Hacking Instacheck v2

[DestinyFeather]

http://projectpokemon.org/forums/showthread.php?37221-(X-Y)-KeySAV-Box-Data-Viewer

KeySAV

KeySAV is a tool I wrote to decrypt portions of the X/Y SaveData from a Digital Save / PowerSaves rip.
With this tool you can view IVs/Nature/ESV/TSV of Hatched/Unhatched Pokémon that are in your boxes.
SUPPORTS BOTH RETAIL CARTRIDGES AND DIGITAL COPIES

You cannot use someone else's data.
This program does not export any data from your save file. Only views it.
Thanks to OmegaDonut for dumps, testing, and original concept.

Tutorial:

Spoiler

Digital Copy Save files are stored in:

• X - \title\00040000\00055d00\
• Y - \title\00040000\00055e00\

Datel PowerSaves are stored in the C:\Users\*\PowerSaves3DS folder.

Initial Setup:

• Have an empty box 1 & 2 (can move out of box)
• Go capture 6 Pokémon
• --
• Have them in slots 1-6 in Box 1
• Save once, hard reset, save again, then export your save as "16.bin" (or 16.sav if you have a digital)
• --
• Move them to slots 1-6 in Box 2, keep same order.
• Save once, hard reset, save again, then export your save as "26.bin" (or 26.sav if you have a digital)

Tab 1: Cracking your Keystreams

• Open SAV 1 = 26.bin
• Open SAV 2 = 16.bin
• Click [Break].
• (If it fails, switch SAV1 & SAV2. You've switched their positions ingame).
• --
• Save K1 with the suggested filename.
• Save K2 with the suggested filename.
• Save Blank as Blank.ekx

Tab 2: Box Data Export

• Open the Save file you wish to check.
• Open the Box keystream of the box you wish to view data for.
• Open the Blank.ekx you've exported.
• Select the Box you wish to dump from. It must match the suggested Box "save as" name.
• Select the Data Mode you wish to Dump for: TSV outputs TSVs, the other two output egg/stat-data in different formats.
• Click Dump Box. Results will be exported to the lower window.

If you have any errors, try re-breaking with the two save files switched. If you downloaded shortly after release, re-download -- I fixed some bugs. Should be stable now.

 

[The Real Jdbye]

"This program does not export any data from your save file."
...

I broke their defenses

 

[Luis Felipe Gonzalez]

would a r4i save dongle save file work with this?

 

[Queno138]

would a r4i save dongle save file work with this?

no, because r4i can't read the sector for nand saves.

Multiple people (including myself) made dumps, and the file is filled with nothing but 00s.

"This program does not export any data from your save file."
...

I broke their defenses

Release please XD

 

[Kaphotics]

Release please XD

he won't; those were debug functions when I was making the program.

I went and turned off the stuff that people don't need to use... because the most useful stuff is the box viewing.

Unless you want to get the encryption stream for one slot at a time (instead of 30 at a time), you'll be able to do nothing extra with it. All it does is read data from your save file, no writing (because that hasn't been figured out yet).

(alt checkflag switches to the alternate save file location; they swap positions when you save which is why 2 saves are required)
(dump key allows you to dump an entire box's key with a blank assuming it is empty; it was used to develop and check the box breaker's feasibility, since that was developed last)
(native EKX allows you to get the keystream if you already have the encrypted PKX data for a single slot)
(foreign EKX was our first way of getting the keystream for a single slot; was before we figured out the box-breaking exploit)

A lot of it was just manual input; for public release I was able to automate and simplify the process.

 

[Huntereb]

It's a start, but ultimately useless. It'll only be worth while when it can make modifications and actually save them.

 

[aos10]

so , only power save can get the save file ?
i need to buy one

 

[Kaphotics]

It's a start, but ultimately useless. It'll only be worth while when it can make modifications and actually save them.

You're entitled to believe whatever you want, but no, it's not useless. IV / SV checking of an entire box at a time. That's definitely useful to some communities, but not useful for scriptkiddies to inject their hacks.

so , only power save can get the save file ?
i need to buy one

You can use it with eShop digital copies. The only way to get the save file off of a retail cart is through the PowerSaves device.

 

[aos10]

You're entitled to believe whatever you want, but no, it's not useless. IV / SV checking of an entire box at a time. That's definitely useful to some communities, but not useful for scriptkiddies to inject their hacks.



You can use it with eShop digital copies. The only way to get the save file off of a retail cart is through the PowerSaves device.

i can ?
how to do it ?

 

[Kaphotics]

i can ?
how to do it ?

Read the tutorial on the KeySAV thread or read /r/SVExchange's documentation.

 

[FAST6191]

People Hozu has managed to be a member for 3 and a half years at this point (posting in all of them, not just lurking) without getting into trouble. Having a quick scan the site in question, which was not linked, it would not appear to contravene any GBAtemp rules and people are quite free to enact harsher rules on sites they control. When your main audience includes the pokemon set, much less the subset that is inclined to hack without putting in the effort to learn hacking, I can say from experience it is a toxic community and an iron fist in an attempt to ensure some civility is a good thing; we do the same thing here and where anybody can make a non translation hack thread that has no hope of getting anywhere every pokemon hack gets to be vetted first.

Now the remark might have ranked as a snide one, and indeed I do not care about cheating, much less the form I consider entirely acceptable of generating mons as they could reasonably and easily be obtained in the normal game or that could be expected by those that move entirely within "official" circles, so meh, but if we slapped everybody for a such a thing then we would have no members. Everybody has said their piece, there is no outstanding hurts needing comment and we have an interesting new program to discuss in a interesting world -- most of this is largely side channel hacking, such a thing is quite rare in console/game hacking world where we instead have traditionally seen the console in question being totally owned and the only troubles being nobody has put in the effort to reverse engineer the game code. It might even serve to pay attention here as this sort of thing might be the future as console makers get someone competent to create security for their consoles (not to mention increasing code complexity means higher level inferences are a more and more useful way of looking at things), learning now leaves less of a gap later.

If you must discuss it then take it to another thread.

 

[Xexyz]

YES! This works for digital!

 

[fierce waffle]

"This program does not export any data from your save file."
...
I broke their defenses

As did I! Haha

 

[Huntereb]

You're entitled to believe whatever you want, but no, it's not useless. IV / SV checking of an entire box at a time.

Yeah, still worthless to me. If I ever truly need to check the stats of one of my guys, I would just use the IV checker in the last town. I don't get box-fulls of Pokemon at a time, especially when I can't use Pokebank on my 3DS anyway.

That's definitely useful to some communities, but not useful for scriptkiddies to inject their hacks.

Yeah, I can only dream of this.