Nintendo SWITCH Cheat Codes Download

Avoid creating cheat Request Topic​

Request cheats are made in :​

cheat-codes-ams-and-sx-os-add-and-request-general


This group provides cheat code authors to post works, share experience, learn and exchange

This group also provides cracking game players to get the latest and most complete cheats, and assist in testing

Since GBATemp is the most famous place in the industry, we hope to improve the content quality of this group

The main contents of this group include:
1. Publish personal originals.
2. Improve the quality of secondary creation (including version updates, repairs, and enhancements)
3. Request to create game cheats
4. Tutorial sharing on developing game cheat codes

For technical exchanges, sharing the code of others must attach the URL of the webpage published by the original author (do not copy the complete code)

Although the content of this group is very precious, it is provided for free, and it is not allowed to reprint it to commercial places or paid membership websites for profit.
Nintendo SWITCH Cheat Codes Download
Nintendo SWITCH Cheat Codes Download

Breeze beta 94

  • Thread starter Thread starter TomSwitch
  • Start date Start date
  • Views Views 1,947
  • Replies Replies 87
  • Likes Likes 10

TomSwitch

Well-Known Member
Member
Joined
Jan 10, 2019
Messages
7,744
Solutions
1
Reaction score
22,323
Trophies
4
Age
46
XP
26,693
Country
United States
Members-only download
This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.


Fixed a conditional key bug affecting the edit cheat menu.
Now automatically save cheat to file when returning to the cheat menu after successfully assembling an ASM cheat.
Fix gen2 catch address being zero if you quit Breeze and return.

Changed the location of the ARM32 version.
\switch\breeze.nro can be deleted, the new version is located elsewhere so there won't be two breeze in hbmenu

beta94d
Gen2 fork is now at 0.13g, new version needed and
will required a reboot to use gen2 menu.
Double watch buffer size. Support stack that has
less than 100 entries.
Fixed search progress bar bug.

1727321406485.png
1727247644760.png
Beta94b is released. Release note has full description of everything that is new in 94 until this point.
Members-only download
This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

1727247704292.png
1726491792894.png
1726463411704.png

1726444021003.png

Members-only download
This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.


1726355955385.png

1726356017323.png

Members-only download
This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

1726277031555.png
Members-only download
This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

sorry I messed up the update to p2 release and it ended up with p1 in the zip, breeze.zip in this release has been removed.

1726206787332.png

Members-only download
This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Do not update if you don't find these features exciting.
1726149018225.png
 
Last edited by TomSwitch,
is this a more accurate way of getting the x30 value for separate player and enemy?
 
is this a more accurate way of getting the x30 value for separate player and enemy?
This is when X30 got corrupted by a bl in the current function. When ever there is a bl X30 will be with the address that is +4 of the bl. Game function will push X30 to stack if there is any bl in the function. Normally you can easily see those bl by just going a few page up
Post automatically merged:

Here is some action with the new feature on

Yars Rising​

Found HP, set watch,

1726188991894.png
1726189353415.png

found instruction see that this instruction was called with different stack configuration to access our hero hp
Set instruction watch, see that there is 8 hits. Do the normal x30 watch and can see that all of them won't narrow down to only hero
1726188894581.png
Now try the new feature and set X30 alternative to stack with offset 1
1726188583976.png
We can see there is a caller that access everything and there is a caller that access only our hero

Set watch on caller and capture X0
1726189490770.png

If after more test this is the one unique to our hero we can then either see how X0 relates to the hero hp or do a stack match which is a small variant from the X30 match brute force method.
The X0 captured can be used for other purpose if the structure pointed to it has other interesting values
From pointer search it is likely that HP is [[X0+48]+38] deep enough and not too deep to be interesting

[Breeze beta94 p1 Yars Rising 1.0.891299 TID: 01007EA01E00A000 BID: 28E6F0436FCA2D90]
[hp asm]
04000000 02677E50 BD403800
04000000 02677E50 14A1512C
04000000 04ECC300 A9376BF9
04000000 04ECC304 18000159
04000000 04ECC308 F94007FA
04000000 04ECC30C 53103F5A
04000000 04ECC310 6B1A033F
04000000 04ECC314 54000061
04000000 04ECC318 BD405000
04000000 04ECC31C BD003800
04000000 04ECC320 BD403800
04000000 04ECC324 A9776BF9
04000000 04ECC328 175EAECB
04000000 04ECC32C 64700000

stp x25, x26, [sp,#-0x90]
ldr w25,e
ldr x26, [sp,8]
lsl w26,w26,16
cmp w25, w26
b.ne original
ldr s0, [x0, #0x50]
str s0, [x0, #0x38]
original: {original}
ldp x25, x26, [sp,#-0x90]
return: b code1+4
e:.word 0x64700000

[hp asm2]
04000000 0209246C D63F0120
04000000 0209246C 14B8E7B1
04000000 04ECC330 A9376BF9
04000000 04ECC334 F9402419
04000000 04ECC338 B940533A
04000000 04ECC33C B9003B3A
04000000 04ECC340 A9776BF9
04000000 04ECC344 D63F0120
04000000 04ECC348 1747184A

STP X25, X26, [SP,#-0x90]
ldr x25, [x0,0x48]
ldr w26, [x25,0x50]
str w26, [x25,0x38]
return:
LDP X25, X26, [SP,#-0x90]
blr x9
b code1+4

Can be further shorten by three opcodes by change b to bl and blr to br
[hp asm2 v2]
04000000 0209246C 94B8E7B1
04000000 04ECC330 A9376BF9
04000000 04ECC334 F9402419
04000000 04ECC338 B940533A
04000000 04ECC33C B9003B3A
04000000 04ECC340 A9776BF9
04000000 04ECC344 D61F0120

Members-only download
This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.
 
Last edited by TomSwitch,
Hi Tom
is that [sp,8] will always use for get value of stack 1,2 or 3? or is it [sp,#0x8]?
with ldr x25, [x0,#0x48] is this your just pick a close by the hp location?
thanks for the toturial
 
Hi Tom
is that [sp,8] will always use for get value of stack 1,2 or 3? or is it [sp,#0x8]?
with ldr x25, [x0,#0x48] is this your just pick a close by the hp location?
thanks for the toturial
The number is how far down the stack. New version will give you the offset to use. It's *8. The number besides the pointer is how far down SP a pointer into main code space is found
ldr x25, [x0,#0x48] is because I know it is [[X0+48]+38], not part of the flow I have shown, I did pointer search earlier
 
Last edited by TomSwitch,
1726216915204.png
This is the result for watching HP.

When she was alone only one unique case
1726217152425.png

If you break with IDA pro you should see this case as it is the only case, check the stack to see if it match.
You should see those pointers 1 line down from SP, 3 lines down from SP and 26 lines down from SP

1726236348041.png
 
Last edited by TomSwitch,
View attachment 457786
This is the result for watching HP.

When she was alone only one unique case
View attachment 457787

If you break with IDA pro you should see this case as it is the only case, check the stack to see if it match.
You should see those pointers 1 line down from SP, 3 lines down from SP and 26 lines down from SP
Thanks Tom now i understand the number before those stack now :yay:
 
The gen2 fork released earlier has a bug. I have replace the one in beta94 p2 with the bug fix.

GDB was broken and will crash your Switch if you use GDB.
 
This is when X30 got corrupted by a bl in the current function. When ever there is a bl X30 will be with the address that is +4 of the bl. Game function will push X30 to stack if there is any bl in the function. Normally you can easily see those bl by just going a few page up
Post automatically merged:

Here is some action with the new feature on

Yars Rising​

Found HP, set watch,

View attachment 457684
View attachment 457690

found instruction see that this instruction was called with different stack configuration to access our hero hp
Set instruction watch, see that there is 8 hits. Do the normal x30 watch and can see that all of them won't narrow down to only hero
View attachment 457682
Now try the new feature and set X30 alternative to stack with offset 1
View attachment 457679
We can see there is a caller that access everything and there is a caller that access only our hero

Set watch on caller and capture X0
View attachment 457696

If after more test this is the one unique to our hero we can then either see how X0 relates to the hero hp or do a stack match which is a small variant from the X30 match brute force method.
The X0 captured can be used for other purpose if the structure pointed to it has other interesting values
From pointer search it is likely that HP is [[X0+48]+38] deep enough and not too deep to be interesting

[Breeze beta94 p1 Yars Rising 1.0.891299 TID: 01007EA01E00A000 BID: 28E6F0436FCA2D90]
[hp asm]
04000000 02677E50 BD403800
04000000 02677E50 14A1512C
04000000 04ECC300 A9376BF9
04000000 04ECC304 18000159
04000000 04ECC308 F94007FA
04000000 04ECC30C 53103F5A
04000000 04ECC310 6B1A033F
04000000 04ECC314 54000061
04000000 04ECC318 BD405000
04000000 04ECC31C BD003800
04000000 04ECC320 BD403800
04000000 04ECC324 A9776BF9
04000000 04ECC328 175EAECB
04000000 04ECC32C 64700000

stp x25, x26, [sp,#-0x90]
ldr w25,e
ldr x26, [sp,8]
lsl w26,w26,16
cmp w25, w26
b.ne original
ldr s0, [x0, #0x50]
str s0, [x0, #0x38]
original: {original}
ldp x25, x26, [sp,#-0x90]
return: b code1+4
e:.word 0x64700000

[hp asm2]
04000000 0209246C D63F0120
04000000 0209246C 14B8E7B1
04000000 04ECC330 A9376BF9
04000000 04ECC334 F9402419
04000000 04ECC338 B940533A
04000000 04ECC33C B9003B3A
04000000 04ECC340 A9776BF9
04000000 04ECC344 D63F0120
04000000 04ECC348 1747184A

STP X25, X26, [SP,#-0x90]
ldr x25, [x0,0x48]
ldr w26, [x25,0x50]
str w26, [x25,0x38]
return:
LDP X25, X26, [SP,#-0x90]
blr x9
b code1+4

Can be further shorten by three opcodes by change b to bl and blr to br
[hp asm2 v2]
04000000 0209246C 94B8E7B1
04000000 04ECC330 A9376BF9
04000000 04ECC334 F9402419
04000000 04ECC338 B940533A
04000000 04ECC33C B9003B3A
04000000 04ECC340 A9776BF9
04000000 04ECC344 D61F0120

Members-only download
This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.
can't seem to replicate this, could you write the steps to achieve this when you have time?
sometimes 0 count when I watch breakpoint using stack, also x30_catch keep changing back to offset after used x30_catch =stack and detached, not sure if that is normal or not
1.jpg2.jpg3.jpg
 
Last edited by dsrules,
mine is show p2 also where the stack show offset aswell stack_offset=1,0x8
I got it from here
Members-only download
This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

p1 and p2 from github are exactly the same file date and time
9/12/2024 9:23 PM
 
Last edited by dsrules,
p2 now = p1 at github same filesize date and time
only gen2.zip is different
i have no idea i remember when i installed p1 then install gen2 retsrt ,atmostphere wont let me boot in error, then i update atmostphere to the latest then it works
 
i have no idea i remember when i installed p1 then install gen2 retsrt ,atmostphere wont let me boot in error, then i update atmostphere to the latest then it works
maybe TomSwitch uploaded the wrong file when he updated gen2
 

Attachments

  • Breeze.zip
    Breeze.zip
    6.4 MB · Join the group to download
These files are for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to download them. It's free.

Group statistics

Group owner:
matias3ds
Members:
86081
Threads:
7770
Messages:
42276
Photos:
0

Site & Scene News