Hacking Datel Powersaves now supports Pokemon X/Y

[aos10]

i don't know if it mention before
but,the save file is 1 mb .bin
is there no way to edit it ?

i heard there is another tool to edit the 3DS game , i think its called cyber 3ds or something like that , but its for Japaneses games
and you use some HEX editor for known address

 

[Sheimi]

Why are people actually doing so difficult? It should be damn easy to change things . You make a backup and look afterwards what has changed with a HEX editor and voila?

It took me hours and hours to make a edited digital save boot without error. It's not easy at all. I spent half the day trying.

 

[kyogre123]

It took me hours and hours to make a edited digital save boot without error. It's not easy at all. I spent half the day trying.

Would you share your secrets?

 

[Deleted User]

I already did that, if you corrupt the save with 0xFF and then start pokemon without saving it creates a save with correct hashs but just 0xFF instead of save files, if you send that save to their server you get a save with just 0x00 but encrypted, so basically you get the decrypt key from their server since the encryption is xor.

But it's impossible to get the correct decrypt key for the hashs since they always change and datels server don't except broken saves.
There are 6 hashs, here a simple compare test, note: all values are encrypted.

Different between:
First file:  "C:\Users\Falo\Powersaves3DS\pokemon backup\languages\EKJA????????_2014-03-20_01-25-47_(Backup German).bin"
Second file: "C:\Users\Falo\Powersaves3DS\pokemon backup\languages\EKJA????????_2014-03-20_01-25-57_(Backup France).bin"
Shift: 0
------------------------------------------------------------------------
00000018 | 68 9A 19 63            | 00000018 | D9 81 1B 9C            | <-- powersave checksum
------------------------------------------------------------------------
00000028 |      47    65    72    | 00000028 |      46    72    61    | <-- save name
00000030 | 6D    61    6E          | 00000030 | 6E    63    65          |
------------------------------------------------------------------------
00000098 |            49 C5 2B 79 | 00000098 |            A2 C6 7C 0C | <-- AES-MAC hash
000000A0 | F7 0F 02 ED 3B 09 F6 8B | 000000A0 | 6E 69 C1 B2 6B 46 9C 67 |
000000A8 | 62 9D 42 F2            | 000000A8 | 3C F1 91 E5            |
------------------------------------------------------------------------
00000208 | E4 45 8B 85 77 2F 2E F5 | 00000208 | 99 10 38 9E E6 29 72 56 | <-- DISA hash
00000210 | B1 BE 5F C4 21 42 34 6A | 00000210 | 06 5E 96 FB 67 7E B8 8E |
00000218 | 4C 3F 8A 82 11 17 07 16 | 00000218 | 72 87 26 6D D8 19 61 A1 |
00000220 | D9 1A 6B B5 2B 26 6D 8D | 00000220 | 4A 52 1A EA 8A 15 A3 5A |
------------------------------------------------------------------------
000004D8 | 47 E3 57 80 72 DE D9 B5 | 000004D8 | 9A B9 B9 22 7D 13 95 12 | <-- DIFI hash
000004E0 | B2 DA B1 8C BF E5 CB AC | 000004E0 | FB A2 F3 4A 74 17 2C 7D |
000004E8 | 73 B9 D4 04 0F AF 20 54 | 000004E8 | BD D0 C6 25 C0 A6 1F 20 |
000004F0 | 3B D5 32 AE 2B 95 A0 D1 | 000004F0 | 26 6A 93 ED 88 33 20 33 |
------------------------------------------------------------------------
00002098 |            8D 16 AA 70 | 00002098 |            8A 19 F8 3D | <-- ??? hash
000020A0 | C1 A1 AB 72 CE 6A B9 A4 | 000020A0 | 0D 6E B3 CC B9 D8 3A B8 |
000020A8 | FD 36 93 D6 49 68 6F 4E | 000020A8 | B9 39 DB 9E 3D CB 7C B8 |
000020B0 | CD FE 81 85 0A 1B 9C 8D | 000020B0 | 65 F9 14 29 B4 8E B0 56 |
000020B8 | 52 DA 5F F2 EB D5 65 E9 | 000020B8 | 33 FA D8 C0 5B 62 61 73 |
000020C0 | 43 71 6A 09 33 83 71 65 | 000020C0 | A2 44 A4 E8 8F 98 B1 60 |
000020C8 | FA 31 AD 54 3D 4D 88 AF | 000020C8 | F5 D5 D9 12 1C 73 47 F9 |
000020D0 | 10 4F 72 88 5C EB 3D 90 | 000020D0 | A5 FB 90 01 83 22 64 10 |
000020D8 | 17 74 38 A3            | 000020D8 | 2E 84 F1 D1            |
------------------------------------------------------------------------
00002398 |            49 33 52 34 | 00002398 |            2A 1A 46 9B | <-- DISA hash
000023A0 | 67 8B F6 DE 84 57 3D 94 | 000023A0 | 72 E1 64 7E 61 56 BA 12 |
000023A8 | FF 79 06 86 01 14 A2 23 | 000023A8 | 6D 30 60 AD 8B F6 95 12 |
000023B0 | 10 9A 1F 97 7F 15 D9 14 | 000023B0 | 90 BC 38 2C 50 DF 89 07 |
000023B8 | 4D 72 73 E9            | 000023B8 | 42 50 50 60            |
------------------------------------------------------------------------
00002DB8 |            A3 9A E5 89 | 00002DB8 |            CF 72 C7 AB | <-- DIFI hash
00002DC0 | 34 FC 45 47 71 05 95 4A | 00002DC0 | 7D EF 8A EC BA 2D 13 68 |
00002DC8 | E9 9D 84 DB FD 9A D0 2D | 00002DC8 | FB 0C DE 1C 5F AF 0E 28 |
00002DD0 | DF 93 27 AD F2 03 B5 A4 | 00002DD0 | 07 70 DE 38 2D 2E 10 F0 |
00002DD8 | 48 F0 7E EF            | 00002DD8 | 4B 2F 45 BF            |
------------------------------------------------------------------------
000194C8 |    2E                  | 000194C8 |    28                  | <-- decrypted value changed from 05 to 03 (german to france)
------------------------------------------------------------------------
0006A938 |                  85 CE | 0006A938 |                  67 D3 | <-- decrypted value changed from 6F 44 to 8D 59 (checksum?)
------------------------------------------------------------------------

Hmm, I'm sure you've already seen this but: http://projectpokemon.org/forums/sh...-File-Research&p=182373&viewfull=1#post182373

I've been doing some research on XOR and it doesn't seem all that crazy, if datel can do it; so can we! Again this is where me having a 3ds and all these tools would be helpful :/

 

[Kaphotics]

Hmm, I'm sure you've already seen this but: http://projectpokemon.org/forums/sh...-File-Research&p=182373&viewfull=1#post182373

I've been doing some research on XOR and it doesn't seem all that crazy, if datel can do it; so can we! Again this is where me having a 3ds and all these tools would be helpful :/

Except Datel actually decrypts them instead of using XORs to reveal before/after plaintext.

Datel receives your encrypted save file and a piece of the ROM necessary to run the AES encryption/decryption for your save file. All that is done client side is fetching of the two pieces and selecting of codes to apply.

As I already said @PP:
Pursuing anything with PowerSaves will get you nowhere.

They will not accept your edited save files (they have to be valid for their 3DS to load them or else -> Web Operation Failed), nor are you able to have custom codes. The only thing you can glean is how some edits were done; however you can manipulate ingame to get most relevant information out.

 

[Deleted User]

What I'm trying to say is if they can do it, we can to;
plus they provide us with a tool that connects game cartridges to the PC; has anybody done any digging to the driver of the USB tool?

 

[DoMoo]

The new Codes are 50/100 Interesting

 

[naruto5293]

hmph, i wonder why event garchomp was removed. was it corrupting saves? i could've gotten it last night, but i guess it wasn't meant to be...

 

[DoMoo]

Event Garchomp?

 

[RemixDeluxe]

Event Garchomp?

Pokemon X and Y got reprinted with event Pokemon included to push more sales on the games. One copy of the game got an event Garchomp and the other an event Scizor.

Not sure if they have exclusive moves or anything to make them even worth owning, you could probably pokegen a better one anyways.

 

[Mrjonnyvision]

Is there any way to get these unreleased pokemon/items again? I already got Diancie but wanted Other items like the mega stones for latios/latias. I highly doubt it cause they removed it from their server, but there is still a way to do this. You just need alot of patience and intelligence.

 

[RemixDeluxe]

Is there any way to get these unreleased pokemon/items again? I already got Diancie but wanted Other items like the mega stones for latios/latias. I highly doubt it cause they removed it from their server, but there is still a way to do this. You just need alot of patience and intelligence.

Meet with someone locally that happened to have gotten it while it was available (or ship your game to someone.) Thats the best you can hope for, as far as getting it early.

 

[BvanBart]

Said by someone who has absolutely no idea what they are saying.

There are hashes of the savefile; if left uncorrected you will have a 'corrupt savefile'.

Funny, software developer here...

 

[Mrjonnyvision]

So does anyone know an alternate id changer/hex changer or editor that will let us get those unreleased items again?

 

[RemixDeluxe]

So does anyone know an alternate id changer/hex changer or editor that will let us get those unreleased items again?

Datel is in complete control of what content is released. Unless we as a community find out how decrypting and encrypting for 3DS saves work, we cant accomplish anything on our own.

TL;DR We are at Datel's mercy.

 

[khalaan]

Consider yourself lucky, I have been tinking with 3ds development so I've been running emunand classic to play PY, which it turns out isn't compatible with the Datel so I have a 30.00 paper weight unless I can figure out a way to dissect their files and get something usable out of it... Though I have a PY save with the old encryption so I guess that's a plus, kind of...

 

[ShinyJellicent12]

I tried Cheat Engine before realizing it didn't work lol but I'm pretty sure Datel will just end up releasing the codes when the actual event is released. When the Diancie event is released, they'll release the Diancie cheat. I was hoping for Diancie/AZ's Floette/Lati@site, but it's whatever :/ as long as I can clone my leftovers :3

 

[chrisrlink]

About what exactly? What do you wanna know.

I hope you didnt buy this for the event Pokemon/items cause they are gone.

even blazikennite torchic? or only the unreleased events?also to get x999 of everything....oh my bad if I get all megastones I won't need it

 

[ShinyJellicent12]

even blazikennite torchic? or only the unreleased events?also to get x999 of everything

The codes currently here are for:

• Max Money
• Max BP
• Max Pokemiles
• Item slots 1-10 x999
• 999 Master Balls, Heart Scales, Destiny Knots, Mega Stones (minus Lati@site), and other evolutionary stones in first slot
• 999 recovery items in first recovery item slot (Rare Candies, PP Max, Iron etc.)
• 999 berries in first berry slot
• Delete the first pokemon in box 1 of the PC
• Make Pokemon 1-10 in box 1 of the PC shiny
• Make the first Pokemon unshiny in box 1 of the PC
• Torchic Wonder Card
• Full O-Power Orbs and all O-Powers
• Floette forms 1-5 (a floette must be in box 1 slot 1)
• Language modifier

So yes, basically everything but the unreleased content is still here

 

[RemixDeluxe]

even blazikennite torchic? or only the unreleased events?also to get x999 of everything

Everything else is intact, the only things removed was unreleased content. Even the event garchomp was removed which is odd since that is already available to the public.