hero

Set watch on caller and capture X0
View attachment 457696

If after more test this is the one unique to our hero we can then either see how X0 relates to the hero hp or do a stack match which is a small variant from the X30 match brute force method.
The X0 captured can be used for other purpose if the structure pointed to it has other interesting values
From pointer search it is likely that HP is [[X0+48]+38] deep enough and not too deep to be interesting

[Breeze beta94 p1 Yars Rising 1.0.891299 TID: 01007EA01E00A000 BID: 28E6F0436FCA2D90]
[hp asm]
04000000 02677E50 BD403800
04000000 02677E50 14A1512C
04000000 04ECC300 A9376BF9
04000000 04ECC304 18000159
04000000 04ECC308 F94007FA
04000000 04ECC30C 53103F5A
04000000 04ECC310 6B1A033F
04000000 04ECC314 54000061
04000000 04ECC318 BD405000
04000000 04ECC31C BD003800
04000000 04ECC320 BD403800
04000000 04ECC324 A9776BF9
04000000 04ECC328 175EAECB
04000000 04ECC32C 64700000

stp x25, x26, [sp,#-0x90]
ldr w25,e
ldr x26, [sp,8]
lsl w26,w26,16
cmp w25, w26
b.ne original
ldr s0, [x0, #0x50]
str s0, [x0, #0x38]
original: {original}
ldp x25, x26, [sp,#-0x90]
return: b code1+4
e:.word 0x64700000

[hp asm2]
04000000 0209246C D63F0120
04000000 0209246C 14B8E7B1
04000000 04ECC330 A9376BF9
04000000 04ECC334 F9402419
04000000 04ECC338 B940533A
04000000 04ECC33C B9003B3A
04000000 04ECC340 A9776BF9
04000000 04ECC344 D63F0120
04000000 04ECC348 1747184A

STP X25, X26, [SP,#-0x90]
ldr x25, [x0,0x48]
ldr w26, [x25,0x50]
str w26, [x25,0x38]
return:
LDP X25, X26, [SP,#-0x90]
blr x9
b code1+4

Can be further shorten by three opcodes by change b to bl and blr to br
[hp asm2 v2]
04000000 0209246C 94B8E7B1
04000000 04ECC330 A9376BF9
04000000 04ECC334 F9402419
04000000 04ECC338 B940533A
04000000 04ECC33C B9003B3A
04000000 04ECC340 A9776BF9
04000000 04ECC344 D61F0120

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

can't seem to replicate this, could you write the steps to achieve this when you have time?
sometimes 0 count when I watch breakpoint using stack, also x30_catch keep changing back to offset after used x30_catch =stack and detached, not sure if that is normal or not

 

[ranma99vn]

can't seem to replicate this, could you write the steps to achieve this when you have time?
sometimes 0 count when I watch breakpoint using stack, also x30_catch keep changing back to offset after used x30_catch =stack and detached, not sure if that is normal or not
View attachment 457901View attachment 457902View attachment 457903

try p2, p1 is buggy

 

[dsrules]

try p2, p1 is buggy

already using p2 but still shows p1 in breeze?

 

[ranma99vn]

already using p2 but still shows p1 in breeze?

mine is show p2 also where the stack show offset aswell stack_offset=1,0x8

@TomSwitch can it be manually input X30 to checking different offset ?

 

[dsrules]

mine is show p2 also where the stack show offset aswell stack_offset=1,0x8

I got it from here

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

p1 and p2 from github are exactly the same file date and time
9/12/2024 9:23 PM

 

[ranma99vn]

I got it from here

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

Try again i download it and drag drop to the root of the sd card and over write the old one

 

[dsrules]

Try again i download it and drag drop to the root of the sd card and over write the old one
View attachment 457910

p2 now = p1 at github same filesize date and time
only gen2.zip is different

 

[ranma99vn]

p2 now = p1 at github same filesize date and time
only gen2.zip is different

i have no idea i remember when i installed p1 then install gen2 retsrt ,atmostphere wont let me boot in error, then i update atmostphere to the latest then it works

 

[dsrules]

i have no idea i remember when i installed p1 then install gen2 retsrt ,atmostphere wont let me boot in error, then i update atmostphere to the latest then it works

maybe TomSwitch uploaded the wrong file when he updated gen2

 

[ranma99vn]

maybe TomSwitch uploaded the wrong file when he updated gen2

Try this to see if it works

 

[dsrules]

Try this to see if it works

Thanks, this one dated 9/13