ROM Hack How to find pointers on NTR Debugger memory dumps? (NTR CFW)

[Nanquitas]

No, I meant the plugin's code
Well the code below should work so maybe there's an error somewhere else in the code.

 

[omegapirate]

There you go.

I'm really not sure what I'm doing wrong though xD

EDIT: Perhaps, maybe the "static pointer" is not really static? I will check that as well though.

 

[Nanquitas]

Hmmm, your code seems right.

Probably the base pointer is not the right one.
I wrote a little function to change a menu entry with the value we read at a specific address (untested).

void printReadValue(u32 addr, u32 pos)
{
    char *buffer;
    char buf[9];

    pos = gamePluginMenu.offsetInBuffer[pos];
    buffer = &gamePluginMenu.buf[pos];
    while (*buffer != 'x' && *(buffer - 1) != '0' && *buffer != '\0')
        buffer++;
    if (*buffer == '\0')
        return;
    if (*buffer == 'x')
        buffer++;
    memset(buf, '\0', 9);
    xsprintf(buf, "%08X", READU32(addr));
    strcpy(buffer, buf);
}

// init
void initCheatMenu() {
    initMenu();
    addCheatMenuEntry("ATK monst 2");
    addCheatMenuEntry("ATK monst LEADER");
    addCheatMenuEntry("ATK monst 3");
    addCheatMenuEntry("ATK monst 4");
    addCheatMenuEntry("ATK monst 5");
    addCheatMenuEntry("ATK monst 6");
    addCheatMenuEntry("READU32 = 0x00000000");  
    updateMenu();
}

And in your gamePluginEntry function, put this in the while loop:

printReadValue(0x145EAEB0, 6);

If it's correctly working, it should change the entry in the menu with the value stocked at the address you provided. This way you should be able to confirm if it's a pointer or not easily.

 

[omegapirate]

Hmmm, your code seems right.

Probably the base pointer is not the right one.
I wrote a little function to change a menu entry with the value we read at a specific address (untested).

void printReadValue(u32 addr, u32 pos)
{
    char *buffer;
    char buf[9];

    pos = gamePluginMenu.offsetInBuffer[pos];
    buffer = &gamePluginMenu.buf[pos];
    while (*buffer != 'x' && *(buffer - 1) != '0' && *buffer != '\0')
        buffer++;
    if (*buffer == '\0')
        return;
    if (*buffer == 'x')
        buffer++;
    memset(buf, '\0', 9);
    xsprintf(buf, "%08X", READU32(addr));
    strcpy(buffer, buf);
}

// init
void initCheatMenu() {
    initMenu();
    addCheatMenuEntry("ATK monst 2");
    addCheatMenuEntry("ATK monst LEADER");
    addCheatMenuEntry("ATK monst 3");
    addCheatMenuEntry("ATK monst 4");
    addCheatMenuEntry("ATK monst 5");
    addCheatMenuEntry("ATK monst 6");
    addCheatMenuEntry("READU32 = 0x00000000");
    updateMenu();
}

And in your gamePluginEntry function, put this in the while loop:

printReadValue(0x145EAEB0, 6);

If it's correctly working, it should change the entry in the menu with the value stocked at the address you provided. This way you should be able to confirm if it's a pointer or not easily.

Yea I tested your code and it correctly showed an address, the only problem is that it seems that the pointer address I found is, unfortunately, dynamic which means I will have to go and search for multi-level pointers to truly find a static pointer which I can read and change at will.

One thing I want to try with this code is if I can set it so that it can read live the value I'm searching for. Say, I want to search for coins I have on a live basis and i think i should see the coin value in hex in the ntr menu.

I will also probably buy IDA Pro and learn ASM to learn how to get deeper pointers. I believe I will be successful but it will certainly take time.

I will update if I can get the ntr menu to show the value of some item in game live.

EDIT: Ok so I tried the code with starfox 64 with a code I discovered for the B-bombs and it successfully showed how many bombs I had live. Dropping bombs and getting more changed the value and in the menu the change appeared.

This means that the pointer I found for the other game is wrong, which means I will have to search for deeper pointers to find one that is truly static.

I will keep updating with my findings and how I will search for deeper pointers.

Obviously any help is appreciated and will be credited in the tut (thanks to @Nanquitas though)

 

[Nanquitas]

If you have the address where the coins are stocked, yes you can show it in the menu by changing the plugin's menu buffer.

Also, you can code a function to search through the ram to find a value or address.
Actually i made this, so as you can see, we can show and navigate through the memory.
Now aside from showing, you can also analyze it to find what you're searching for.

Actually it's, I believe, just like the Gateway's cheat menu act. It dump the ram then analyze it. You can do it too with a plugin, but you have to code it.

 

[omegapirate]

If you have the address where the coins are stocked, yes you can show it in the menu by changing the plugin's menu buffer.

Also, you can code a function to search through the ram to find a value or address.
Actually i made this, so as you can see, we can show and navigate through the memory.
Now aside from showing, you can also analyze it to find what you're searching for.

Actually it's, I believe, just like the Gateway's cheat menu act. It dump the ram then analyze it. You can do it too with a plugin, but you have to code it.

Yea that's what i did with starfox 64 3d and it seems to work live!

For example:

Here's the game with 3 b-bombs: http://screencast.com/t/mvI0rwAX
Then I dropped one and got 2 b-bombs: http://screencast.com/t/0OL922oPo

I believe your code is really useful to see how an address behaves live.

The biggest problem here is finding the multi level pointers xD

Wish they were all static without being dynamic xD

 

[Nanquitas]

You have a gateway, so you should just do ram dumps then use the soft for searching pointers. When you have the first one, search for pointer to pointers until you have no results. That should work no ?

 

[omegapirate]

You have a gateway, so you should just do ram dumps then use the soft for searching pointers. When you have the first one, search for pointer to pointers until you have no results. That should work no ?

Interesting.

Would you mind explaining your process?

This is what I'm thinking of doing:

First, before learning ASM and/or buying IDA Pro, I want to use gateway card to find pointers from ram dumps from several boot ups so that the pointers change.

Then I will use either Cheat Engine or some manual searching for pointers until I have some that I can use.

Then there will be the multi level pointer search which I will try to use CE for this or do this manually or start learning ASM and get IDA Pro to find them.

Not sure how I can find the pointer to pointer address with gateway though. Maybe I'm missing something?

 

[Nanquitas]

I don't own a gateway so i'll be a bit helpless in this domain. :/

But, on maxconsole forums, i read a tuto on how to find pointer with a dump made by a gateway. It's not working with ntr, but seems like the soft is clearly made to find pointers.
Try to find this one, and you should be able to find the pointers.

 

[omegapirate]

I don't own a gateway so i'll be a bit helpless in this domain. :/

But, on maxconsole forums, i read a tuto on how to find pointer with a dump made by a gateway. It's not working with ntr, but seems like the soft is clearly made to find pointers.
Try to find this one, and you should be able to find the pointers.

Yea i think thats the one im using xD

"Finding Pointer Codes With Gateway RAM Dump"

 

[Nanquitas]

Yes, it's the one. x)

It's not working ?

 

[omegapirate]

Yes, it's the one. x)

It's not working ?

Yea it seems to work but I found there are tons of more pointers than I think I will be able to find xD

 

[Nanquitas]

You just have to make more dump, and compare the list. Then take one whose the same on all the dumps.

 

[omegapirate]

You just have to make more dump, and compare the list. Then take one whose the same on all the dumps.

OK so I think I found a real static base pointer as I can't seem to find any address that points to this one and so far I think I'm making progress.

The base pointer I found: 0x1495A608
That base pointer points to: 0x148EB857
Then that pointer points to: 0xF1635A22

Those addresses seem to be static as I opened the NTR menu (where the address are displayed thanks to @Nanquitas code) after changing course, booting and restarting game several times so I think I found something here.

Now, here's the problem.

I really don't think that 0xF1635A22 is a valid address at all but I will give it a shot and see if for some reason I can actually read that address xD. I'll update in a few minutes.

Edit: Tried with reading 0xF1635A22 but obv the 3ds crashed xD. Perhaps I need to find another pointer?

 

[Nanquitas]

An other pointer or maybe your not supposed to read the value from the second pointer but from the second + offset ?

 

[omegapirate]

An other pointer or maybe your not supposed to read the value from the second pointer but from the second + offset ?

lol offsets seem a whole world for me. Maybe this is a little bit too much, but where can I read about offsets with pointers?

It's like the first time I read about that so I'm doing some googling while I hopefully get an answer xD

 

[omegapirate]

Success! So I learned about offsets and I was able to make it work finally!

The main problems I had were that I really didn't remember much about C, pointers and the offsets.

I had to learn about them and how they are applied and yea basically make it happen!

I can make a tutorial if anybody gets interested

Thanks @Nanquitas for your awesome help!

 

[TamDanny]

Success! So I learned about offsets and I was able to make it work finally!

The main problems I had were that I really didn't remember much about C, pointers and the offsets.

I had to learn about them and how they are applied and yea basically make it happen!

I can make a tutorial if anybody gets interested

Thanks @Nanquitas for your awesome help!

I, for one, would really love a tutorial on finding pointers and offsets. I'm also trying to use the NTR Debugger, but I sometimes bump into some dead ends. A tutorial would be incredibly useful.

 

[omegapirate]

I, for one, would really love a tutorial on finding pointers and offsets. I'm also trying to use the NTR Debugger, but I sometimes bump into some dead ends. A tutorial would be incredibly useful.

It's really simple once you go through hell and learn everything in 1 day hehe but yea, absolutely, I will make a tutorial then.

It will take me a few days or so to get my ideas right but I will try to do it xD

 

[TamDanny]

It's really simple once you go through hell and learn everything in 1 day hehe but yea, absolutely, I will make a tutorial then.

It will take me a few days or so to get my ideas right but I will try to do it xD

Thanks, I appreciate it!
I've been learning to use the debugger for a bit now, and so far I can do some basic stuff; like change the number of coins currently obtained (or in my case, number of stars in Kirby Triple Deluxe); but some things I can't really change for whatever reason. For example, I wanted to edit the percentage damage in Smash (a float value, I believe) or the state of having the Final Smash (probably a boolean). Even after finding the address, editing it does nothing at all. After reading through this, I guess it's because of those dynamic pointers, so learning how to deal with those pesky pointers and multi-level pointers would be a huge help to me, as well as any others who's trying this out.