Hacking Infolib.dat coeing any thoughts ?

drwhojan · Sep 25, 2010

Link hear

http://gbatemp.net/t256729-help-for-workin...t&p=3153204

Any thought's are idears welcome ??

drwhojan · Sep 25, 2010

(Note) No B/S hear , Exsample use pong and retro updates , No this is all about finding out infolib.dat coding manuly!

Now i do know that the code extracted with a code genrator is from the ARM9 and ARM7 in ram or a rom

Hear is what i can find out so far

infolib.dat structure

CODENote infolib.dat structure

PATCH[0] : 00 00 00 00 ... reserve
PATCH[1] : 00 00 00 00 ... reserve
PATCH[2] : XX XX 00 00 ... [ARM7 RAM offset] Patch_A
PATCH[3] : 00 00 00 00 ... reserve

PATCH[4] : 00 00 00 00 ... resreve
PATCH[5] : 00 00 00 00 ... reserve
PATCH[6] : XX XX 00 00 ... [ARM7 RAM offset] Patch_B (function1:MemoryRead)
PATCH[7] : XX XX 00 00 ... [ARM7 RAM offset] Patch_B (function2:MemoryWrite)

PATCH[8] : XX XX 00 00 ... [ARM7 RAM offset] Patch_B (function2:MemoryWrite)
PATCH[9] : XX XX 00 00 ... [ARM7 RAM offset] Patch_B (function3:WaitDelay)
PATCH[10] : 00 00 00 00 ... [ARM7 RAM offset] Patch_B (function4:MemoryWrite256)
PATCH[11] : XX XX 00 00 ... [ARM7 RAM offset] Patch_B (function5:MemoryWrite64K)

PATCH[12] : 00 00 00 00 ... [ARM7 RAM offset] Patch_B (function6:MemoryWrite512K)
PATCH[13] : XX XX 00 00 ... [ARM7 RAM offset] Patch_B (function7:CardCommand)
PATCH[14] : XX XX xx 00 ... [ARM9 RAM offset] Patch_B (function7:CardCommand)
PATCH[15] : XX XX XX 00 ... [ARM9 RAM offset] Patch_B (function8:CardInitialize)

PATCH[16] : XX XX 00 00 ... [ARM9 RAM offset] Patch_A
PATCH[17] : FF FF FF FF ... [ARM9 RAM offset] Patch_C (functuon7:CardCommand)
PATCH[18] : XX XX xx 00 ... [ARM9 RAM offset] Patch_D (DMA patch)
PATCH[19] : FF FF FF FF ... [ARM9 RAM offset] Patch_E

PATCH[20] : XX XX 00 00 ... [ARM9 RAM offset] Branch Address (Cheat & Reset)
PATCH[21] : XX XX XX 00 ... [ARM7 Execute RAM offset] Branch Address (Cheat & Reset)
PATCH[22] : FF FF FF FF ... reserve
PATCH[23] : FF FF FF FF ... reserve

infolib.dat is, ARM7, ARM9 offset addresses are recorded to be deployed patch program memory.

· ARM9: If the compression code, and the offset address after deployment.
· ARM7: offset address of the memory to be deployed early.
However, offset RAM Execute ARM7 is, ARM7 ?'re confusing offset address that contains the executable code
* These values, even if, ARM code, if odd, THUMB code is embedded.
(Odd case, the embedded address bit0 to 0 respectively)

Embed code, there are four patterns. For convenience, Patch_A, Patch_B, Patch_C, Patch_D call.

Patch_A will only return
Patch_B Patch_C and memory, the patch is deployed 0x023FE000 call each feature of the program.
The Patch_D, DMA code when processing embedded
Patch_E is Animal Crossing? Embed code
PATCH [20], PATCH [21] is, Cheat & Reset to store the memory address of the jump process.

(1) PATCH [2]: Patch_A
If your code · ARM
* (ARM7_RAM_ADDRESS + PATCH [2]) = E12FFF1E bx r14

If your code · THUMB
* (ARM7_RAM_ADDRESS + PATCH [2]) = 4770

(2) PATCH [6]: Patch_B (function1)
If your code · ARM
* (ARM7_RAM_ADDRESS + PATCH [6] +0) = E59F3000 ldr r3, [r15]
* (ARM7_RAM_ADDRESS + PATCH [6] +4) = E12FFF13 bx r3
* (ARM7_RAM_ADDRESS + PATCH [6] +8) = 023FE001

If your code · THUMB
* (ARM7_RAM_ADDRESS + PATCH [6] +0) = 4B00
* (ARM7_RAM_ADDRESS + PATCH [6] +2) = 470C
* (ARM7_RAM_ADDRESS + PATCH [6] +4) = E001
* (ARM7_RAM_ADDRESS + PATCH [6] +6) = 023F

u32 MemoryRead (u32 chip_address, (u8 *) read_buffer, u32 read_size)
entry
r0 = chip_address
r1 = * read_buffer
r2 = read_size

return
r0 = 0

(3) PATCH [7]: Patch_B (function2)
If your code · ARM
* (ARM7_RAM_ADDRESS + PATCH [7] +0) = E59F3000 ldr r3, [r15]
* (ARM7_RAM_ADDRESS + PATCH [7] +4) = E12FFF13 bx r3
* (ARM7_RAM_ADDRESS + PATCH [7] +8) = 023FE00B

If your code · THUMB
* (ARM7_RAM_ADDRESS + PATCH [7] +0) = 4B00
* (ARM7_RAM_ADDRESS + PATCH [7] +2) = 470C
* (ARM7_RAM_ADDRESS + PATCH [7] +4) = E00B
* (ARM7_RAM_ADDRESS + PATCH [7] +6) = 023F

void MemoryWrite (u32 chip_address, (u8 *) write_buffer, u32 write_size)
entry
r0 = chip_address
r1 = * write_buffer
r2 = write_size

(4) PATCH [8]: Patch_B (function2)
If your code · ARM
* (ARM7_RAM_ADDRESS + PATCH [8] +0) = E59F3000 ldr r3, [r15]
* (ARM7_RAM_ADDRESS + PATCH [8] +4) = E12FFF13 bx r3
* (ARM7_RAM_ADDRESS + PATCH [8] +8) = 023FE00B

If your code · THUMB
* (ARM7_RAM_ADDRESS + PATCH [8] +0) = 4B00
* (ARM7_RAM_ADDRESS + PATCH [8] +2) = 470C
* (ARM7_RAM_ADDRESS + PATCH [8] +4) = E00B
* (ARM7_RAM_ADDRESS + PATCH [8] +6) = 023F

void MemoryWrite (u32 chip_address, (u8 *) write_buffer, u32 write_size)
entry
r0 = chip_address
r1 = * write_buffer
r2 = write_size

(5) PATCH [9]: Patch_B (function3)
If your code · ARM
* (ARM7_RAM_ADDRESS + PATCH [9] +0) = E59F3000 ldr r3, [r15]
* (ARM7_RAM_ADDRESS + PATCH [9] +4) = E12FFF13 bx r3
* (ARM7_RAM_ADDRESS + PATCH [9] +8) = 023FE015

If your code · THUMB
* (ARM7_RAM_ADDRESS + PATCH [9] +0) = 4B00
* (ARM7_RAM_ADDRESS + PATCH [9] +2) = 470C
* (ARM7_RAM_ADDRESS + PATCH [9] +4) = E015
* (ARM7_RAM_ADDRESS + PATCH [9] +6) = 023F

void WaitDelay (void)

(6) PATCH [10]: Patch_B (function4)
If your code · ARM
* (ARM7_RAM_ADDRESS + PATCH [10] +0) = E59F2000 ldr r2, [r15]
* (ARM7_RAM_ADDRESS + PATCH [10] +4) = E12FFF12 bx r2
* (ARM7_RAM_ADDRESS + PATCH [10] +8) = 023FE01F

If your code · THUMB
* (ARM7_RAM_ADDRESS + PATCH [10] +0) = 4A00
* (ARM7_RAM_ADDRESS + PATCH [10] +2) = 4708
* (ARM7_RAM_ADDRESS + PATCH [10] +4) = E01F
* (ARM7_RAM_ADDRESS + PATCH [10] +6) = 023F

void MemoryWrite256 (u32 chip_address)
entry
r0 = chip_address

(7) PATCH [11]: Patch_B (function5)
If your code · ARM
* (ARM7_RAM_ADDRESS + PATCH [11] +0) = E59F2000 ldr r2, [r15]
* (ARM7_RAM_ADDRESS + PATCH [11] +4) = E12FFF12 bx r2
* (ARM7_RAM_ADDRESS + PATCH [11] +8) = 023FE029

If your code · THUMB
* (ARM7_RAM_ADDRESS + PATCH [11] +0) = 4A00
* (ARM7_RAM_ADDRESS + PATCH [11] +2) = 4708
* (ARM7_RAM_ADDRESS + PATCH [11] +4) = E029
* (ARM7_RAM_ADDRESS + PATCH [11] +6) = 023F

void MemoryWrite64K (u32 chip_address)
entry
r0 = chip_address

(8) PATCH [12]: Patch_B (function6)
If your code · ARM
* (ARM7_RAM_ADDRESS + PATCH [12] +0) = E59F1000 ldr r1, [r15]
* (ARM7_RAM_ADDRESS + PATCH [12] +4) = E12FFF11 bx r1
* (ARM7_RAM_ADDRESS + PATCH [12] +8) = 023FE033

If your code · THUMB
* (ARM7_RAM_ADDRESS + PATCH [12] +0) = 4900
* (ARM7_RAM_ADDRESS + PATCH [12] +2) = 4704
* (ARM7_RAM_ADDRESS + PATCH [12] +4) = E033
* (ARM7_RAM_ADDRESS + PATCH [12] +6) = 023F

void MemoryWrite512K (void)

(9) PATCH [13]: Patch_B (function7)
If your code · ARM
* (ARM7_RAM_ADDRESS + PATCH [13] +0) = E59F2000 ldr r2, [r15]
* (ARM7_RAM_ADDRESS + PATCH [13] +4) = E12FFF12 bx r2
* (ARM7_RAM_ADDRESS + PATCH [13] +8) = 023FE03D

If your code · THUMB
* (ARM7_RAM_ADDRESS + PATCH [13] +0) = 4A00
* (ARM7_RAM_ADDRESS + PATCH [13] +2) = 4708
* (ARM7_RAM_ADDRESS + PATCH [13] +4) = E03D
* (ARM7_RAM_ADDRESS + PATCH [13] +6) = 023F

void CardCommand (u32 command)
entry
r0 = command (Gamecard bus command)

(10) PATCH [14]: Patch_B (function7)
If your code · ARM
* (ARM9_RAM_ADDRESS + PATCH [14] +0) = E59F2000 ldr r2, [r15]
* (ARM9_RAM_ADDRESS + PATCH [14] +4) = E12FFF12 bx r2
* (ARM9_RAM_ADDRESS + PATCH [14] +8) = 023FE03D

If your code · THUMB
* (ARM9_RAM_ADDRESS + PATCH [14] +0) = 4A00
* (ARM9_RAM_ADDRESS + PATCH [14] +2) = 4708
* (ARM9_RAM_ADDRESS + PATCH [14] +4) = E03D
* (ARM9_RAM_ADDRESS + PATCH [14] +6) = 023F

void CardCommand (u32 command)
entry
r0 = command (Gamecard bus command)

(11) PATCH [15]: Patch_B (function8)
If your code · ARM
* (ARM9_RAM_ADDRESS + PATCH [15] +0) = E59F1000 ldr r1, [r15]
* (ARM9_RAM_ADDRESS + PATCH [15] +4) = E12FFF11 bx r1
* (ARM9_RAM_ADDRESS + PATCH [15] +8) = 023FE047

If your code · THUMB
* (ARM9_RAM_ADDRESS + PATCH [15] +0) = 4900
* (ARM9_RAM_ADDRESS + PATCH [15] +2) = 4704
* (ARM9_RAM_ADDRESS + PATCH [15] +4) = E047
* (ARM9_RAM_ADDRESS + PATCH [15] +6) = 023F

void CardInitialize (void)

(12) PATCH [16]: Patch_A
If your code · ARM
* (ARM9_RAM_ADDRESS + PATCH [16]) = E12FFF1E bx r14

If your code · THUMB
* (ARM9_RAM_ADDRESS + PATCH [16]) = 4770

(13) PATCH [17]: Patch_C (function7)
If your code · ARM
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x0C) = E92D400F stmdb r13!, (R0, r1, r2, r3, r14)
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x10) = E1A0000C mov r0, r12
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x14) = E1A01005 mov r1, r5
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x18) = E28FE008 add r14, r15, # 0x8
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x1C) = E59F2000 ldr r2, [r15]
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x20) = E12FFF12 bx r2
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x24) = 023FE03D
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x28) = E8BD400F ldmia r13!, (R0, r1, r2, r3, r14)
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x2C) = E1A00000 nop (mov r0, r0)
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x30) = E1A00000 nop (mov r0, r0)
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x34) = E1A00000 nop (mov r0, r0)
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x38) = E1A00000 nop (mov r0, r0)
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x3C) = E1A00000 nop (mov r0, r0)
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x40) = E1A00000 nop (mov r0, r0)
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x44) = E1A00000 nop (mov r0, r0)
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x48) = E1A00000 nop (mov r0, r0)
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x4C) = E1A00000 nop (mov r0, r0)
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x50) = E1A00000 nop (mov r0, r0)
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x54) = E1A00000 nop (mov r0, r0)
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x58) = E1A00000 nop (mov r0, r0)
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x5C) = E1A00000 nop (mov r0, r0)
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x60) = E1A00000 nop (mov r0, r0)
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x64) = E1A00000 nop (mov r0, r0)
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x68) = E1A00000 nop (mov r0, r0)
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x6C) = -------- skip
* (ARM9_RAM_ADDRESS + PATCH [17] +0 x70) = E1A00000 nop (mov r0, r0)

If your code · THUMB
No

void CardCommand (u32 command)
entry
r0 = command (Gamecard bus command)

(14) PATCH [18]: Patch_D
If your code · ARM
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x00) = E59F1010 ldr r1, [r15, # +0 x10]
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x04) = E5911000 ldr r1, [r1, # +0 x0]
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x08) = E38114A1 orr r1, r1, # 0xA1000000
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x0c) = E5801004 str r1, [r0, # +0 x4]
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x10) = E3A00000 mov r0, # 0x0
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x14) = E12FFF1E bx r14
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x18) = 027FFE60

If your code · THUMB
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x00) = 4903
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x02) = 6809
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x04) = 4A03
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x06) = 4311
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x08) = 6041
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x0a) = 2000
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x0c) = 4770
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x0e) = 0000
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x10) = FE60
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x12) = 027F
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x14) = 0000
* (ARM9_RAM_ADDRESS + PATCH [18] +0 x16) = A100

(15) PATCH [19]: Patch_E
pending

If anyone can make sense of it ?

Hear are the two gentators one for TTDS

<a href="http://gbatemp.net/t214600-may-i-know-how-to-edit-extinfo-dat-savlib-dat-and-infolib-dat?view=findpost&p=2712974" target="_blank">http://gbatemp.net/t214600-may-i-know-how-...t&p=2712974</a>

Direct link <a href="http://www.ndstti.cn/download/tool/infolib_custom.7z" target="_blank">http://www.ndstti.cn/download/tool/infolib_custom.7z</a>

One For R4 original Ysmenu <a href="http://gbatemp.net/t236685-tutorial-infolib-dat-generator-for-r4-original-ysmenu-users" target="_blank">http://gbatemp.net/t236685-tutorial-infoli...al-ysmenu-users</a>

Direct link <a href="http://www.mediafire.com/download.php?82jdu1jdeewujl1" target="_blank">http://www.mediafire.com/download.php?82jdu1jdeewujl1</a>

Now also i heard that it might be possible to use a nds emulator degubber - but i have tryed everythink 

Anythought's are good idears are welcome hear 

It's a question of bypassing the errcode=-4 witch is ARM9 and Errcode=-6 is ARM7 issue

EDIT:

<img src="http://img245.imageshack.us/img245/955/infolibdatsturcture.png" border="0" class="linked-image" />

This image is for NDS roms , (Note) Not DSI

Arm7 is in Green and ARM9 in Red , infolib.dat structure image

Apart from what i can find im out of idear's ?

drwhojan · Sep 28, 2010

Can not work it out or think of any good idears , I quit and will continue with real life insted ...

Thought's and Idear's over to you all XD!

Hacking Infolib.dat coeing any thoughts ?

Well-Known Member

Well-Known Member

Well-Known Member

Similar threads

Popular threads in this forum