Homebrew Nintendo Badge Arcade Hacking - Full Documentation and Progress

Status
Not open for further replies.

Nyannurs

Well-Known Member
OP
Member
Joined
Aug 30, 2014
Messages
480
Trophies
0
XP
904
Country
Germany
9a824dd80c.jpg


First tutorial by @Méga_Mew has been released: https://gbatemp.net/threads/tutorial-how-to-make-a-custom-
badge.403281/

Great tutorials by @Ericzander for both homebrew users and emuNAND users:
Homebrew:
emuNAND:


User @szymbar15 - managed to dupe badges.
That for starters, it's extremely inaccurate tho.
http://3dbrew.org/wiki/Home_Menu#BadgeMngFile.dat
0x04 - amount of different collections
0x08 - amount of unique badges
0x0C - amount of badges placed in the Home Menu
0x18 - amount of all badges
0x1C - 4-byte something looking like a checksum

0x3E8 starts an array of values 0x28 byte long
First 4 bytes - checksum? It's not CRC-32, or is it? If it's CRC-32, then I don't know which part of the rest of this array entry is checksumed.
0x04 - badge ID in hex, after converting to dec looks like something like "XYZ00" with X, Y and Z being digits and X can be 0.
0x08 - badge collection ID
0x0C - badge order ID in that tool to place badges
0x10 - the amount of badges placed in the Home Menu already
0x12 - the amount of badges you have
0x14 - 2-byte something I have no clue about
0x18 - shortcuts to apps, 0x10 long. There are two repeats of the same value being title IDs from this list: http://3dbrew.org/wiki/Title_list#00040010_-_System_Applications
In order to make a shortcut work, one must write the entire extended string twice, for example if you want to call Activity Log on European 3DS, it goes like 00 22 02 00 10 00 04 00 00 22 02 00 10 00 04 00.
If a badge has no shortcut, all the bytes get replaced with FFs.
That's all I know.

EDIT: Ooh, I something another that would be interesting. 0xB2E8 is the beginning of the "Home Menu layout section" array with 0x18 long values.
0x00 - The 6-byte ID from the upper section: 4 first bytes are probably checksum, second are badge ID.
0x08 - Collection ID
0x0C - Badge order ID
0x10 - ?! Ascending numbers anyway
0x14 - 4-byte always (?) FFs.

EDIT: Fufufufu, they've secured it up nicely. 0xA030 begins the 'collection' section. Array with 0x48 long values.
0x04 - ?!
0x08 - Collection ID
0x14 - Amount of unique badges you have from that collection
0x18 - Total amount of badges from that collection
0x1C - Starting badge ID of this collection

Progressing it up nicely, I'll try to clone some badges really soon.

EDIT: I did it!
YnUruC4.jpg

Steps to multiply the amount of badges:
1. Edit 0x18
2. Edit 0x12 in the first array of badges.
3. Edit 0x18 in the 'collection' array.
Easy, I'll try to tinker some more and maybe code a tool for it.

EDIT: BadgeMngFile.dat is updated after connecting to the internet in the Badge Arcade app, so if you open it up, any modifications you made will be removed.

User @Februarysn0w - provided badge data with 950 badges.
ah...I already got 950 badges legally and the case is full. lol
send you my data asap.

User @Februarysn0w - provided comments on hex editing.
and now I just paid for this game 2 times and got 10 or 20 badges. completed 2 or 3 collections.
Here is screen shot and some comment by me. Sorry I'm not exactly understand the data. just a sample.
3hAxqad.png

left one is new right one is old.
I think other some hex mean how many badges you have one by one.

EDIT:
I think we need a completed save data. I saved 3 savedata, so if someone need these files feel free to give me reply.

EDIT2
Here is badge count! I confirmed.
k0BHc0X.png

User @szymbar15 - provided information about how badges are stored.
Huh, I just uncovered an interesting thing.
These values at 0x358 ascend every time you get the badges. They do it by adding another F at the end (or the beginning since it's little endian) of the string (?).
LjeEC3b.png

It's way more complex than I thought, I'm putting the editor onhold for now, I have to uncover every nook and cranny there is.

EDIT: Hype, I am able to add my own badges to the old save file using Hex Editor and the values from the new save. There's a little catch though :P

EDIT: Okay, I fixed it again. Figured out one new thing, adding to that research post.

User @szymbar15 - found out how to edit text in the badge placer menu.
FINALLY. That Sunshell is a pain in the ass to install :/
BadgeData.dat is a file that's exactly 16 048 000 bytes long.
0x0 starts the two-dimensional array of entries 0x10 times 0x8A long.
Japanese file I got from @Februarysn0w actually gives a bit more info on how the array looks like.
The first line is Japanese text, the second one is English, the third one is French, then German, Italian, Spanish, Simplified Chinese, Korean, Dutch, Portugese, Russian, Traditional Chinese and 4 lines that don't appear to be relevant, but they're usually the same as English ones.
Names of the badges appear at 0x35E80, again we've got a two-dimensional array 0x10 times 0x8A long, but this time it's one per badge, not one per series.
0x250F80 starts the section that looks like properties of the badges, although I can't find any values from Mng in there.
0x318F80 is another section with similar values, investigation will be held.
0xCDCF80 is yet another one and it appears a bit different, although complex as well.
I think one of them might be related to the image and another one might be banner for example. Will check later.
And that's all from this file, I'll try to edit the name of the collection to see if I was right on the first part, stay tuned :)

EDIT: Ooooops, sorry for double post, how do I merge posts over here...? :S

EDIT: It works! YEAH!
eLowCmdl.jpg

User @Kaphotics - provided information on how to add a footer to a .bclim file through hex editing.
4eBAGr3.png


result in pk3DS:
oclm4Wl.png


result in png2bclim (same):
YQ1fKU8.png


Obviously the footer I used may have not been the best fit, but you'd have to tweak it to maybe show up right. Who knows, maybe they have a custom color palette stored in the game files.

User @szymbar15 - managed to open a badge's .bclim file.
Anyway, I DID IT GUYS
HYPE
7ReK36K.png

Now holy fuka how to generate own BCLIM...

User @Méga-Mew - successfully injected a .bclim into the badge placer menu.
bclim injection work !
1447606835-img-20151115-175726806.jpg


Now I will try with badges

User @Méga-Mew - successfully injected a badge.
Badge injection ! (But with 8-bit mario)

1447610555-img-20151115-190045683.jpg

User @Méga-Mew - fixed the badge's shape.
Mario shade fixed

1447611781-img-20151115-192106808.jpg


(00 at the top left)

Setting up a database for badges: @shutterbug2000

Resources:

https://github.com/szymbar15/extdata_dump/releases/tag/vB -- Fast and stable way to dump Badge Center's files.
https://github.com/szymbar15/extdata_dump/blob/master/config.txt -- Config that allows you to automatically dump and replace only the files you need.
https://gbatemp.net/threads/release-sunshell-a-powerfull-shell-for-3ds.382483/ -- Another option for dumping Badge Center's files, very slow.
https://gbatemp.net/threads/wip-ohana3ds-tool.392576/ -- allows you to open .bclim files.
https://onedrive.live.com/redir?resid=B6305612E3C95FBD!694&authkey=!ANwz34EVEYjGARc&ithint=folder,rar
@Februarysn0w's badge data, containing over 1000 badges. update any time when I got new badges. also I give permission to folder all the people to upload download the files.
How a .bclim works:
"4 bytes per pixel. This means that in 8,192 byte big file you can fit an image that would have 2,048 pixels.
For example 32x64. Or 64x32. Or 128x16. And any file that has these dimensions will be exactly 8192 bytes IF NOT for the metadata in the footer, which can't be avoided." (by user @szymbar15)


Further documentation of the progress on badge hacking will be edited into the post.
 
Last edited by Nyannurs,

Keizel

Well-Known Member
Member
Joined
Jun 28, 2015
Messages
381
Trophies
0
XP
372
Country
United States
If I want dump for upload my file with badges, is important the Region of my 3DS? (EUR in this case)
 
Status
Not open for further replies.

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    SylverReZ @ SylverReZ: Hello @realtimesave.