Here is a tutorial using some recently added features of Breeze and pointersearcher se.
The game NieR:Automata The End of YoRHa Edition 1.0.2 TID: 0100B8E016F76000 BID: 992787E2B5425994 is used in the example
This tutorial only covers the easy hack and not every game has easy hack.
This is the hack state after some some minutes of hacking ( the time taken did not cover the game playing time, this is a good game to use as an example also because it does not put too much demand on wasting time running here and there in game )
Search for HP. (about 5 mins)
The first boss is a good candidate to search for HP. Since it has a substantial health bar which gives you time to do multiple search.
What I usually do is start with float. I go to search manager and activate the moon jump preset ( it's a good starting point for most search for float not just moon jump ). Set the auto start and auto continue to 1 for faster actions. Do a first search using this setup by press X.
Hit the boss and see the health bar reduce. This game is very nice in that it shows you how much you have reduced the HP. So take note of the number and do a --val (press ZL+Left "Less cycle" until you get this) search of the quantity of hurt you have inflicted on the Boss. After just a few search nothing was found. So the reasonable assumption is HP is not in float. Next we try u32. By observation we can tell the HP is a fairly large number in the thousands. Do a range search that we can reasonably think covers what the HP might be, for example we assume the HP is between 500 and 50000. Using u32 [A..B] we start a first search on the boss HP again. This time we end up with a few candidates that looks promising. Next step is to hack the number. Discover the candidate that reduce the Boss's HP. At this point you can instant kill the Boss ( don't kill it, you need it alive ) but you want to check by hitting the Boss and see the changed bar reduce ( general principal always check that what you get is the real value and not just the display value, though in this case they are the same ). Now you have found the Boss HP memory address and ready to proceed to the next step.
Find the code that access HP ( about 1 min )
Use a debugger that supports GDB and set a break point on the boss HP found above. Here you can use pointer searcher se to help transfer data between Switch and the PC. First add the Boss HP to bookmark (press + on the candidate), then on pointer searcher se fetch the bookmark. Drag and drop the address from the bookmark fetched to one of the target address box, click on the drop value and do a copy (so you can paste it later). Click on "detach dmnt" (lower left side of the screen). Launch your debugger and attach to the game, set a break point on what you have on the clip board. Go hack and play the game until the hit point is hit. You want both read and write to the boss HP. Copy the address of the code back to pointer searcher se and add a label next to these address. Click on the check mark to select what you have just added and click "upload bookmark with label" to upload this to switch.
Do the above two steps for Hero HP and you will have what I have in the below screen. The address of code that access the HP of hero and enemy.
This game is nice again in that the code that access enemy HP and hero HP is not the same making it much easier. This game is nice again in that the code that access this boss hp that we found above also seems to work on most enemy ( I don't know if it works on all as I am not that far along playing the game)
Making code (about 10 mins)
Import bookmark uploaded by pointer searcher se (ZL+"+"). "Bookmark to Cheat" (ZL+Y) to add these as cheats for the next step.
Goto cheats and edit cheat on "read en hp"
at this code x0+0x860 has the address of the Boss HP found in step one above but we don't know what else this code access yet
So we "Add utility codes" on this code. This will produce three codes for you. "Activate read en hp" is the code that inject a code on the game at this code address [main+2F41A8]. This code will save what is x0+0x860 and the content pointed by this pointer in a buffer for us to examine. Depending on the game code this buffer will need to be clear from time to time to make room and to clear what is no longer relevant. "Pointer to buffer .." is pointing to the buffer, add this to bookmark to access the buffer.
"Add utility codes" requires a file to be copied to the game directory created by Breeze when you save cheat to file. The directory will be shown on screen as shown below, and you copy asm1.txt from breeze directory there before you can use the "Add utility codes" successfully. "asm1.txt" can be customized for each game, therefore it is fetch from the game directory instead of breeze directory.
Play the game a bit and see what is in the buffer. Goto the bookmark you have just added and click on the rstick. The cursor is pointed on the first entry. The format is pointer followed by value. Look around and have a feel of what this code access. Look at the number 1142, that match the hero hit point and it probably is (needs to be verified). To hack value you have to follow the pointer by pressing ZL+Y. The other one is for show only and may not be the current value even as many code access memory not just the one we hacked. After playing around a bit this code location seems to be not so useful (for now).
Next we try the others. Same drill.
Enemy HP write and Hero HP write turns out to be good ones. ( Read code is normally executed more frequently and if everything else being equal read is then better )
Now we proceed to create hack.
Look around the code above the write with Breeze. Right click on the bookmark and move the cursor up a bit then ZL+X to look at the disassembly.
In this case a very promising sign to see a subtract on the register that is subsequently written to the enemy hp address
If we amplify the amount subtracted by a lsl you can have various power of 2 amplification. In this case a 2^6 amplification is applied to the damage to enemy. Test it a bit and verify that it works then add this address to bookmark then to cheat code.
(go back to memory explorer, put cursor on the address, press +, go to bookmark then add the bookmark to cheat)
For hero we found the same thing but we want the damage to be zero so we change w22 to #0
Thanks for reading
The game NieR:Automata The End of YoRHa Edition 1.0.2 TID: 0100B8E016F76000 BID: 992787E2B5425994 is used in the example
This tutorial only covers the easy hack and not every game has easy hack.
This is the hack state after some some minutes of hacking ( the time taken did not cover the game playing time, this is a good game to use as an example also because it does not put too much demand on wasting time running here and there in game )
Search for HP. (about 5 mins)
The first boss is a good candidate to search for HP. Since it has a substantial health bar which gives you time to do multiple search.
What I usually do is start with float. I go to search manager and activate the moon jump preset ( it's a good starting point for most search for float not just moon jump ). Set the auto start and auto continue to 1 for faster actions. Do a first search using this setup by press X.
Hit the boss and see the health bar reduce. This game is very nice in that it shows you how much you have reduced the HP. So take note of the number and do a --val (press ZL+Left "Less cycle" until you get this) search of the quantity of hurt you have inflicted on the Boss. After just a few search nothing was found. So the reasonable assumption is HP is not in float. Next we try u32. By observation we can tell the HP is a fairly large number in the thousands. Do a range search that we can reasonably think covers what the HP might be, for example we assume the HP is between 500 and 50000. Using u32 [A..B] we start a first search on the boss HP again. This time we end up with a few candidates that looks promising. Next step is to hack the number. Discover the candidate that reduce the Boss's HP. At this point you can instant kill the Boss ( don't kill it, you need it alive ) but you want to check by hitting the Boss and see the changed bar reduce ( general principal always check that what you get is the real value and not just the display value, though in this case they are the same ). Now you have found the Boss HP memory address and ready to proceed to the next step.
Find the code that access HP ( about 1 min )
Use a debugger that supports GDB and set a break point on the boss HP found above. Here you can use pointer searcher se to help transfer data between Switch and the PC. First add the Boss HP to bookmark (press + on the candidate), then on pointer searcher se fetch the bookmark. Drag and drop the address from the bookmark fetched to one of the target address box, click on the drop value and do a copy (so you can paste it later). Click on "detach dmnt" (lower left side of the screen). Launch your debugger and attach to the game, set a break point on what you have on the clip board. Go hack and play the game until the hit point is hit. You want both read and write to the boss HP. Copy the address of the code back to pointer searcher se and add a label next to these address. Click on the check mark to select what you have just added and click "upload bookmark with label" to upload this to switch.
Do the above two steps for Hero HP and you will have what I have in the below screen. The address of code that access the HP of hero and enemy.
This game is nice again in that the code that access enemy HP and hero HP is not the same making it much easier. This game is nice again in that the code that access this boss hp that we found above also seems to work on most enemy ( I don't know if it works on all as I am not that far along playing the game)
Making code (about 10 mins)
Import bookmark uploaded by pointer searcher se (ZL+"+"). "Bookmark to Cheat" (ZL+Y) to add these as cheats for the next step.
Goto cheats and edit cheat on "read en hp"
at this code x0+0x860 has the address of the Boss HP found in step one above but we don't know what else this code access yet
So we "Add utility codes" on this code. This will produce three codes for you. "Activate read en hp" is the code that inject a code on the game at this code address [main+2F41A8]. This code will save what is x0+0x860 and the content pointed by this pointer in a buffer for us to examine. Depending on the game code this buffer will need to be clear from time to time to make room and to clear what is no longer relevant. "Pointer to buffer .." is pointing to the buffer, add this to bookmark to access the buffer.
"Add utility codes" requires a file to be copied to the game directory created by Breeze when you save cheat to file. The directory will be shown on screen as shown below, and you copy asm1.txt from breeze directory there before you can use the "Add utility codes" successfully. "asm1.txt" can be customized for each game, therefore it is fetch from the game directory instead of breeze directory.
Play the game a bit and see what is in the buffer. Goto the bookmark you have just added and click on the rstick. The cursor is pointed on the first entry. The format is pointer followed by value. Look around and have a feel of what this code access. Look at the number 1142, that match the hero hit point and it probably is (needs to be verified). To hack value you have to follow the pointer by pressing ZL+Y. The other one is for show only and may not be the current value even as many code access memory not just the one we hacked. After playing around a bit this code location seems to be not so useful (for now).
Next we try the others. Same drill.
Enemy HP write and Hero HP write turns out to be good ones. ( Read code is normally executed more frequently and if everything else being equal read is then better )
Now we proceed to create hack.
Look around the code above the write with Breeze. Right click on the bookmark and move the cursor up a bit then ZL+X to look at the disassembly.
In this case a very promising sign to see a subtract on the register that is subsequently written to the enemy hp address
If we amplify the amount subtracted by a lsl you can have various power of 2 amplification. In this case a 2^6 amplification is applied to the damage to enemy. Test it a bit and verify that it works then add this address to bookmark then to cheat code.
(go back to memory explorer, put cursor on the address, press +, go to bookmark then add the bookmark to cheat)
For hero we found the same thing but we want the damage to be zero so we change w22 to #0
Thanks for reading
Attachments
Last edited by TomSwitch,