ROM Hack DS Auto Trainer Maker (DSATM)

[Syzero]

for some reason i still get that error on the emulator 'the rom-image has crashed' but would it still work on my flash-cart (N-card).

(im using NO$GBA)

 

[cracker]

I test it in no$gba (debug) and it worked fine. Try it on your cart and hopefully it will do what the header tells it to (starting the processor at the different address).

 

[Syzero]

all i get is a white screen so i dont know wat i did wrong this is what i did:
1. load up the game and cheat txt and choose what to save it as
2. changed the slowmo and enable disable keys
3. did not add ram dump
4. hook into-arm7 embed into- arm7
5. auto patch

 

[cracker]

all i get is a white screen so i dont know wat i did wrong this is what i did:
1. load up the game and cheat txt and choose what to save it as
2. changed the slowmo and enable disable keys
3. did not add ram dump
4. hook into-arm7 embed into- arm7
5. auto patch

And this is with v3.1? Try using the address you used before but patching with the normal method. If it doesn't give you a white screen on boot then it means that the flash cart is ignoring the header.

 

[Syzero]

all i get is a white screen so i dont know wat i did wrong this is what i did:
1. load up the game and cheat txt and choose what to save it as
2. changed the slowmo and enable disable keys
3. did not add ram dump
4. hook into-arm7 embed into- arm7
5. auto patch

And this is with v3.1? Try using the address you used before but patching with the normal method. If it doesn't give you a white screen on boot then it means that the flash cart is ignoring the header.

by 'normal method, do you mean no auto patching?

EDIT: never mind, all this was done with v3.0, i just got 3.1 did everything again and it works perfectly, THANX man and keep going there! i glad theres someone like you :halleluyah:

 

[Fermosi]

Darn it, i still get an error (black screen either with new game or load, with load it comes up as soon as i enter a menu/shop/pub/fight) with FFTA2 using these CODEAll Classes Available
5213bee0 b3c00c02
0213bee0 e3a01000
0213bf14 e3a01000
0213bf60 ea00000b
d2000000 00000000


Press Select for all Weapons, Armor, Accessories, and Items
94000130 FFFB0000
D3000000 0212CCDC
D5000000 63000000
C0000000 000001AF
D6000000 00000000
D4000000 00000001
D2000000 00000000


Max MP (All Characters) (Press Select)
94000130 FFFB0000
C0000000 00000017
0212B158 03E703E7
DC000000 0000011C
D2000000 00000000


Infinite Gil
0212E63C 05F5E0FF


Infinite CP
1212E640 0000270F


Hold L When Choosing Directions To Move Again
0206942C e1c011b2
94000130 fdff0000
0206942c E3A01000
D2000000 00000000

Any clue to get it work? D:
EDIT : using m3 sd slot 2

 

[Syzero]

it said while i was auto patching sonic rush adventure that there was an assembly code error telling me to send trainer.asm and cheat txt. here it is:

ldr r3,numbytes
ldr r2,realtraineraddress
add r1,r15,#0x18
trainercopyloop:
ldr r0,[r1],#0x4
str r0,[r2],#0x4
subs r3,r3,#0x1
bne trainercopyloop
ldr r15,armstart
realtraineraddress: .long 0x23FE000
armstart: .long 0x2380000

trainerstart:
str r0,swap
ldr r0,irqjump0
stmdb r13!,{r0}
ldr r0,swap
b start
str r0,swap
ldr r0,irqjump1
stmdb r13!,{r0}
ldr r0,swap
start:
stmdb r13!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9,r10,r11,r12,r14}
ldr r1,enableflag
ldr r2,enablekey
ldr r3,disablekey
mov r0,#0x4000000
ldr r0,[r0,#0x130]
cmp r0,r2
moveq r1,#0x1
cmp r0,r3
moveq r1,#0x0
str r1,enableflag
cmp r1,#0x0
bne turnedon
ldmia r13!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9,r10,r11,r12,r14}
ldmia r13!,{r15}

turnedon:

ldr r4,slowdownkey
ldr r5,speedupkey
mov r1,#0x4000000
ldr r1,[r1,#+0x130]
ldr r0,slowmolevel
cmp r1,r4
addeq r0,#0x1
cmp r0,#0x1500
movgt r0,#0x1500
cmp r1,r5
subeqs r0,#0x1
movlt r0,#0x0
str r0,slowmolevel
slowmoloop:
mov r1,#0x1
slowmoinnerloop:
subs r1,r1,#0x1
bne slowmoinnerloop
subs r0,r0,#0x1
bcc slowmodone
b slowmoloop
slowmolevel: .long 0x0
slowmodone:
mov r0,#0x0

ldr r1,address0
ldr r1,[r1]
cmp r0,r1
beq label0

mov r0,#0x0

ldr r1,address1
ldr r1,[r1]
cmp r0,r1
beq label0

ldr r5,address-1
ldrh r5,[r5]
ldr r2,lval0
ldr r0,lval1
and r5,r5,r2
cmp r5,r0
bne label0

ldr r0,lval2
mov r2,#0xE8

strh r0,[r1,+r2]


label0:
ldr r5,address2
ldrh r5,[r5]
ldr r2,lval0
ldr r0,lval3
and r5,r5,r2
cmp r5,r0
bne label1

ldr r5,address3
ldrh r5,[r5]
ldr r2,lval0
mov r0,#0x0
and r5,r5,r2
cmp r5,r0
bne label1

ldr r0,lval4

ldr r1,address4
str r0,[r1]


label1:
mov r0,#0x0

ldr r1,address0
ldr r1,[r1]
cmp r0,r1
beq label4

mov r0,#0x0

ldr r1,address1
ldr r1,[r1]
cmp r0,r1
beq label4

ldr r1,address-1
ldr r1,[r1]
mov r2,#0x38
ldrh r6,[r1,+r2]
ldr r5,address5
ldrh r5,[r5]
ldr r2,lval5
mov r0,#0x0
and r5,r5,r2
cmp r5,r0
bne label2

mov r5,#0x20
add r6,r6,r5


label2:
ldr r5,address5
ldrh r5,[r5]
ldr r2,lval6
mov r0,#0x0
and r5,r5,r2
cmp r5,r0
bne label3

ldr r5,lval7
add r6,r6,r5


label3:
mov r2,#0x38
mov r1,#0x0
str r6,[r1,+r2]
add r1,r1,#0x4
mov r2,#0x38
mov r1,#0x0
str r6,[r1,+r2]
add r1,r1,#0x4
mov r2,#0x38
mov r1,#0x0
str r6,[r1,+r2]
add r1,r1,#0x4


label4:

ldmia r13!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9,r10,r11,r12,r14}
ldmia r13!,{r15}

address0: .long 0x2134020
address1: .long 0x2139F9C
address2: .long 0x213A0F0
address3: .long 0x213A0F4
address4: .long 0x218E458
address5: .long 0x4000130
lval0: .long 0xFFFF
lval1: .long 0xFFFA
lval2: .long 0x12C0
lval3: .long 0x201
lval4: .long 0xE0000
lval5: .long 0x204
lval6: .long 0x104
lval7: .long 0xFFFFFFD0
enableflag: .long 0x0
enablekey: .long 0x2FE;@R+A
disablekey: .long 0x2FD;@R+B

slowdownkey: .long 0x27F;@R+DOWN
speedupkey: .long 0x2BF;@R+UP

swap: .long 0x0
irqjump0: .long 0x37FB9D4
irqjump1: .long 0x3806BE0
trainerend:
numbytes: .long (trainerend-trainerstart)/4

cheat txt

Max Boost
62134020 00000000
62139f9c 00000000
b2139f9c 00000000
90000000 0000fffa
100000e8 000012c0
d2000000 00000000

Extra Sea Chart Ink
9213a0f0 00000201
9213a0f4 00000000
0218e458 000e0000
d2000000 00000000

Press SELECT+L to Grow / SELECT+R to Shrink
62134020 00000000
62139f9c 00000000
b2139f9c 00000000
b000001c 00000000
da000000 00000038
94000130 fdfb0000
d4000000 00000020
d0000000 00000000
94000130 fefb0000
d4000000 ffffffd0
d0000000 00000000
d6000000 00000038
d6000000 00000038
d6000000 00000038
d2000000 00000000

 

[cracker]

Updated to 3.2 to add support for multiple pointers such as the SRA codes use and to fix a bug with pointers getting reset.

@Syzero: The codes for SRA use a strange check. Codes with the line "90000000 0000fffa" need to have that line removed in order to work. It makes the cheat function load the value at 0x0 and see if it = 0xfffa and if it doesn't then the cheat gets jumped over. The address check is a very strange one and I don't think the value ever changes except when it is written at boot so it would never = 0xfffa and the code would never work. Just remove the line and the code works fine. Also the size modifying code works fine but the game will reduce the size automatically when you jump or spring into the air. Just a warning in case you think it is a bug.

 

[cracker]

Darn it, i still get an error (black screen either with new game or load, with load it comes up as soon as i enter a menu/shop/pub/fight) with FFTA2 using these

*snip*

Any clue to get it work? D:
EDIT : using m3 sd slot 2

Because you are using the codes for the UK version.

Use the US codes and they should work fine.

 

[Syzero]

oh, ok, thx Cracker!

 

[Fermosi]

Yeah, i know, that's cause i was using the UK vers...
Well, anyway, i can use the US vers too, my mother language isn't on the UK vers...(just multi4 instead of multi5 >.>)

 

[Fermosi]

Thanks for all your support, it just seems like the UK vers didn't like codes...
It's just perfect with the US vers

 

[cory1492]

cracker, is there anything I should be aware of with the .asm file parser? Using 3.3 my code never winds up in the asm, trying this on metroid prime pinball (basically trying to work out simple rumble enable "cheat" patch for 3in1.) I have "hook into" and "embed into" set to both ARM9, but it always says "autopatching trainer at end of arm7.bin" - that normal?

Also, another dumb question that comes up as a result - is there a way to make it so that a given code only runs once (or once per enable/disable) instead of on each interrupt (not that I've gotten it working to find out if it is actually doing that like I suspect it would)? I'll do up my own vars to track this stuff if there isn't a simpler way, though

Hopefully I haven't missed anything completely obvious.

my code

Spoiler

ÂÂÂÂLDRÂÂÂÂ R0, =0x4000204 
ÂÂÂÂMOVÂÂÂÂ R1, #0x6800
ÂÂÂÂSTRHÂÂÂÂR1, [R0]
ÂÂÂÂMOVÂÂÂÂ R0, #0xD200
ÂÂÂÂLDRÂÂÂÂ R3, =0x9FE0000
ÂÂÂÂMOVÂÂÂÂ R1, #0x1500
ÂÂÂÂSTRHÂÂÂÂR0, [R3]
ÂÂÂÂMOVÂÂÂÂ R2, #0x8000000
ÂÂÂÂSUBÂÂÂÂ R3, R3, #0x1FC0000
ÂÂÂÂSTRHÂÂÂÂR1, [R2]
ÂÂÂÂSTRHÂÂÂÂR0, [R3]
ÂÂÂÂADDÂÂÂÂ R2, R2, #0x40000
ÂÂÂÂLDRÂÂÂÂ R3, =0x9E20000
ÂÂÂÂSTRHÂÂÂÂR1, [R2]
ÂÂÂÂMOVÂÂÂÂ R0, #0xF0
ÂÂÂÂMOVÂÂÂÂ R0, R0,LSL#16
ÂÂÂÂMOVÂÂÂÂ R0, R0,LSR#16
ÂÂÂÂADDÂÂÂÂ R2, R2, #0x1F80000
ÂÂÂÂSTRHÂÂÂÂR0, [R3]
ÂÂÂÂSTRHÂÂÂÂR1, [R2] 
ÂÂÂÂMOVÂÂÂÂ R0, #0x0
ÂÂÂÂMOVÂÂÂÂ R2, #0x8000000
ÂÂÂÂSTRÂÂÂÂ R0, [R2]
ÂÂÂÂADDÂÂÂÂ R0, R0, #2
ÂÂÂÂSTRÂÂÂÂ R0, [R2]

the resulting trainer.asm, don't see any trace of my code in there...

Spoiler

ldr r3,numbytes
ldr r2,realtraineraddress
add r1,r15,#0x18
trainercopyloop:
ldr r0,[r1],#0x4
str r0,[r2],#0x4
subs r3,r3,#0x1
bne trainercopyloop
ldr r15,armstart
realtraineraddress: .long 0x23FE000
armstart: .long 0x2000800

trainerstart:
str r0,swap
ldr r0,irqjump0
stmdb r13!,{r0}
ldr r0,swap
start:
stmdb r13!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9,r10,r11,r12,r14}

label0:
ldmia r13!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9,r10,r11,r12,r14}
ldmia r13!,{r15}

swap: .long 0x0
irqjump0: .long 0x1FF8000
trainerend:
numbytes: .long (trainerend-trainerstart)/4

Seems to work OK in 1.3, at least I can tinker with my code till you let me know if 3.x is broke.
edit:/ take that back, didn't work so good in 1.3, whitescreens on arm9 and card insert error/halt on arm7 (which can't write to exmemcnt anyway.) I guess patience will be the virtue then

 

[Frederica Bernkastel]

This is so useful that it calls for...
STICKY!

 

[cracker]

Updated to 3.4.

cracker, is there anything I should be aware of with the .asm file parser? Using 3.3 my code never winds up in the asm, trying this on metroid prime pinball (basically trying to work out simple rumble enable "cheat" patch for 3in1.) I have "hook into" and "embed into" set to both ARM9, but it always says "autopatching trainer at end of arm7.bin" - that normal?

Also, another dumb question that comes up as a result - is there a way to make it so that a given code only runs once (or once per enable/disable) instead of on each interrupt (not that I've gotten it working to find out if it is actually doing that like I suspect it would)? I'll do up my own vars to track this stuff if there isn't a simpler way, though

Hopefully I haven't missed anything completely obvious.

my code

Spoiler

ÂÂÂÂLDRÂÂÂÂ R0, =0x4000204 
ÂÂÂÂMOVÂÂÂÂ R1, #0x6800
ÂÂÂÂSTRHÂÂÂÂR1, [R0]
ÂÂÂÂMOVÂÂÂÂ R0, #0xD200
ÂÂÂÂLDRÂÂÂÂ R3, =0x9FE0000
ÂÂÂÂMOVÂÂÂÂ R1, #0x1500
ÂÂÂÂSTRHÂÂÂÂR0, [R3]
ÂÂÂÂMOVÂÂÂÂ R2, #0x8000000
ÂÂÂÂSUBÂÂÂÂ R3, R3, #0x1FC0000
ÂÂÂÂSTRHÂÂÂÂR1, [R2]
ÂÂÂÂSTRHÂÂÂÂR0, [R3]
ÂÂÂÂADDÂÂÂÂ R2, R2, #0x40000
ÂÂÂÂLDRÂÂÂÂ R3, =0x9E20000
ÂÂÂÂSTRHÂÂÂÂR1, [R2]
ÂÂÂÂMOVÂÂÂÂ R0, #0xF0
ÂÂÂÂMOVÂÂÂÂ R0, R0,LSL#16
ÂÂÂÂMOVÂÂÂÂ R0, R0,LSR#16
ÂÂÂÂADDÂÂÂÂ R2, R2, #0x1F80000
ÂÂÂÂSTRHÂÂÂÂR0, [R3]
ÂÂÂÂSTRHÂÂÂÂR1, [R2] 
ÂÂÂÂMOVÂÂÂÂ R0, #0x0
ÂÂÂÂMOVÂÂÂÂ R2, #0x8000000
ÂÂÂÂSTRÂÂÂÂ R0, [R2]
ÂÂÂÂADDÂÂÂÂ R0, R0, #2
ÂÂÂÂSTRÂÂÂÂ R0, [R2]

the resulting trainer.asm, don't see any trace of my code in there...

Spoiler

ldr r3,numbytes
ldr r2,realtraineraddress
add r1,r15,#0x18
trainercopyloop:
ldr r0,[r1],#0x4
str r0,[r2],#0x4
subs r3,r3,#0x1
bne trainercopyloop
ldr r15,armstart
realtraineraddress: .long 0x23FE000
armstart: .long 0x2000800

trainerstart:
str r0,swap
ldr r0,irqjump0
stmdb r13!,{r0}
ldr r0,swap
start:
stmdb r13!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9,r10,r11,r12,r14}

label0:
ldmia r13!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9,r10,r11,r12,r14}
ldmia r13!,{r15}

swap: .long 0x0
irqjump0: .long 0x1FF8000
trainerend:
numbytes: .long (trainerend-trainerstart)/4

Seems to work OK in 1.3, at least I can tinker with my code till you let me know if 3.x is broke.
edit:/ take that back, didn't work so good in 1.3, whitescreens on arm9 and card insert error/halt on arm7 (which can't write to exmemcnt anyway.) I guess patience will be the virtue then

I accidently broke .asm a while back it seems by inadvertently using a temp variable for the check in between the call to the patching function.

I only half-read what you wrote about the code execution and went off on a different feature that I had been planning on doing for a while and thought was what you were talking about -- executing the function every x cycles. It's not hard at all to do it once:

mov r1,donealready
cmp r1,#0x0
bne endfunc
mov r1,#0x1
str r1,donealready
.

.
b endfunc
donealready: .long 0x0
endfunc:

For what you are looking to do doing it once should be fine enough since I don't think it would be written over again.

QUOTE(Antoligy @ Jul 6 2008, 03:20 PM) This is so useful that it calls for...
[size=36][color=#FF0000]STICKY![/color][/size][/quote]

Glad you like it.  [img]http://gbatemp.net/vanilla/emoticons/yaynds.gif[/img]

 

[cory1492]

Nice one, works well now cracker and thanks yet again. Now I see the explanation in the log as to why it's sticking stuff into arm7 when I tell it to use arm9, too

-as doesn't seem to like

ÂÂÂÂmovÂÂÂÂ r1, donealready

it tells me it wants

ÂÂÂÂmovÂÂÂÂ r1, #donealready

Whats needed to find "safe" locations to patch into arm9? I'm going to review the thread now, see if I missed it last night.

edit:/ argh, moving irq targets? This would be so much simpler if arm7 could set external/mem control registers

the final arm9 using the default memory gives the error "Undefined opcode - with no debug vector defined" or on starfox "bad SWI number" in no$, which I assume is what is crashing it...?

 

[cracker]

Nice one, works well now cracker and thanks yet again. Now I see the explanation in the log as to why it's sticking stuff into arm7 when I tell it to use arm9, too

-as doesn't seem to like

ÂÂÂÂmovÂÂÂÂ r1, donealready

it tells me it wants

ÂÂÂÂmovÂÂÂÂ r1, #donealready

Whats needed to find "safe" locations to patch into arm9? I'm going to review the thread now, see if I missed it last night.

edit:/ argh, moving irq targets? This would be so much simpler if arm7 could set external/mem control registers

the final arm9 using the default memory gives the error "Undefined opcode - with no debug vector defined" or on starfox "bad SWI number" in no$, which I assume is what is crashing it...?

I must have been asleep when I typed that out.

It should be:

ldr r1,donealready

By "patch into" do you mean hook into or embed into?

Usually when I get the bad SWI error it is because the game jumps to where your "handler" should be but it isn't located there and it executes through until it hits the data that looks like an SWI op. If you are using normal patching then you can't write to anything above 0x23bfe00. However, after the game is booted it can safely write to this area.

 

[cory1492]

By "patch into" I mean, using 0xdeadbeef padding and a memory dump absolutely no arm9 locations are given. Any locations I have tried so far have yielded a white screen. Is it possible arm/thumb is the issue (trying to rule out everything)? ATM (heh) I feel like I'm missing something important.

 

[cracker]

By "patch into" I mean, using 0xdeadbeef padding and a memory dump absolutely no arm9 locations are given. Any locations I have tried so far have yielded a white screen. Is it possible arm/thumb is the issue (trying to rule out everything)? ATM (heh) I feel like I'm missing something important.

You picked a bad game to test with I guess. MPP white screens in no$gba (both free and debug) even without patching.

And BTW I don't think IRQs ever use Thumb mode (at least I've never seen it) so it should never be a problem.

 

[Syzero]

i dont know why but when i use the following codes and activate them, the game (PMD2) freezes:

CODEMax/Infinite Money In Bank
0229c128 3b9ac9ff

Agility always active
C0000000 00000004
021ACD50 00080807
DC000000 00000230
D2000000 00000000

Restore HP (Press Y)
9237211c f7ff0800
121acc52 000003e7
d2000000 00000000

Restore Move Points (L+A)
9237211c 00000201
221acd66 00000063
221acd6e 00000063
221acd76 00000063
221acd7e 00000063
d2000000 00000000

Max IQ (Press Y)
9237211c f7ff0800
221acc51 00000004
d2000000 00000000

(Partner) Restore HP (Press Y)
9237211c f7ff0800
121ace82 000003e7
d2000000 00000000

(Partner) Restore Move Points (L+A)
9237211c 00000201
221acf96 00000063
221acf9e 00000063
221acfa6 00000063
221acfae 00000063
d2000000 00000000

(Partner) Max IQ (Press Y)
9237211c f7ff0800
221ace81 00000004
d2000000 00000000

(3rd) Press Up to Restore PP:
94000130 FFBF0000
221AD1C6 00000063
221AD1CE 00000063
221AD1D6 00000063
221AD1DE 00000063
D2000000 00000000

(3rd) max iq (R+X)
9237211c fAff0000
121AD0B0 00007FFF

(4th) Press Up to Restore PP:
94000130 FFBF0000
221AD3F6 00000063
221AD3FE 00000063
221AD406 00000063
221AD40E 00000063
D2000000 00000000

(4th) Max IQ (R+X)
9237211c fAff0000
121AD2E0 00007FFF

Item 10: golden apple (R+A)
9237211c 00000101
2229AF26 00000001
1229AF28 00000001
1229AF2A 00000073

Item 11: pure seed (R+A)
9237211c 00000101
2229AF2C 00000001
1229AF2E 00000001
1229AF30 0000005F

and sometimes when i use boost in sonic rush adventure, the game will freeze during an act/before a boss. i used the following codes:
CODEMax Boost
62134020 00000000
62139f9c 00000000
b2139f9c 00000000
100000e8 000012c0
d2000000 00000000

Extra Sea Chart Ink
9213a0f0 00000201
9213a0f4 00000000
0218e458 000e0000
d2000000 00000000

Press SELECT+L to Grow / SELECT+R to Shrink
62134020 00000000
62139f9c 00000000
b2139f9c 00000000
b000001c 00000000
da000000 00000038
94000130 fdfb0000
d4000000 00000020
d0000000 00000000
94000130 fefb0000
d4000000 ffffffd0
d0000000 00000000
d6000000 00000038
d6000000 00000038
d6000000 00000038
d2000000 00000000

Also, when i remove to 2 item codes,the game won't freeze after i activate them but it will freeze later when im in a dungeon.
CAN SOME ONE HELP!!?

EDIT: i realised that the item and the 2 last iq cheats never actually worked so can someone make those codes work (With the specified trigger)?