ROM Hack Question Pointer Search Tutorial??????

Smoker1

Well-Known Member
OP
Member
Joined
Feb 17, 2015
Messages
5,066
Trophies
1
Location
California
XP
6,145
Country
United States
I need a Pointer Search that will work for the following.........
Switch using Atmosphere 0.9.3|S
Have EdiZon

I have tried JNoexs+SX OS Code Builder, but I get Issues. I will use 1 Game that is getting to me as an Example.....

I find the Addresses/Values needed
Fighters History Search Results.jpg

I then go by The Following Tutorial, shared by @phonz
https://gbatemp.net/threads/cheat-codes-ams-and-sx-os-add-and-request.520293/page-55#post-8356895

Now in the Tutorial, it is shown using JNoexs v1.1.1. But 1.1.2 does not create a Dump like the previous. So I go by what was Suggested, and go by the 1st Dump that was made for the Search in Question, for both.....
Fighters History - Time Results.jpg Fighters History - Health 1 Results.jpg Fighters History - Health 2 Results.jpg
NOTICE THE ADDRESS AND THE RESULTING CODE. ALSO THE OFFSET SECTION.

However, there are times, when trying to Convert with the Code Builder, I get this Error.....
Pointer Error.jpg

Or if I am able to get Results that create a Code, none of them work.
NOTE: for the Game in Question, the Codes when I found them, were located in the HEAP Section. Also, the Addresses change, so they do in fact require a Pointer, and must be run after the Game has been run, or it will give a Error, just like the NeoGeo Games.

Basically, all these Switch Games that have Pointers for, on behalf of us Noobs, I ask - HOW??????????? Wouldn't it be better for Users to be able to create their own Codes instead of hounding Pages with Requests, over and over again?

Info needed -
Tools Required????
Programs Required????
Which CFW is Required - SX OS, Atmosphere???? Can both be used?
How can Memory Dumps be made, and used for Pointer Searches????
 

Falo

Well-Known Member
Member
Joined
Jul 22, 2012
Messages
680
Trophies
2
XP
2,628
Country
Germany
Heap is the RAM of games, some have fixed addresses, but normally Heap should ALWAYS be considered dynamic and there should always be a pointer to it.
The base-pointer itself must be contained in main memory, it cannot be anywhere else or it is a wrong pointer, so a memory address outside of main memory is always wrong.
If the pointer is lower then main, like in your screenshot, then it is wrong, because it must be inside of main memory, not outside.

Your problem is:
- you try to find a multi-level pointer by searching just 1 level
- you're not searching in main memory

But the biggest problem is your target, "Johnny Turbo's Arcade Fighter's History"
This target is a PC Engine game, emulated inside of Unity Engine.

This means:
- you need to find a pointer to the emulator memory inside of main
- then find the pointer to the values inside emulator memory
depending on how the emulator was coded, this could be a 4 or 5 level pointer.

main is 0x0 - 0x813CFBF, any address outside of this range is wrong for the base pointer.

Tools Required????
Programs Required????
- Ida Pro
- Il2CppDumper
- dnSpy
- noexes

Which CFW is Required - SX OS, Atmosphere???? Can both be used?
Atmosphere

How can Memory Dumps be made, and used for Pointer Searches????
Just search for something in noexes, it creates a *.tmp file, this file is your memory dump.
 

phonz

Well-Known Member
Member
Joined
May 1, 2018
Messages
279
Trophies
0
XP
1,882
Country
Canada
When you see [main-xxxxxxxx] the minus/negative means you are searching in an area thats not in Main.
Which won't get you anywhere if you are looking for a pointer.
The base address for the pointer has to be in memory that isn't dynamic (IE Main) or else it won't work.

When you create your memory dump you should restart your search, Select the Start (and pointer start)/Stop point of the main memory in the tools tab.
Then search for whatever you want to create the dump of that area, AND then (in my experience) hit restart one more time and that pops the dumped ram into a file (I think its a .bin or .dat? or .tmp? in the tmp folder).

Jnoexs is pretty limited though as it will NOT search beyond 2 pointers deep.
In those cases you can manually try and map your way through the RAM using something like SXOS RAM viewer, but that will take some time.

There is @BullyWiiPlaza universal pointer searcher tool as well, but I'm not entirely sure jnoexs dumps work with it?
Switch memory registers are 64bit I think (000000XX XXXXXXXX), and I'm not sure how his tool handles that. But it's actively updated so maybe it likes switch memory dumps now *shrug*

Hope this clears some things up for yeh.

PS. I didn't write that tutorial, credits go to @talixme . I just re-upped the images.
I often reference it and repost it because it's pretty straight forward and easy to understand.

I might recommend EdiZone/WerWolv's discord server if you need any questions answered regarding EdiZone cheat creation.
And IIRC, @WerWolv was looking into attempting to create a pointer searcher in his tool.
He already has a *void search which I think? will let you search for a vlaue without alignment (ie, not 8/16/32/64 bit). Which can be helpful when you are manually trying to navigate RAM for pointers. But I don't think there is a memory viewer yet.
 
Last edited by phonz,

Smoker1

Well-Known Member
OP
Member
Joined
Feb 17, 2015
Messages
5,066
Trophies
1
Location
California
XP
6,145
Country
United States
@phonz - Yeah I was looking around, saw it was from someone else, forgot who, so I just put you sharing it. Yeah, I looked up the UPST, but was wondering if it worked with the Switch Memory. I asked the Dev, but have had no Reply yet.
Well WerWolv is away for Schooling, last I heard, but I know there have been occasional work done on the GitHub Page, so there may be intermittent Work being done on Free Time. Just cant wait till the Unknown Search is improved upon (currently, you need to know the Value).

@Falo - PC Engine????? Damn. Only knew it was for Arcade and SNES.
Odd thing is, when I Search for Inf Time, that is the only Address that I end up getting eventually in EdiZon. At first there are a couple of BASE's and a few MAIN's, but then by the 3rd, they go away and I am left with a load of HEAPs. Is there any difference between Signed or Unsigned Results? And the Ending 3 Digits match the MAME Cheat File, also.

Is there any reason why netCheat will not Connect, even when JNoexs will?

--------------------- MERGED ---------------------------

Oh, I did do one suggestion, but instead of doing the Pointer Search in MAIN, I was told to try in just the HEAP Sections. I did get the Code Builder to accept those, but none of them worked, but I had the same problem with the Address/Offset Issue, where it thought the end of the Address was supposed to be the Offset.
 

BullyWiiPlaza

Nintendo Hacking <3
Member
Joined
Aug 2, 2014
Messages
1,932
Trophies
0
XP
2,477
Country
Germany
There is @BullyWiiPlaza universal pointer searcher tool as well, but I'm not entirely sure jnoexs dumps work with it?
Switch memory registers are 64bit I think (000000XX XXXXXXXX), and I'm not sure how his tool handles that. But it's actively updated so maybe it likes switch memory dumps now *shrug*
Yes, it does. I worked together with 2 people wanting Switch support. :)

You can put 64-bit addresses and you need to specify the address size to be 8 bytes for better efficiency. And especially consider the module dumps mode since there are modules on Switch. This is very similar to Windows so I could implement both for the price of one kinda.

Link:
https://github.com/BullyWiiPlaza/Universal-Pointer-Searcher

Let me know.
 
Last edited by BullyWiiPlaza,

Smoker1

Well-Known Member
OP
Member
Joined
Feb 17, 2015
Messages
5,066
Trophies
1
Location
California
XP
6,145
Country
United States
How would that work with EdiZon, though? From the Addresses JNoexs was giving me, they are a little different.
FH Time Address in EdiZon
[ HEAP + 0x00038659E5 ]

For JNoexs, the 0s would have a Number for it like the examples, unless EdiZon just removes those, same with SX OS Cheat Engine.

Also, I am basically going off of what I am reading from the EdiZon Search info.....
Set the memory region you want to search in. HEAP contains dynamically allocated values and will be where the majority of the values worth changing will be found. MAIN contains global variables and instructions for game operation. You may find some values here but it's mainly for finding pointers to HEAP values or changing game code. RAM will search the entirety of the Games used memory including memory shared memory and resources. Should only be used as a final resort as this will be extremely slow.

I am wondering what BASE is, because I got that for 1 Game, forgot which.
 
Last edited by Smoker1,

phonz

Well-Known Member
Member
Joined
May 1, 2018
Messages
279
Trophies
0
XP
1,882
Country
Canada
How would that work with EdiZon, though? From the Addresses JNoexs was giving me, they are a little different.
FH Time Address in EdiZon
[ HEAP + 0x00038659E5 ]

For JNoexs, the 0s would have a Number for it like the examples, unless EdiZon just removes those, same with SX OS Cheat Engine.

Also, I am basically going off of what I am reading from the EdiZon Search info.....

I am wondering what BASE is, because I got that for 1 Game, forgot which.

Jnoexs shows the raw address basically, while things like SXOS/EdiZone generally only show HEAP+32bit, or MAIN+32bit, UNLESS it's a BASE address.
HEAP and MAIN tell Edizone/SXOS what to add to the 32bit address to get the full RAM location.
Base addresses are pretty much completely dynamic, so it would show the full address.

... Is there any difference between Signed or Unsigned Results? And the Ending 3 Digits match the MAME Cheat File, also.
Signed values allow for both positive and negative value associations.

ex. Decimal -21 == signed HEX 0xFFEB
but unsigned HEX 0xFFEB = Decimal 65515
 
Last edited by phonz,
  • Like
Reactions: Smoker1

phonz

Well-Known Member
Member
Joined
May 1, 2018
Messages
279
Trophies
0
XP
1,882
Country
Canada
Yes, it does. I worked together with 2 people wanting Switch support. :)

You can put 64-bit addresses and you need to specify the address size to be 8 bytes for better efficiency. And especially consider the module dumps mode since there are modules on Switch. This is very similar to Windows so I could implement both for the price of one kinda.

Link:
https://github.com/BullyWiiPlaza/Universal-Pointer-Searcher

Let me know.

@BullyWiiPlaza
Universal Pointer Searcher doesn't seem to like 64bit Starting Addresses.
Is this intentional?

64bit_starter.png
 

BullyWiiPlaza

Nintendo Hacking <3
Member
Joined
Aug 2, 2014
Messages
1,932
Trophies
0
XP
2,477
Country
Germany
@BullyWiiPlaza
Universal Pointer Searcher doesn't seem to like 64bit Starting Addresses.
Is this intentional?

64bit_starter.png
This is actually a bug but you should use the "Add Module Dumps Folder" option to add a folder containing all modules:

upload_2019-9-26_14-29-40.png

upload_2019-9-26_14-30-18.png


Furthermore, I fixed the starting address size bug and did a few minor other fixes. You can download the newest version from the same link once again.
 
Last edited by BullyWiiPlaza,
  • Like
Reactions: Smoker1 and phonz

phonz

Well-Known Member
Member
Joined
May 1, 2018
Messages
279
Trophies
0
XP
1,882
Country
Canada
This is actually a bug but you should use the "Add Module Dumps Folder" option to add a folder containing all modules:


View attachment 180659

Furthermore, I fixed the starting address size bug and did a few minor other fixes. You can download the newest version from the same link once again.

Awesome thanks.

Can I ask what tool you used to dump all the Nintendo Switch RAM into their segmented chunks like that?
Technically you could do this with something like Jnoexs, but you would have to do it manually as far as I know and that would, in some cases, take and hour or two.
Or is that image a dump from anotehr device/PC?

Thanks again, @BullyWiiPlaza
Love your work.
 
  • Like
Reactions: BullyWiiPlaza

BullyWiiPlaza

Nintendo Hacking <3
Member
Joined
Aug 2, 2014
Messages
1,932
Trophies
0
XP
2,477
Country
Germany
Awesome thanks.

Can I ask what tool you used to dump all the Nintendo Switch RAM into their segmented chunks like that?
Technically you could do this with something like Jnoexs, but you would have to do it manually as far as I know and that would, in some cases, take and hour or two.
Or is that image a dump from anotehr device/PC?

Thanks again, @BullyWiiPlaza
Love your work.
Thanks. :)
The user @tastymeatball told me the following in a private message:
edit: rewrote my Ram Dumper so that now heap memory regions which are directly behind each other are combined in one file. So Smash only creates about 100 files.
I'm not sure if this tool is posted or anything, I only got the memory dumps from him so I could test and develop my pointer searcher based on these.
 
  • Like
Reactions: Stoned and phonz

Gamerjin

Well-Known Member
Member
Joined
May 25, 2016
Messages
2,836
Trophies
1
XP
6,563
Country
United States
so, i dont know if this question is already answered from the different device part:
does this include the RAM dumper used in sxos?
 

phonz

Well-Known Member
Member
Joined
May 1, 2018
Messages
279
Trophies
0
XP
1,882
Country
Canada
SXOS dumps it all into a single file and i think it just includes MAIN+HEAP (whatever the game sees).
But main can also extend into subsdkX, and I'm not entirely sure SXOS dumps those parts? It should in theory though.
https://switchbrew.org/wiki/ExeFS
But I don't think I've ever seen them mapped in SXOS Memory Viewer. It might be that they just group it with Main though.
 
Last edited by phonz,
  • Like
Reactions: Smoker1

Stoned

Well-Known Member
Member
Joined
Mar 26, 2014
Messages
2,766
Trophies
2
Age
45
XP
4,458
Country
Germany
Thanks. :)
The user @tastymeatball told me the following in a private message:

I'm not sure if this tool is posted or anything, I only got the memory dumps from him so I could test and develop my pointer searcher based on these.

He Shared his tool whit me, and i will try my Luck in Combination whit your Pointer tool. :)
 
  • Like
Reactions: DaBlackDeath

Gamerjin

Well-Known Member
Member
Joined
May 25, 2016
Messages
2,836
Trophies
1
XP
6,563
Country
United States
ok, so next question:
in the sample picture the target is 10 digits long, however, i cant use 10 digits in the RAM viewer in sxos. are the extra 2 digits needed? if so, how can i find them in sxos?
 

Smoker1

Well-Known Member
OP
Member
Joined
Feb 17, 2015
Messages
5,066
Trophies
1
Location
California
XP
6,145
Country
United States
OK, so I am getting a SX Os Pro (Dongle/Jig), and wondering if the Memory Dump will work with HxD to find Pointers in the Dump? Or, if there is a way to get TempAR to compare Dumps, especially if the Pointer I need is for say 8,16, or 32Bit.
 

phonz

Well-Known Member
Member
Joined
May 1, 2018
Messages
279
Trophies
0
XP
1,882
Country
Canada
aye, 10 digits. You need to search for a 64bit value if you are searching the memory manually.
It will be 000000XX XXXXXXXX.
The first two XX digits kinda tell you what part of the ram its looking in.

If you are using SXOS, you can browse through memory regions manually and SXOS will automatically parse these 64bit addresses into MAIN/HEAP+XXXXXXXX (you can disable this feature though). It does this because the switch is kinda dynamically allocates where it stores MAIN and HEAP.
So it uses the base address for heap/main and adds it to XXXXXXXX for the actual RAM location.
BASE addresses is just a straight up full RAM address + 0x8000000 (I think, don't quote me on that one).
Just remember though, if you are manually stepping through the ram, the numbers are little endian. But I imagine everyone in this topic is already aware of that.

Hopefully @tastymeatball publishes his tool. The more software options available the better.
Until then, Jnoexs has been treating me well enough. I have yet to try dumping memory from Jnoexs into different hunks and comparing with UPS. Hopefully that works and I can deal with 2+ level pointers a little easier xD.
I've manually stepped backwards through some Jnoexs pointer results and they lead me to completely incorrect addresses. Not sure why it includes those in it's results.
 

wiitendo84

Well-Known Member
Member
Joined
Jan 3, 2014
Messages
1,394
Trophies
2
Age
40
Location
New Albany, Indiana
XP
3,811
Country
United States
So I'm using the tool tastymeatball made. I got everything as far as what is needed but it still doesn't find any pointers...I put the address for health in for the address. I've changed the address size to 8. But it seems like it can't find any pointers whatsoever for the game. Was wondering if there was something I did wrong as far as setting the universal pointer searcher up. Using the modules option. All of the bin files are in there. Any suggestions @BullyWiiPlaza
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • Xdqwerty @ Xdqwerty:
    @PandaPandel, I might be either that or pansexual
  • Xdqwerty @ Xdqwerty:
    I mean, I do like femboys
  • PandaPandel @ PandaPandel:
    i am bi/pan
    i am just dumb gorl
    +1
  • PandaPandel @ PandaPandel:
    @K3Nv2 what have i done
  • Xdqwerty @ Xdqwerty:
    @PandaPandel, dont worry other girls enter chat relatively frequently
  • BigOnYa @ BigOnYa:
    @K3Nv2 is secretly really a girl also
  • Xdqwerty @ Xdqwerty:
    @BigOnYa, we just need to crack his egg
    +1
  • PandaPandel @ PandaPandel:
    i support egg cracking
    +1
  • Xdqwerty @ Xdqwerty:
    the two eggs he has down there
  • Xdqwerty @ Xdqwerty:
    either that or the lgbt slang
  • K3Nv2 @ K3Nv2:
    @BigOnYa, wishes I had a vagina
    +3
  • BigOnYa @ BigOnYa:
    I do, but its ok. One of these days, you may get lucky and experience what one feels like.
    +1
  • K3Nv2 @ K3Nv2:
    That's silly urewife calls me bigjim
    +2
  • K3Nv2 @ K3Nv2:
    91° F that
    +1
  • Xdqwerty @ Xdqwerty:
    @K3Nv2, 91 fuck that?
  • BigOnYa @ BigOnYa:
    Yep 89 here today, supposed to be 96 tomorrow. Good days to stay inside AC and play video
    games.
  • K3Nv2 @ K3Nv2:
    You get heat from weed
  • BigOnYa @ BigOnYa:
    Yea in the winter, I throw bricks of weed in my fireplace to keep warm, and it adds a nice scent in the air.
  • K3Nv2 @ K3Nv2:
    Just a brick?
  • BigOnYa @ BigOnYa:
    Translate the whole video for us...
  • K3Nv2 @ K3Nv2:
    Something about family guy
  • Xdqwerty @ Xdqwerty:
    @BigOnYa, it has the auto captions
  • BigOnYa @ BigOnYa:
    But the captions are in english, I only speak Ebonics
    +1
  • BakerMan @ BakerMan:
    i made myself a pizza today, that shit was mid
    BakerMan @ BakerMan: i made myself a pizza today, that shit was mid