ROM Hack Cheat Codes AMS and Sx Os, Add and Request

[Jericoss]

I was not blaming anyone here in this thread.
I put a post in the atmosphere thread, hoping someone would answer, but to no avail...

where is the the atmosphere thread???
can you guide me there? thanks.

 

[Gamerjin]

this is the one i made the post on:
https://gbatemp.net/threads/atmosphere-nx-custom-firmware-in-development-by-sciresm.496832/

as for the actual post:
https://gbatemp.net/threads/atmosph...pment-by-sciresm.496832/page-264#post-8921571

 

[Meko]

loosely translated Tokyo cheats

[2 times the effect of incense props]
04000000 0015A8F8 E0820080

[4 times the effect of incense props]
04000000 0015A8F8 E0820100

[8 times the effect of incense props]
04000000 0015A8F8 E0820180

[After using the magic book once, the battle will be upgraded]
04000000 0015A764 E2401000

[After using the magic book once, the battle will be upgraded close]
04000000 0015A764 E0401004

 

[Jericoss]

i am searching for U16 in Main with edizon but after the first search it says in the second run no one of the values have been changed ...
am i doing something wrong ?

 

[dsrules]

In case anyone would like to try it out to find the pointers and health values

https://mega.nz/#!yyQm2CoR!Hm1FXocvhw9iEspOmU3MzLY4mGjZm_TursLhKUTcjLs

same as Doom 3 Ammo Clip, not found when click Narrow regardless what settings are used

 

[Jericoss]

In case anyone would like to try it out to find the pointers and health values

https://mega.nz/#!yyQm2CoR!Hm1FXocvhw9iEspOmU3MzLY4mGjZm_TursLhKUTcjLs

What is this? a dump for Noexs?

 

[dsrules]

this is the one i made the post on:
https://gbatemp.net/threads/atmosphere-nx-custom-firmware-in-development-by-sciresm.496832/

as for the actual post:
https://gbatemp.net/threads/atmosph...pment-by-sciresm.496832/page-264#post-8921571

most of the people don't know anything about other cheat codetypes, you will have the tag the author of AMS or Edizon

 

[Jericoss]

most of the people don't know anything about other cheat codetypes, you will have the tag the author of AMS or Edizon

@dsrules .That is not in SX OS Cheat Hacker Guide?

# Code Type 1: Conditional statements

1TMC00AA AAAAAAAA YYYYYYYY (YYYYYYYY)

T = width of comparison value (1/2/4/8)
M = memory type (0 = main nso, 1 = heap)
C = Condition to use for comparison
A = Address relative to (M)
Y = Value to compare against

List of valid conditions:
- 1: Greater Than
- 2: Greater Than or Equal To
- 3: Lower Than
- 4: Lower Than or Equal To
- 5: Equal To
- 6: Not Equal To

Spoiler

SX OS Cheat Hacker Guide
========================

--[ 1. Introduction

This small guide attempts to shed some light on finding your own cheat codes
for Switch games using the SX OS Cheat finder as well as detailing the specifics
about the SX OS Cheat Code Format.

--[ 2. Address Space Layout Randomization

The Nintendo Switch Operating System (Horizon OS) implements Address Space
Layout Randomization (from here on ASLR) for every process. What this means
is that the absolute base address of for example a game's executable or a
game's heap memory are not fixed in stone. SX OS does *not* disable this ASLR
as it would effectively make your console less secure. The downside of this is
that you as a cheat hunter will need to keep this in mind when finding cheats,
but we've tried our best to encapsulate/hide these details at a high level.

When working with pointers in the SX OS Cheat Engine you can have three different
type of pointers:
* MAIN - memory addresses/pointers relative to the game's NSO executable
* HEAP - memory addresses/pointers relative to the start of the game's heap
* BASE - memory addresses/pointers that are neither part of MAIN/HEAP,
they are displayed a relative to the address space base (usually 0x8000000)

Throughout the SX OS Cheat finder every memory address is thus displayed as:
[MAIN+xxxx], [HEAP+xxxx], [BASE+xxxx]

When writing actual cheat codes you need to specify what kind of address you are
reading/writing from, we support reading/writing from/to both MAIN and HEAP memory.

Remember that having cheat codes which write to a magic HEAP address are most of
the time not very stable/reliable cheat codes, because the layout of the HEAP is
not always fully deterministic and often times depends on how someone navigates
through a game. In these cases it is better to study the game logic more and find
pointers (or pointers to pointers, etc.) until you traced back to an address that
resides in MAIN (a pointer in BSS or RO for example). At the end of this guide
you will find a small case study of how the included codes for
"Mega Man Legacy Collection" work.

--[ 3. SX OS Cheat Code Format

SX OS Cheat Codes are loosely inspired by older cheat engines such as Action Replay.
While old Action Replay cheat codes usually had a fixed width per code, some code
types in the SX OS cheat engine can have a different length.

Cheat codes are placed inside the sxos folder on your microSD card. In order
for SX OS to pick up your cheat codes they need to be correctly placed in the
right subfolders. This subfolder format works like this:
/sxos/titles/<titleID>/cheats/<buildID>.txt

Where titleID is the titleID of the game and buildID are the first 8bytes of the
game's build ID formatted as ascii hexadecimals. Both the titleID and buildID for
a running game are displayed below the SXOS logo when you navigate to the cheats
tab in the SX OS Menu. The buildID is needed to properly deal with different
versions of the same game, which might lead to incompatibilities for cheat codes.
When SX OS detects you have cheats on your SD cards for the currently running game
but the buildID mismatches, it offers you to copy over the cheats from the other
buildID to the one of the version you are currently running, if you want to
experiment with (or fix) the compatibility of certain cheat codes.

A basic cheat code definition will look like this:

[Infinite Health]
11111111 22222222
11111111 22222222
11111111 22222222

Where 'Infinite Health' is the displayed name of the code and the lines containing
'11111111 22222222' are all the codes that belong to this cheat.

The cheat engine supports up to 16 'scratch' registers which can be used for
arbitrary purposes like stashing offsets or memory locations.

There is one special type of code. The "master code" which is not defined by
enclosing the name in '[' and ']' but using '{' and '}' instead. The master code
cannot be disabled and is executed before any other (enabled) cheat code. These
exists to avoid duplication in multiple cheats which share certain characteristics.
An example of master code usage can be seen in the case study for the
"Mega Man Legacy Collection" cheats you will find further down in this guide.

Below is an overview of the various code types currently implemented in the SX
OS Cheat Engine.

# Code Type 0: Write to memory

0TMR00AA AAAAAAAA YYYYYYYY (YYYYYYYY)

T = width of write (1/2/4/8)
M = memory type (0 = main nso, 1 = heap)
R = register to be added as offset
A = address relative to (M)

With code type 0 you can do a write to memory.

# Code Type 1: Conditional statements

1TMC00AA AAAAAAAA YYYYYYYY (YYYYYYYY)

T = width of comparison value (1/2/4/8)
M = memory type (0 = main nso, 1 = heap)
C = Condition to use for comparison
A = Address relative to (M)
Y = Value to compare against

List of valid conditions:
- 1: Greater Than
- 2: Greater Than or Equal To
- 3: Lower Than
- 4: Lower Than or Equal To
- 5: Equal To
- 6: Not Equal To

# Code Type 2: End of conditional statement

20000000

This code type terminates an conditional block (Code type 3 or 8)

# Code Type 3: Looping

300R0000 VVVVVVVV

R = Register to use for loop counter
V = Loop count

310R0000

This code type is used at the end of the loop, use the same R value as
for the start of the loop.

# Code Type 4: Load register with value

400R0000 VVVVVVVV VVVVVVVV

This code type will load one of the registers with a specific value

R = Register to be filled
V = Value to be put in register

# Code Type 5: Load register with value from memory

5TMRI0AA AAAAAAAA

T = Width of value to be loaded from memory (1/2/4/8)
M = memory type (0 = main nso, 1 = heap)
R = Load from register index
I = Load from register flag, set to 1 to load from register R instead of address A
A = Address relative to (M)

# Code Type 6: Store value to memory address from register

6T0RIor0 VVVVVVVV VVVVVVVV

T = Width of value to be stored to memory
R = Register index containing the memory address
I = Increment register flag, set to 1 to increment the register by T after storing
o = add additional offset from register 'r'
r = offset register index
V = value to be stored to memory

# Code Type 7: Apply arithmic operation to register

7T0RC000 VVVVVVVV

T = Width of value (1/2/4/8)
R = Register index to apply arithmic operation to
C = Arithmic operation to apply:
0 = addition, 1 = subtraction, 2 = multiplication, 3 = shift left, 4 = shift right
V = Value to be used during arithmic operation

# Code Type 8: Check for buttons being pressed

8kkkkkkk

k = keypad value to check against. the hex values for the various keys are:

0000001 - A
0000002 - B
0000004 - X
0000008 - Y
0000010 - Left Stick Pressed
0000020 - Right Stick Pressed
0000040 - L
0000080 - R
0000100 - ZL
0000200 - ZR
0000400 - Plus
0000800 - Minus
0001000 - Left
0002000 - Up
0004000 - Right
0008000 - Down
0010000 - Left Stick Left
0020000 - Left Stick Up
0040000 - Left Stick Right
0080000 - Left Stick Down
0100000 - Right Stick Left
0200000 - Right Stick Up
0400000 - Right Stick Right
0800000 - Right Stick Down
1000000 - SL
2000000 - SR

Multiple button values can be combined by OR'ing them together. For example
A+B becomes 0000003, and A+B+X+Y becomes 000000f.

This code type otherwise behaves the same as the conditional code type 1.

--[ 4. Using the Cheat Finder in SX OS

SX OS Comes with a cheat searcher functionality that will help you in identifying
the memory locations you need in order to write your own cheat codes. You start
by launching a game, when you reach a point in the game where you want to start
searching for cheats you hit the home button, and navigate to the album viewer (SX OS Menu).

You can start a cheat search by navigating to "Cheat Searcher" in the cheat tab of the
SX OS menu. You will be prompted to pick what kind of value you want to start
a cheat search for. If you dont know the answer you can try to approximate it. Lets say
you want to hunt down the memory location of your in-game coins, and you know
that you can accumulate over 1000 coins, you know for sure the data type you are
looking for is gonna be bigger than 8-bit. This takes some experimentation and
expertise to get used to.

Once you select the data type a memory dump for the running game will be created
on your microSD card. This initial memory dump will take a while, it is advised
to use a fast microSD card with enough free space. If you are looking for a
specific/exact value, you can now select "Next Search" and pick "Exact Value",
here you can enter the exact value you're looking for (in hexadecimal). Once the
comparison is done it will tell you how many candidate memory locations it found
and whether they are few enough to manually explore.

If there's too many candidates left, you simply exit the SX OS Rom Menu and go
back to the game. Try to grab/lose some coins (or whatever item you're trying
to cheat) and head back into the SX OS menu's cheat tab, pick "Next Search" and
specify the condition. This can be "exact value" again if you know the value
you're looking for, or simply "less than" if you know you just lost some of the
desired item/stats. Keep iterating the searches until the cheat searcher tells
you there's few enough candidate memory locations left for you to start
exploring manually.

Manually exploring memory location candidates can be done by going to "View candidates"
in the cheats menu. When you select a candidate from the list you will be brought
to the builtin hex editor where you can change the values at these memory locations.
Once you change a value you can go back to the game and see if your change had
any/the desired effect to help in concluding whether you found the right memory
location.

--[ 5. Case Study of "Mega Man: Legacy Collection" cheat codes.

Currently we only provide a single example of working cheat codes. We would love
to spend all of our time on finding more cheats, but we have different priorities. ;-)

The cheats we found are a slightly interesting example though of the various code
types the SX OS Cheat Engine currently offers.

Mega Man: Legacy Collection is a collection of old Mega Man games originally
released for the NES back in the day. The switch "port" of these games is actually
a NES emulator in disguise. The meat of our Mega Man cheat codes hinges on the
"master code" which finds the virtual NES' memory start address, from there we
can apply any RAM patches to the NES memory as we wish. Let's have a look at how
this works.

The full master code looks like this:

-- 8< ------------------------
{Master Code}
580f0000 00d3a2a0
580f1000 038cb840
580f1000 00000008
780f0000 0000000f
-- 8< ------------------------

The usage of '{' and '}' indicates that this is a master code, eg. a code that
cannot be disabled and is always ran at the start of your cheat code list.

Lets break down the master code line by line:
580f0000 00d3a2a0

Code type 5 is 'Load register with value from memory', here we load a 8 byte (64bit)
value, relative from MAIN (0) into register 'f' (15). The offset from the start of
MAIN is 0xd3a2a0.

In pseudocode this would be something like:

register_f = read64(MAIN + 0xd3a2a0)

The next line reads:
580f1000 038cb840

This one is very similar to the first code, but notice how we have an '1' there.
if you look this up in the SX OS Code Format description above you can see this
is the 'Load from register flag'. If set to '1' we will take the address from the
register specified in the register index field rather than a memory location
relative from MAIN or HEAP. In pseudocode this would be:

register_f = read64(register_f + 0x38cb840)

The following line '580f1000 00000008' is more of the same, this time reading
the next pointer from offset 8, or in pseudocode:

register_f = read64(register_f + 0x8)

Then finally we we end with '780f0000 0000000f'. Which uses code type 7 to do
some basic arithmic to the memory location in register f. In pseudo code this
would be:

register_f = register_f + 15

So in essence all the "master code" does is follow a bunch of pointers and
eventually end up with a pointer in register F that holds the start of the virtual
NES' memory. This register f value can then be used in any cheat codes that need
to write/read from the virtual NES' memory in order to give Mega Man exciting
super powers! ;-)

Let's have a quick look at one of the game specific cheat codes for Mega Man 1:

[MM1 Infinite Health]
400e0000 00000000 0000006a
610f01e0 00000000 0000001c

The first line '400e0000 00000000 0000006a' is using code type #4 to load a
register with a specific value. In this case we load register E with value 0x6a.
0x6a is the RAM offset for Mega Man's health.

The following line '610f01e0 00000000 0000001c' is using code type #6, which
is "Store value to memory address from register" to write to this location.

Here we say write a 1 byte (8bit) value to the address: register_f + register_e.
The value to be written is 0x1c, the maximum value Mega Man's health can have
in Mega Man 1.

--[ 6. Closing Words

We hope this guide outlines the possibilities of the cheat engine and the
need for decent master codes a bit. We are looking forward to many community
contributions with new cheat codes and of course suggestions for improving our
cheat code finder and engine.

Yours Sincerely,

Team Xecuter -- Rocking the switch in 2018 and beyond!

 

[Gamerjin]

most of the people don't know anything about other cheat codetypes, you will have the tag the author of AMS or Edizon

well, i did ask in the edizon discord server, he had said that it was atmosphere.

@Jericoss, thats for static address, i was referring to the 0xC register block condition check

Spoiler

### Code Type 0xC0: Begin Register Conditional Block

Code type 0xC0 performs a comparison of the contents of a register and another value. This code support multiple operand types, see below.

If the condition is not met, all instructions until the appropriate conditional block terminator are skipped.

#### Encoding

```
C0TcSX##
C0TcS0Ma aaaaaaaa
C0TcS1Mr
C0TcS2Ra aaaaaaaa
C0TcS3Rr
C0TcS400 VVVVVVVV (VVVVVVVV)
C0TcS5X0
```

+ T: width of memory write (1, 2, 4, or 8 bytes)
+ c: Condition to use, see below.
+ S: Source Register
+ X: Operand Type, see below.
+ M: Memory Type (operand types 0 and 1)
+ R: Address Register (operand types 2 and 3)
+ a: Relative Address (operand types 0 and 2)
+ r: Offset Register (operand types 1 and 3)
+ X: Other Register (used for operand type 5)
+ V: Value to compare to (operand type 4)

#### Operand Type

+ 0: Memory Base + Relative Offset
+ 1: Memory Base + Offset Register
+ 2: Register + Relative Offset
+ 3: Register + Offset Register
+ 4: Static Value
+ 5: Other Register

#### Conditions

+ 1: >
+ 2: >=
+ 3: <
+ 4: <=
+ 5: ==
+ 6: !=

 

[Jericoss]

well, i did ask in the edizon discord server, he had said that it was atmosphere.

@Jericoss, thats for static address, i was referring to the 0xC register block condition check

Spoiler

### Code Type 0xC0: Begin Register Conditional Block

Code type 0xC0 performs a comparison of the contents of a register and another value. This code support multiple operand types, see below.

If the condition is not met, all instructions until the appropriate conditional block terminator are skipped.

#### Encoding

```
C0TcSX##
C0TcS0Ma aaaaaaaa
C0TcS1Mr
C0TcS2Ra aaaaaaaa
C0TcS3Rr
C0TcS400 VVVVVVVV (VVVVVVVV)
C0TcS5X0
```

+ T: width of memory write (1, 2, 4, or 8 bytes)
+ c: Condition to use, see below.
+ S: Source Register
+ X: Operand Type, see below.
+ M: Memory Type (operand types 0 and 1)
+ R: Address Register (operand types 2 and 3)
+ a: Relative Address (operand types 0 and 2)
+ r: Offset Register (operand types 1 and 3)
+ X: Other Register (used for operand type 5)
+ V: Value to compare to (operand type 4)

#### Operand Type

+ 0: Memory Base + Relative Offset
+ 1: Memory Base + Offset Register
+ 2: Register + Relative Offset
+ 3: Register + Offset Register
+ 4: Static Value
+ 5: Other Register

#### Conditions

+ 1: >
+ 2: >=
+ 3: <
+ 4: <=
+ 5: ==
+ 6: !=

@BASgamer Do you know anything about this?? Once you asked about it.
@AnalogMan

--------------------- MERGED ---------------------------

@Jericoss, thats for static address, i was referring to the 0xC register block condition check

I couldn't find anything about that, sorry.
What I saw in other forums is that optantic was finding out about that a long time ago, maybe he knows.

 

[Jericoss]

Those not, others yes

Warriors Orochi 3
credits to @Momotaro

Spoiler

[Basic Attack Power Up of Weapons v 1.0.11]
300E0000 00001F5F
01100000 12398A30 00000063
78000000 00000024
310E0000
20000000

[Exp Max finn527 91wii]
04100000 11F65088 0098967F

[Rare Stone]
04100000 11F65084 000003E7

[Precious Stone]
04100000 11F6507C 0098967F

[Weapon attributes]
04100000 11f65098 0000270F
04100000 11f6509A 0000270F
04100000 11f6509C 0000270F
04100000 11f6509E 0000270F
04100000 11f650A0 0000270F
04100000 11f650A2 0000270F
04100000 11f650A4 0000270F
04100000 11f650A6 0000270F
04100000 11f650A8 0000270F
04100000 11f650AA 0000270F
04100000 11f650AC 0000270F
04100000 11f650AE 0000270F
04100000 11f650B0 0000270F
04100000 11f650B2 0000270F
04100000 11f650B4 0000270F
04100000 11f650B6 0000270F
04100000 11f650B8 0000270F
04100000 11f650BA 0000270F
04100000 11f650BC 0000270F
04100000 11f650BE 0000270F
04100000 11f650C0 0000270F
04100000 11f650C2 0000270F
04100000 11f650C4 0000270F
04100000 11f650C6 0000270F
04100000 11f650C8 0000270F
04100000 11f650CA 0000270F
04100000 11f650CC 0000270F
04100000 11f650CE 0000270F
04100000 11f650D0 0000270F
04100000 11f650D2 0000270F
04100000 11f650D4 0000270F
04100000 11f650D6 0000270F
04100000 11f650D8 0000270F
04100000 11f650DA 0000270F
04100000 11f650DC 0000270F
04100000 11f650DE 0000270F
04100000 11f650E0 0000270F
04100000 11f650E2 0000270F
04100000 11f650E4 0000270F
04100000 11f650E6 0000270F
04100000 11f650E8 0000270F
04100000 11f650EA 0000270F
04100000 11f650EC 0000270F
04100000 11f650EE 0000270F
04100000 11f650F0 0000270F
04100000 11f650F2 0000270F
04100000 11f650F4 0000270F
04100000 11f650F6 0000270F
04100000 11f650F8 0000270F
04100000 11f650FA 0000270F
04100000 11f650FC 0000270F
04100000 11f650FE 0000270F
04100000 11f65100 0000270F
04100000 11f65102 0000270F
04100000 11f65104 0000270F
04100000 11f65106 0000270F
04100000 11f65108 0000270F
04100000 11f6510A 0000270F
04100000 11f6510C 0000270F
04100000 11f6510E 0000270F
04100000 11f65110 0000270F
04100000 11f65112 0000270F
04100000 11f65114 0000270F
04100000 11f65116 0000270F

[Weapon Material M Max]
04100000 11F6A74E 000003E7
04100000 11F6A750 000003E7
04100000 11F6A752 000003E7
04100000 11F6A754 000003E7
04100000 11F6A756 000003E7
04100000 11F6A758 000003E7
04100000 11F6A75A 000003E7
04100000 11F6A75C 000003E7
04100000 11F6A75E 000003E7
04100000 11F6A760 000003E7
04100000 11F6A762 000003E7
04100000 11F6A764 000003E7
04100000 11F6A766 000003E7
04100000 11F6A768 000003E7
04100000 11F6A76A 000003E7
04100000 11F6A76C 000003E7
04100000 11F6A76E 000003E7
04100000 11F6A770 000003E7
04100000 11F6A772 000003E7
04100000 11F6A774 000003E7
04100000 11F6A776 000003E7
04100000 11F6A778 000003E7
04100000 11F6A77A 000003E7
04100000 11F6A77C 000003E7
04100000 11F6A77E 000003E7
04100000 11F6A780 000003E7
04100000 11F6A782 000003E7
04100000 11F6A784 000003E7
04100000 11F6A786 000003E7
04100000 11F6A788 000003E7
04100000 11F6A78A 000003E7
04100000 11F6A78C 000003E7
04100000 11F6A78E 000003E7
04100000 11F6A790 000003E7
04100000 11F6A792 000003E7
04100000 11F6A794 000003E7
04100000 11F6A796 000003E7
04100000 11F6A798 000003E7
04100000 11F6A79A 000003E7
04100000 11F6A79C 000003E7
04100000 11F6A79E 000003E7
04100000 11F6A7A0 000003E7
04100000 11F6A7A2 000003E7
04100000 11F6A7A4 000003E7
04100000 11F6A7A6 000003E7
04100000 11F6A7A8 000003E7
04100000 11F6A7AA 000003E7
04100000 11F6A7AC 000003E7
04100000 11F6A7AE 000003E7
04100000 11F6A7B0 000003E7
04100000 11F6A7B2 000003E7
04100000 11F6A7B4 000003E7
04100000 11F6A7B6 000003E7
04100000 11F6A7B8 000003E7
04100000 11F6A7BA 000003E7
04100000 11F6A7BC 000003E7
04100000 11F6A7BE 000003E7
04100000 11F6A7C0 000003E7
04100000 11F6A7C2 000003E7
04100000 11F6A7C4 000003E7
04100000 11F6A7C6 000003E7
04100000 11F6A7C8 000003E7
04100000 11F6A7CA 000003E7
04100000 11F6A7CC 000003E7
04100000 11F6A7CE 000003E7
04100000 11F6A7D0 000003E7
04100000 11F6A7D2 000003E7
04100000 11F6A7D4 000003E7
04100000 11F6A7D6 000003E7
04100000 11F6A7D8 000003E7
04100000 11F6A7DA 000003E7
04100000 11F6A7DC 000003E7
04100000 11F6A7DE 000003E7
04100000 11F6A7E0 000003E7
04100000 11F6A7E2 000003E7
04100000 11F6A7E4 000003E7
04100000 11F6A7E6 000003E7
04100000 11F6A7E8 000003E7
04100000 11F6A7EA 000003E7
04100000 11F6A7EC 000003E7
04100000 11F6A7EE 000003E7
04100000 11F6A7F0 000003E7
04100000 11F6A7F2 000003E7
04100000 11F6A7F4 000003E7
04100000 11F6A7F6 000003E7
04100000 11F6A7F8 000003E7
04100000 11F6A7FA 000003E7
04100000 11F6A7FC 000003E7
04100000 11F6A7FE 000003E7
04100000 11F6A800 000003E7
04100000 11F6A802 000003E7
04100000 11F6A804 000003E7
04100000 11F6A806 000003E7
04100000 11F6A808 000003E7
04100000 11F6A80A 000003E7
04100000 11F6A80C 000003E7
04100000 11F6A80E 000003E7
04100000 11F6A810 000003E7
04100000 11F6A812 000003E7
04100000 11F6A814 000003E7
04100000 11F6A816 000003E7
04100000 11F6A818 000003E7
04100000 11F6A81A 000003E7
04100000 11F6A81C 000003E7
04100000 11F6A81E 000003E7
04100000 11F6A820 000003E7
04100000 11F6A822 000003E7
04100000 11F6A824 000003E7
04100000 11F6A826 000003E7
04100000 11F6A828 000003E7
04100000 11F6A82A 000003E7
04100000 11F6A82C 000003E7
04100000 11F6A82E 000003E7
04100000 11F6A830 000003E7
04100000 11F6A832 000003E7
04100000 11F6A834 000003E7
04100000 11F6A836 000003E7
04100000 11F6A838 000003E7
04100000 11F6A83A 000003E7
04100000 11F6A83C 000003E7
04100000 11F6A83E 000003E7
04100000 11F6A840 000003E7
04100000 11F6A842 000003E7
04100000 11F6A844 000003E7
04100000 11F6A846 000003E7
04100000 11F6A848 000003E7
04100000 11F6A84A 000003E7
04100000 11F6A84C 000003E7
04100000 11F6A84E 000003E7
04100000 11F6A850 000003E7
04100000 11F6A852 000003E7
04100000 11F6A854 000003E7
04100000 11F6A856 000003E7
04100000 11F6A858 000003E7
04100000 11F6A85A 000003E7
04100000 11F6A85C 000003E7
04100000 11F6A85E 000003E7
04100000 11F6A860 000003E7
04100000 11F6A862 000003E7
04100000 11F6A864 000003E7
04100000 11F6A866 000003E7
04100000 11F6A868 000003E7
04100000 11F6A86A 000003E7
04100000 11F6A86C 000003E7
04100000 11F6A86E 000003E7
04100000 11F6A870 000003E7
04100000 11F6A872 000003E7
04100000 11F6A874 000003E7
04100000 11F6A876 000003E7
04100000 11F6A878 000003E7
04100000 11F6A87A 000003E7
04100000 11F6A87C 000003E7
04100000 11F6A87E 000003E7
04100000 11F6A880 000003E7
04100000 11F6A882 000003E7
04100000 11F6A884 000003E7
04100000 11F6A886 000003E7
04100000 11F6A888 000003E7
04100000 11F6A88A 000003E7
04100000 11F6A88C 000003E7
04100000 11F6A88E 000003E7
04100000 11F6A890 000003E7
04100000 11F6A892 000003E7
04100000 11F6A894 000003E7
04100000 11F6A896 000003E7
04100000 11F6A898 000003E7
04100000 11F6A89A 000003E7
04100000 11F6A89C 000003E7
04100000 11F6A89E 000003E7
04100000 11F6A8A0 000003E7
04100000 11F6A8A2 000003E7
04100000 11F6A8A4 000003E7
04100000 11F6A8A6 000003E7
04100000 11F6A8A8 000003E7
04100000 11F6A8AA 000003E7
04100000 11F6A8AC 000003E7
04100000 11F6A8AE 000003E7
04100000 11F6A8B0 000003E7
04100000 11F6AA6E 000003E7
04100000 11F6AA70 000003E7
04100000 11F6AA72 000003E7
04100000 11F6AA74 000003E7
04100000 11F6AA76 000003E7
04100000 11F6AA78 000003E7
04100000 11F6AA7A 000003E7
04100000 11F6AA7C 000003E7
04100000 11F6AA7E 000003E7
04100000 11F6AA80 000003E7
04100000 11F6AA82 000003E7
04100000 11F6AA84 000003E7

[Perseus Heroes Max]
04100000 11F6A8B0 000003E7

--------------------- MERGED ---------------------------

this is the one i made the post on:
https://gbatemp.net/threads/atmosphere-nx-custom-firmware-in-development-by-sciresm.496832/

as for the actual post:
https://gbatemp.net/threads/atmosph...pment-by-sciresm.496832/page-264#post-8921571

Thanks

 

[dsrules]

well, i did ask in the edizon discord server, he had said that it was atmosphere.

@Jericoss, thats for static address, i was referring to the 0xC register block condition check

Spoiler

### Code Type 0xC0: Begin Register Conditional Block

Code type 0xC0 performs a comparison of the contents of a register and another value. This code support multiple operand types, see below.

If the condition is not met, all instructions until the appropriate conditional block terminator are skipped.

#### Encoding

```
C0TcSX##
C0TcS0Ma aaaaaaaa
C0TcS1Mr
C0TcS2Ra aaaaaaaa
C0TcS3Rr
C0TcS400 VVVVVVVV (VVVVVVVV)
C0TcS5X0
```

+ T: width of memory write (1, 2, 4, or 8 bytes)
+ c: Condition to use, see below.
+ S: Source Register
+ X: Operand Type, see below.
+ M: Memory Type (operand types 0 and 1)
+ R: Address Register (operand types 2 and 3)
+ a: Relative Address (operand types 0 and 2)
+ r: Offset Register (operand types 1 and 3)
+ X: Other Register (used for operand type 5)
+ V: Value to compare to (operand type 4)

#### Operand Type

+ 0: Memory Base + Relative Offset
+ 1: Memory Base + Offset Register
+ 2: Register + Relative Offset
+ 3: Register + Offset Register
+ 4: Static Value
+ 5: Other Register

#### Conditions

+ 1: >
+ 2: >=
+ 3: <
+ 4: <=
+ 5: ==
+ 6: !=

maybe you could report it here https://github.com/Atmosphere-NX/Atmosphere/issues or @SciresM if you are reading this

 

[Lionheartwolf]

Speaking of making cheats, I am very interested in some of these more advanced looking cheats like these recent TMS #FE cheats.

For example:

[No EP reduction during battle]
04000000 000CB034 E2411000

I am poking around that memory region, and I see how most of the cheats come from here, but I don't understand the values. It's not as simple as Float, Hex, or Decimal. It's all in a giant block of values that don't look too much different, but how did anybody find these addresses when a traditional value search would have never come up with this. Is this all disassembler stuff?

 

[RenShakaGSS5]

Warriors Orochi 3
credits to @Momotaro
Thanks

Thank you very much. It was very helpful.
Let's use the code you gave us.

 

[patjenova]

Speaking of making cheats, I am very interested in some of these more advanced looking cheats like these recent TMS #FE cheats.

For example:

[No EP reduction during battle]
04000000 000CB034 E2411000

I am poking around that memory region, and I see how most of the cheats come from here, but I don't understand the values. It's not as simple as Float, Hex, or Decimal. It's all in a giant block of values that don't look too much different, but how did anybody find these addresses when a traditional value search would have never come up with this. Is this all disassembler stuff?

it's assembly coding

 

[Spider_Man]

@dsrules ,@Smoker1
while i was browsing the noexs memory viewer near the ammo totals, i noticed something with the clip counter. it would appear that the game stores the clip counter close to the total ammo address, so i tried to freeze it, hoping to get a new solution to the infinite clip no reload. It didnt work, however, i did noticed that with the gunshot, if i switch away and back to it, it always had a full clip. so while it may not be a perfect solution, but when you have five or six imp throwing fire skulls and you have to stop and reload the shotgun.........
yeah, need i say any more?
anyway, if you want to test the code:

Doom 3
TitleID - 010029D00E740000
BuildID - 28b88c3bdf442ebb
Version - 1.0.3
[Full Clip on switch]
580F0000 0148D0C8
780F0000 000026C8
640F1000 00000000 0000000C
780F0000 00000004
640F0000 00000000 00000008
780F0000 00000010
640F1000 00000000 0000003C

update:if the code stop working, say switching loading areas like into alpha labs, try making a save and reloading that save....
update2: now, when switching areas, it closing because an error happened, so im gonna to see if this is the culprit and if i need to assign a key...

I used to get that so i assigned an activator to enable the code only when the fire button was pressed.

--------------------- MERGED ---------------------------

ok, so adding to the exist total ammo code we have, based on @Smoker1 original pointer:

[Inf Ammo Grenade]
580F0000 0148D0C8
780F0000 00002660
610F0000 00000000 000000FF

[Inf Ammo Gattling Gun]
580F0000 0148D0C8
780F0000 00002680
610F0000 00000000 000000FF

[Inf Ammo Plasma]
580F0000 0148D0C8
780F0000 00002658
610F0000 00000000 000000FF

these doom 3

 

[Senbou]

Hi guys..I have Tokyo Mirage Sessions #FE Encore and TID and BID matches the game but somehow cheats wont show on edizon..anyone know how to fix this? Thanks in advance

 

[Spider_Man]

right guys, sorry ive not been on for a few days, im now back in hospital for the month having kick ass chemo all day/every day.

i am limited what i can do (not because of the chemo) but for some gay reason my switch wont connect to the NHS wifi (tho it already was) unless i perform a firmware update.

Now i cant do the update or else my NEO will be out of date and wont be able to use my PC to connect and find addresses.

And im really thick when it comes to updating the free cfw's hence why i prefer sx os simple drop boot.dat and your good to go, plus my heads up my arse at the moment.

So im defo out of action (unless anyone has a very simple stright forward solution so that i can update my SD files to continue using Neo on the firmware update )

thanks

 

[Alucard93]

Wulverblade
TID:010033700418a000
BID:c68bc0a4f96db645

[Time Stop]
580F0000 02C6BE98
580F1000 00000098
580F1000 00000000
780F0000 00000174
640F0000 00000000 00000000

[Inf HP]
580F0000 02D22328
580F1000 00000010
580F1000 00000078
580F1000 00000000
580F1000 000000A0
780F0000 0000004C
640F0000 00000000 44000000

[Inf SP]
580F0000 02D22328
580F1000 00000010
580F1000 00000078
580F1000 00000000
580F1000 000000A0
780F0000 00000054
640F0000 00000000 42C80000

[Invincible]
580F0000 02D22328
580F1000 00000010
580F1000 00000078
580F1000 00000000
580F1000 000000A0
780F0000 00000040
640F0000 00000000 00000100

[Inf Lives]
580F0000 02D22328
580F1000 00000010
580F1000 00000078
580F1000 00000000
580F1000 000000A0
780F0000 00000058
640F0000 00000000 00000003

[Moon Jump]
80000002
580F0000 02C6BE98
580F1000 00000098
580F1000 00000000
580F1000 00000028
580F1000 00000020
580F1000 00000060
780F0000 000000D0
640F0000 00000000 41800000
20000000

Thanks for the cheats, could you please provide us the same cheats for the 1.3.0 version ?

 

[FunThomas]

@Jericoss : i don't know what you want to show with the 2 pics, some words might help to understand

when i look at the code
[Inf Health]
580F0000 02377808
580F1000 00000030
580F1000 000000A0
580F1000 00000000
780F0000 00000060
640F0000 00000000 00000004

i see it copies 8 Bytes from Main NSO to Register F

but your found results are in Heap ?
for me it looks like there is something wrong, maybe someone could please bring light into this?