Hacking NDS Adaptor PLUS + 3DS Games

[Roxxy]

To check where the saves are located, just put your module into another 3DS.

 

[Quincy]

How? Just how can you think they are stored on the 3DS when they have been backup up from the cartridge..?
The result nekoakuma got could have many reasons.

Here's a theory, the Game saves to both handheld and cart. It tries to read from the 3DS first and if the save isn't present it nabs it off the gamecart..

This is just a wild guess.

 

[doyama]

I thought it was confirmed that the 3DS saves to the console or SD. Im not sure where I saw it though. Check this

This is ABSOLUTELY INCORRECT. Again if you spent the 10 seconds to browse Nintendo's official website it clearly states that 3DS saves are save to the game cartridge. Save games are NOT stored on the SD slot. Only 'extra' data can be stored on the SD slot on a per game basis. The saves themselves are stored on the 3DS cartridge. There is already an extensive thread on this.

http://gbatemp.net/t282983-speculation-the...t&p=3518467

 

[TheNikkoMan]

How? Just how can you think they are stored on the 3DS when they have been backup up from the cartridge..?
The result nekoakuma got could have many reasons.

Here's a theory, the Game saves to both handheld and cart. It tries to read from the 3DS first and if the save isn't present it nabs it off the gamecart..

This is just a wild guess.

Well that could be, as a piracy counter. If the cart save isn't the same as the internal save, the cart save is deleted and replaced with the internal. Obviously the internal is harder to get, and might also be encrypted in a non-stupid way. Which would explain the lousy "encryption" on the saves.
But this is all speculation. But we know that it at least stores a/the save on the cart.
Actually, this isn't possible. If this was true you wouldn't have been able to play game A on console 1, then play game A on console 2, and then play game A at console 1 again. So, it's probably a no.

 

[doyama]

That NDS Adaptor is interesting, but why does their website look like it was designed by a colour blind web designer from the 90s? It's literally a textbook example of what NOT to do

 

[how_do_i_do_that]

They are almost as old as dirt and go as far back to crap that we could dump that is older than most users on this site.

 

[Jaden.]

Haven't you been thinking...

Maybe, the save is located at the cart and 3DS?

Then if the card save != 3DS save, it just loads 3DS save?

1: Have you tryed, formatting the 3DS, put the gamecard with the edited .sav and try?
2: Where you exactly get the .sav? .o

Can't you use the adaptor to get the ROM?

 

[nekoakuma]

Well, I've managed to extract the key.bin and a decryptedsave file of RR....but I'm a bit lost as to what I'm looking for.

I saw the guys name at Line 405 in the one posted in the other thread, but the program doesn't show line numbers (or i don't know how to use it.)

I'm (trying) to use Cygnus Free Edition. Any help on that?

nevermind. Found my name. Gonna try edit it and restore it.

edit;

nothing changed
QUOTEQ7. I have tried all of the above method, but seems my NDS™ card doesn't compatible with the #0907 NDS™ Adaptor Plus, what's wrong?

A). For this case, please download and upgrade to the latest firmware and try again. If the latest firmware upgrade doesn't work, please kindly report to us. If it is a compatibility problem between the game and the #0907 NDS™ Adaptor Plus, we will try our best to release firmware updates so as to fix it.

Just Saying

..... SRC : http://www.hkems.com/qa_0907.htm

Not even sure what this post is about?

I actually did some testing for HKEMS with their 3.00FW, the one which broke the ability to detect and rip 3DS game saves and was later fixed in 3.01.



Anyway, I've ended up with 3 no-go's so far.

1. Backed-up data. Bought a few cars. Restored Data. Cars still unlocked.
2. popoffka tried to corrupt the save (see pg.1), I restored it and the save loaded fine.
3. Using the v1 of the save decrypt tool, changed my name, restored it to cart. Original name appeared.

 

[how_do_i_do_that]

Haven't you been thinking...

Maybe, the save is located at the cart and 3DS?

Then if the card save != 3DS save, it just loads 3DS save?

1: Have you tryed, formatting the 3DS, put the gamecard with the edited .sav and try? Why would I need to format my 3DS for if it is working properly. Have you even tried looking on the SD card for a save file or a bin file. Do you even have a 3DS to begin with.
2: Where you exactly get the .sav? .o From the cart.

Can't you use the adaptor to get the ROM? Nobody has done it yet so the answer is no.

 

[Quincy]

Well, I've managed to extract the key.bin and a decryptedsave file of RR....but I'm a bit lost as to what I'm looking for.

I saw the guys name at Line 405 in the one posted in the other thread, but the program doesn't show line numbers (or i don't know how to use it.)

I'm (trying) to use Cygnus Free Edition. Any help on that?

nevermind. Found my name. Gonna try edit it and restore it.

edit;

nothing changed
QUOTEQ7. I have tried all of the above method, but seems my NDS™ card doesn't compatible with the #0907 NDS™ Adaptor Plus, what's wrong?

A). For this case, please download and upgrade to the latest firmware and try again. If the latest firmware upgrade doesn't work, please kindly report to us. If it is a compatibility problem between the game and the #0907 NDS™ Adaptor Plus, we will try our best to release firmware updates so as to fix it.

Just Saying

..... SRC : http://www.hkems.com/qa_0907.htm

Not even sure what this post is about?

I actually did some testing for HKEMS with their 3.00FW, the one which broke the ability to detect and rip 3DS game saves and was later fixed in 3.01.



Anyway, I've ended up with 3 no-go's so far.

1. Backed-up data. Bought a few cars. Restored Data. Cars still unlocked.
2. popoffka tried to corrupt the save (see pg.1), I restored it and the save loaded fine.
3. Using the v1 of the save decrypt tool, changed my name, restored it to cart. Original name appeared.

Try to delete the save off your never mind.. that isn't possible yet. Try a format to see if the method works (But you'll lose all your data)

 

[nekoakuma]

Well, I've managed to extract the key.bin and a decryptedsave file of RR....but I'm a bit lost as to what I'm looking for.

I saw the guys name at Line 405 in the one posted in the other thread, but the program doesn't show line numbers (or i don't know how to use it.)

I'm (trying) to use Cygnus Free Edition. Any help on that?

nevermind. Found my name. Gonna try edit it and restore it.

edit;

nothing changed
QUOTEQ7. I have tried all of the above method, but seems my NDS™ card doesn't compatible with the #0907 NDS™ Adaptor Plus, what's wrong?

A). For this case, please download and upgrade to the latest firmware and try again. If the latest firmware upgrade doesn't work, please kindly report to us. If it is a compatibility problem between the game and the #0907 NDS™ Adaptor Plus, we will try our best to release firmware updates so as to fix it.

Just Saying

..... SRC : http://www.hkems.com/qa_0907.htm

Not even sure what this post is about?

I actually did some testing for HKEMS with their 3.00FW, the one which broke the ability to detect and rip 3DS game saves and was later fixed in 3.01.



Anyway, I've ended up with 3 no-go's so far.

1. Backed-up data. Bought a few cars. Restored Data. Cars still unlocked.
2. popoffka tried to corrupt the save (see pg.1), I restored it and the save loaded fine.
3. Using the v1 of the save decrypt tool, changed my name, restored it to cart. Original name appeared.

Try to delete the save off your never mind.. that isn't possible yet. Try a format to see if the method works (But you'll lose all your data)

mm, i'm quite a bit ways into the game. i'd rather finish it first then go about deleting it. lol

 

[Bug_Checker_]

Aaron did you replace ALL 4 nicks in the Ridge Racer save file?

And did you re-encrypt the save file with the key.bin?

On a side note BroadOn/Crediar said there were free software to backup 3ds saves, anyone know for sure how?





Edit: mistyped 5 instead of 4

 

[TheNikkoMan]

Haven't you been thinking...

Maybe, the save is located at the cart and 3DS?

Then if the card save != 3DS save, it just loads 3DS save?

1: Have you tryed, formatting the 3DS, put the gamecard with the edited .sav and try?
2: Where you exactly get the .sav? .o

Can't you use the adaptor to get the ROM?
QUOTE(TheNikkoMan @ Apr 3 2011, 09:38 PM) Actually, this isn't possible. If this was true you wouldn't have been able to play game A on console 1, then play game A on console 2, and then play game A at console 1 again. So, it's probably a no.

Get my point?

Also, I thought save restore was broken. If you want to confirm, back it up, decrypt, make the WHOLE SAVE 00 or FF or some crap, reencrypt and restore. If it still plays from the same point, then there's no way restoring works.

 

[Habstinat]

To see if it's just a problem with the NDS Adaptor PLUS not being able to write to the card, try making a backup, changing it to have something weird in it (Or filling it all with FFs), writing it to the card, and then, without touching the 3DS, making a backup from that card again. If you're not getting the weird stuff you just wrote in your new backup, your modified backup wasn't even getting written to the card. Hopefully this is the problem and not something else.

 

[Bug_Checker_]

1st of all, everyone should be using 0.2b or later for decrypt/encrypt

From 3DSaveTool

Change log

v0.2b
fixed a bug in the 0xFF block detection
v0.2
de/encrypting now starts at 0x1000
fixed a few new line errors in the usage info
when de/encrypting only 512byte blocks of 0xFF are skipped now
fixed a bug which would not de/encrypt the last 0x2000 bytes

2nd I'm seeing some differences between the 1st
Ridge Racer 3D.sav dated 3/14/2011 11:11 AM
And the other
Ridge Racer 3D.sav dated 3/17/2011 8:09 PM
They could be bug related but without source code it's just a guess.

I'd like to see a lot more saves. The more the better.

 

[Bug_Checker_]

Ok to answer my own question earlier about 3DS saves and free tools.
Crediar released a tool about 6 hours ago.
http://twitter.com/BroadOn

"BroadOn Released DSaveManager v0.1 you can dump your 3DS savefiles with this (using a DS/DSLite + wlan + PC) -> http://3dbrew.org/wiki/DSaveManager
about 6 hours ago"

DSaveManager v0.1 by crediar
-----------------------------------------------------------------------
It is not allowed to resell, rehost, redistribute or
include this file in any packages!

Usage:
-----------------------------------------------------------------------
This tool only works on a DS/DSLite!

1. Setup WFC via a game
2. Change the IP in the dsm.ini to that of the PC running the DSM.exe
   (Leave a newline at the end of the IP)
3. Load the DSM.nds on your DS/DSLite, any method should work fine.
4. Follow the onscreen instructions!

Addition info:
-----------------------------------------------------------------------
Neither the 3DS card nor the DS/DSLite can be damaged by this,
DS cards and 3DS cards are using the same pinout and the same
voltage. Only the protocol for reading the ROM differs!

Obviously 3DS cards normally don't fit into a DS.
You can either saw off the edge or open the card with a knife and
insert the board into a DS card-case.

Also the current libnds fails to correctly detect the savefile
size so I added a hack, please report new found IDs when the tool
prompts you too(but only for 3DS games!).


Other Stuff:
----------
You can always find the latest version here:

http://3dbrew.org/wiki/DSaveManager

If you find any bugs you can either report them there or come to IRC
efnet #3dsdev!

 

[nekoakuma]

Aaron did you replace ALL 4 nicks in the Ridge Racer save file?

And did you re-encrypt the save file with the key.bin?

On a side note BroadOn/Crediar said there were free software to backup 3ds saves, anyone know for sure how?





Edit: mistyped 5 instead of 4

There's four?

I only changed the one at Line 405. >.>

"Also, I thought save restore was broken. If you want to confirm, back it up, decrypt, make the WHOLE SAVE 00 or FF or some crap, reencrypt and restore. If it still plays from the same point, then there's no way restoring works."

I'm not sure what popoffka did, but he said he tried to corrupt the save and it restored fine for me.


It is a possibility that the NDS Save Adapter isn't writing it back properly though. I can't really test much because I have exams coming up, but if someone wants to mess around with any of the saves and re-ul them, I can try restore and see if anything changes. (Something obvious like Nickname in Ridge Racer)

 

[Habstinat]

Made quite a few modifications to the Ridge Racer 3D save for you to test. You can download them here: http://www.mediafire.com/?cmcfb26uop1c8sj

Here's a description of the filenames and what has changed:

Ridge Racer 3D Qwertyuiopasdfghjklzxcvbnmnbvcxzlkjhgfdsapoiuytrewq.sav - Encrypted version of "Decrypted Ridge Racer 3D Qwertyuiopasdfghjklzxcvbnmnbvcxzlkjhgfdsapoiuytrewq.sav"
Ridge Racer 3D Qwertyuiopasdfghjklzxcvbnmnbvcxzlkjhgfdsapoiuytrewq Insert.sav - Encrypted version of "Decrypted Ridge Racer 3D Qwertyuiopasdfghjklzxcvbnmnbvcxzlkjhgfdsapoiuytrewq Insert.sav".
Decrypted Ridge Racer 3D Qwertyuiopasdfghjklzxcvbnmnbvcxzlkjhgfdsapoiuytrewq.sav - Replaced all four instances of "Aaron" with "Qwertyuiopasdfghjklzxcvbnmnbvcxzlkjhgfdsapoiuytrewq". I replaced the letters ahead of it with this, so the file is the same length.
Decrypted Ridge Racer 3D Qwertyuiopasdfghjklzxcvbnmnbvcxzlkjhgfdsapoiuytrewq Insert.sav - Replaced all four instances of "Aaron" with "Qwertyuiopasdfghjklzxcvbnmnbvcxzlkjhgfdsapoiuytrewq". I inserted it, so the file is a bit longer.
Decrypted Ridge Racer 3D.sav - Decrypted version of "Ridge Racer 3D.sav".
Decrypted Ridge Racer 3D Harry.sav - Replaced all four instances of "Aaron" with "Harry". They have the same number of letters.
Reencrypted Ridge Racer 3D.sav - After decrypting "Ridge Racer 3D.sav", just to see if there was a problem with the reencryption process, I encrypted it again without making any changes.
Ridge Racer 3D.sav - Original save file.
Ridge Racer 3D Harry.sav - Encrypted version of "Decrypted Ridge Racer 3D Harry.sav".
Ridge Racer 3D.bin - Key I used to decrypt/encrypt all the files.

If you could try out all the encrypted files and post your results, that would be great.

 

[nekoakuma]

Alright sweet. Will try now.

Setup:

NDS Adaptor Plus - FW 3.01
Ridge Racer 3D JPN (LNA-CTR-ARRJ-JPN)
JPN Black 3DS

Method: Checking for instances of 'Aaron' (via going to Single Play -> Grand Prix)

Test#1 - Ridge Racer 3D Qwertyuiopasdfghjklzxcvbnmnbvcxzlkjhgfdsapoiuytrewq Insert.sav
Results: Says Aaron still

Test #2 - Ridge Racer 3D Qwertyuiopasdfghjklzxcvbnmnbvcxzlkjhgfdsapoiuytrewq.sav
Results: Still says Aaron.

Test#3 - Ridge Racer 3D Qwertyuiopasdfghjklzxcvbnmnbvcxzlkjhgfdsapoiuytrewq.sav without SD card in slot.
Results: Still says Aaron

Test #4 - Ridge Racer 3D Harry.sav
Results: Still says Aaron.

Test #5 - Ridge Racer 3D.sav (it's an older backup. I've played quite a bit since then.)
Results: No changes whatsoever to any of my race stats/records/cars purchased/time played, etc.


Instances where it says Aaron:

WHen you select Grand Prix, it has a welcome message along the lines of "Welcome Aaron" ..."Aaron" then mentions your race history. After this screen when you can select Basic GP, it has 'Aaron' in the nickname tab on the right.

 

[Jupiterman]

I Didn't exactly read this entire thread but I'm pretty sure it saves to the cartridge. I played my cousin's Samurai Warriors:Chronicles on my 3DS and it still has his Save on there. I'm not sure what all of this means but if it helps any I figured I'd throw that out there.