Hacking GATEWAY PUBLIC RELEASE 2.6

[supermalloch]

Savegame Cheating might be possible now from SD Cart:

Spoiler

Testobject: Fantasy Life EUR (00001131)

- Use SDK-5.2.2 SaveDataFiler.csu and rename it to .3ds
- Start it the usual way
- Backup your SD Save

A new folder named "filer" was created on your SD Cart.

In my Case the needed files are in SDCARD\filer\ExtData\20141106072547\00001131
(fl_ext0.fsd is the same content as _fl_ext0.fsd)

I searched around for my Characters Name and found it 52 00 75 00 6B 00 69 00 61 R.u.k.i.a

After a try to find ingame Stuff i hit the Jackpot:

Money: 61025 > EE 61
Experience: 75081 > 01 25 49

Currently testing if changing will work or not.

EDIT:

IT WORKED.

I can also confirm that this works. After the edit all I had to do was craft one item (to initiate the level up process) and I was level 37! I also gave myself more money as I only had about 800 Dosh before.

Spoiler

I couldn't get the images properly inserted .. oh well,
Before
After

 

[pLaYeR^^]

I can also confirm that this works. After the edit all I had to do was craft one item (to initiate the level up process) and I was level 37! I also gave myself more money as I only had about 800 Dosh before.

Spoiler

I couldn't get the images properly inserted .. oh well,
Before
After

How you got SaveDataFiler installed? I get an error if i try to install it via devmenu...

 

[supermalloch]

How you got SaveDataFiler installed? I get an error if i try to install it via devmenu...

I never installed it. I just ran it from the gateway card. If you want to install it you need to modify Exheader and recompile it.

Pic of it running

Edit: sorry had the wrong pic. Fixed

 

[mvmiranda]

I can also confirm that this works. After the edit all I had to do was craft one item (to initiate the level up process) and I was level 37! I also gave myself more money as I only had about 800 Dosh before.

Spoiler

I couldn't get the images properly inserted .. oh well,
Before
After

Nice!
What offset have you changed to trigger your leveling?
I had 67 hours of gameplay in the EUR version before the US came out and I have already completed the main story
I just want to go faster to finish the main story again and buy the DLC.

 

[supermalloch]

Nice!
What offset have you changed to trigger your leveling?
I had 67 hours of gameplay in the EUR version before the US came out and I have even completed the main story
I just want to go faster to finish the main story again and buy the DLC.

As liomajor found, the offsets are the same. At least in the EU version.
{Example = vertical offset, horizontal offset range}
Money = 0001FCC0, 0C~0F
EXP = 0001FCC0, 04~07
Just remember that the Values are reversed. So AB 11 EE 61 would be inserted as 61 EE 11 AB, etc...
Also make sure you edit both files that correspond to the save slot.

Edit: For the folks who don't know how to get hex values. Use the windows calculator (set to programmer layout) type in your value in DEC mode, then click HEX and it will give you the hex value of the dec number you entered. I used 1000 (3E8) which I inserted incorrectly as 03E8 (59395, I didn't reverse it so it's read as E803) and it made me level 37 from level 2. I should have inserted it as E803 (remember its reversed so instead of = 59395, it = 1000). I went back and made a new file just to make sure it worked correctly and he had exactly 1000 exp.

 

[Plasmastar510]

GREAT NEWS! I can confirm switching to a 8gb or smaller microSD card successfully loads the devMenu. This fixes the "Card Removed" Error The 3DS Sd size does not effect the issue, though the size used for Gateway's redCard does. json, any idea why this works?

Hi. My Micro SD card is 32gb and DevMenu runs fine. I however did have an issue with Super Smash Bros not loading until I formatted as FAT32, as opposed to exFat.

 

[mvmiranda]

As liomajor found, the offsets are the same. At least in the EU version.
{Example = vertical offset, horizontal offset range}
Money = 0001FCC0, 0C~0F
EXP = 0001FCC0, 04~07
Just remember that the Values are reversed. So AB 11 EE 61 would be inserted as 61 EE 11 AB, etc...
Also make sure you edit both files that correspond to the save slot.

Edit: For the folks who don't know how to get hex values. Use the windows calculator (set to programmer layout) type in your value in DEC mode, then click HEX and it will give you the hex value of the dec number you entered. I used 1000 (3E8) which I inserted incorrectly as 03E8 (59395, I didn't reverse it so it's read as E803) and it made me level 37 from level 2. I should have inserted it as E803 (remember its reversed so instead of = 59395, it = 1000). I went back and made a new file just to make sure it worked correctly and he had exactly 1000 exp.

Awesome!
Last question? What about exp points? Do they also "stack up" of you exp to lvl up?

 

[liomajor]

Got SaveDataFiler now working as .cia

and as an extra, i extracted from pokemon y my save (it saves inside rom).

As you can see, i found my characters name

 

[Habbert]

I believe the savegame is already region-unlocked. That's what I read, anyhow. People were able to use their US games with the EUR saves without having to do anything.

What I am interested in is to transfer Fantasy Life saves from one 3DS to another. Can anyone tell me if this is possible now?

I tried the USA release and my save did not appear... ;(

 

[supermalloch]

Awesome!
Last question? What about exp points? Do they also "stack up" of you exp to lvl up?

I'm not sure what you mean. I just crafted 1 item and gained 4 exp, the game then realized I had 59395 extra exp and just leveled me up until I needed more then what I had. Which for me was lvl 37.

 

[Huntereb]

So SaveDataFiler extracts and decryptes save data? Impressive! I guess I'll go re-install that now...

 

[tjexp]

So SaveDataFiler extracts and decryptes save data? Impressive! I guess I'll go re-install that now...

Wonder if the decrypted save is compatible with PkHex

 

[Huntereb]

Wonder if the decrypted save is compatible with PkHex

I wouldn't be surprised. Let me look into what PK Hex is.

 

[Nurio]

I tried the USA release and my save did not appear... ;(

Are you playing it on the same 3DS or a different 3DS?

 

[tyons]

waitwaitwait. can it be used with retail games? I guess not, but...

 

[Habbert]

Are you playing it on the same 3DS or a different 3DS?

same 3DS

 

[Nic333]

Got SaveDataFiler now working as .cia

and as an extra, i extracted from pokemon y my save (it saves inside rom).

As you can see, i found my characters name

Can you post the RSF?
I can't make it work....

 

[MrFahrenheit39]

Got SaveDataFiler now working as .cia



and as an extra, i extracted from pokemon y my save (it saves inside rom).



As you can see, i found my characters name

Was your save on a Gateway or a retail card?

 

[liomajor]

MrFahrenheit39

It was a .rom i mounted bcuz the game saves inside.

BasicInfo:
  Title                  : "SaveData"
  CompanyCode            : "00"
  ProductCode            : "SaveDataFi"
  ContentType            : Application # Application / SystemUpdate / Manual / Child / Trial
  Logo                    : Nintendo # Nintendo / Licensed / Distributed / iQue / iQueForSystem
 
TitleInfo:
  UniqueId                : 0xff40a
  Category                : Application # Application / SystemApplication / Applet / Firmware / Base / DlpChild / Demo / Contents / SystemContents / SharedContents / AddOnContents / Patch / AutoUpdateContents
 
CardInfo:
  MediaType              : Card1 # Card1 / Card2
 
Option:
  UseOnSD                : true # true if App is to be installed to SD
  EnableCompress          : true # Compresses exefs code
  FreeProductCode        : true # Removes limitations on ProductCode
  EnableCrypt            : false # Enables encryption for NCCH and CIA
  MediaFootPadding        : false # If true CCI files are created with padding
 
ExeFs: # these are the program segments from the ELF, check your elf for the appropriate segment names
  ReadOnly:
  - .rodata
  - RO
  ReadWrite:
  - .data
  - RO
  Text:
  - .init
  - .text
  - STUP_ENTRY
 
PlainRegion: # only used with SDK ELFs
- .module_id
 
AccessControlInfo:
  UseOtherVariationSaveData : false
  ExtSaveDataId: 0xff40a
  SystemSaveDataId1: 0x00000000
  SystemSaveDataId2: 0x00000000
  OtherUserSaveDataId1: 0x00000
  OtherUserSaveDataId2: 0x00000
  OtherUserSaveDataId3: 0x00000
  FileSystemAccess:
  - CategorySystemApplication
  - CategoryFileSystemTool
  - Debug
  #- TwlCardBackup
  #- TwlNandData
  #- Boss
  - DirectSdmc
  - SaveDataMove
 
  IdealProcessor                : 0
  AffinityMask                  : 1
  Priority                      : 16
 
  MaxCpu                        : 0x9E # Default
 
  DisableDebug                  : true
  EnableForceDebug              : false
  CanWriteSharedPage            : false
  CanUsePrivilegedPriority      : false
  CanUseNonAlphabetAndNumber    : false
  PermitMainFunctionArgument    : false
  CanShareDeviceMemory          : false
  RunnableOnSleep              : false
  SpecialMemoryArrange          : false
 
  CoreVersion                  : 2
  DescVersion                  : 2
 
  ReleaseKernelMajor            : "02"
  ReleaseKernelMinor            : "33"
  MemoryType                    : Application # Application / System / Base
  HandleTableSize: 512
  IORegisterMapping:
  - 1ff50000-1ff57fff
  - 1ff70000-1ff77fff
  MemoryMapping:
  - 1f000000-1f5fffff:r
  SystemCallAccess:
    ArbitrateAddress: 34
    Break: 60
    CancelTimer: 28
    ClearEvent: 25
    ClearTimer: 29
    CloseHandle: 35
    ConnectToPort: 45
    ControlMemory: 1
    CreateAddressArbiter: 33
    CreateEvent: 23
    CreateMemoryBlock: 30
    CreateMutex: 19
    CreateSemaphore: 21
    CreateThread: 8
    CreateTimer: 26
    DuplicateHandle: 39
    ExitProcess: 3
    ExitThread: 9
    GetCurrentProcessorNumber: 17
    GetHandleInfo: 41
    GetProcessId: 53
    GetProcessIdOfThread: 54
    GetProcessIdealProcessor: 6
    GetProcessInfo: 43
    GetResourceLimit: 56
    GetResourceLimitCurrentValues: 58
    GetResourceLimitLimitValues: 57
    GetSystemInfo: 42
    GetSystemTick: 40
    GetThreadContext: 59
    GetThreadId: 55
    GetThreadIdealProcessor: 15
    GetThreadInfo: 44
    GetThreadPriority: 11
    MapMemoryBlock: 31
    OutputDebugString: 61
    QueryMemory: 2
    ReleaseMutex: 20
    ReleaseSemaphore: 22
    SendSyncRequest1: 46
    SendSyncRequest2: 47
    SendSyncRequest3: 48
    SendSyncRequest4: 49
    SendSyncRequest: 50
    SetThreadPriority: 12
    SetTimer: 27
    SignalEvent: 24
    SleepThread: 10
    UnmapMemoryBlock: 32
    WaitSynchronization1: 36
    WaitSynchronizationN: 37
  InterruptNumbers:
  ServiceAccessControl:
  - APT:U
  - $hioFIO
  - $hostio0
  - $hostio1
  - ac:u
  - boss:U
  - cam:u
  - cecd:u
  - cfg:u
  - dlp:FKCL
  - dlp:SRVR
  - dsp::DSP
  - frd:u
  - fs:USER
  - gsp::Gpu
  - hid:USER
  - http:C
  - mic:u
  - ndm:u
  - news:u
  - nwm::UDS
  - ptm:u
  - pxi:dev
  - soc:U
  - ssl:C
  - y2r:u
  - ldr:ro
  - am:app
  - am:u
  - pm:app
  - ns:s
 
SystemControlInfo:
  SaveDataSize: 512KB
  RemasterVersion: 5
  StackSize: 0x40000
  #JumpId: 0
  Dependency:
    ac: 0x0004013000002402L
    am: 0x0004013000001502L
    boss: 0x0004013000003402L
    camera: 0x0004013000001602L
    cecd: 0x0004013000002602L
    cfg: 0x0004013000001702L
    codec: 0x0004013000001802L
    csnd: 0x0004013000002702L
    dlp: 0x0004013000002802L
    dsp: 0x0004013000001a02L
    friends: 0x0004013000003202L
    gpio: 0x0004013000001b02L
    gsp: 0x0004013000001c02L
    hid: 0x0004013000001d02L
    http: 0x0004013000002902L
    i2c: 0x0004013000001e02L
    ir: 0x0004013000003302L
    mcu: 0x0004013000001f02L
    mic: 0x0004013000002002L
    ndm: 0x0004013000002b02L
    news: 0x0004013000003502L
    nim: 0x0004013000002c02L
    nwm: 0x0004013000002d02L
    pdn: 0x0004013000002102L
    ps: 0x0004013000003102L
    ptm: 0x0004013000002202L
    ro: 0x0004013000003702L
    socket: 0x0004013000002e02L
    spi: 0x0004013000002302L
    ssl: 0x0004013000002f02L

ctrtool --exheader=exheader.bin --exefs=exefs.bin --logo=logo.bin SaveDataFiler.3ds
ctrtool -t exefs --exefsdir=exefs exefs.bin --decompresscode
ctrtool -t exheader exheader.bin > exheader.txt

Makerom 0.13

makerom -f cia -rsf SaveDataFiler.rsf -target t -o SaveDataFiler.cia -icon icon.bin -banner banner.bin -exefslogo -code code.bin -exheader exheader.bin

 

[Lord M]

So now gateway user can edit own save?