pointer searching with Breeze

[TomSwitch]

This guide has aged and the menu is now quit different. Here is a new guide.

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

. Here is the latest members only that the guide is based on.

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

Now all you have to do with simple menu in beta88 is to just press "Pointer Search" on a bookmark, adjust the parameters if required then "Start pointer search"


PS: If you are the first few who download beta88 please re-download. I revised beta88 just minutes after first release. Decided to bring pointer search button to bookmark menu and add some short cuts to pointer search menu

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

Here is a step by step guide on pointer search using this version

First search for the target the usual way(Normally is what you see is what you search. Change value, search again, repeat until found). Go to memory explorer. With the cursor on the target press "MoveRight" (ZL+Y)



You will be prompted to enter a name, after that a depth=0 node with this name will be added as a current target for jump back search and you will be in JumpBack menu. You can go back and add more nodes. "Name=" button let you change the name of the latest addition. Bookmark that leads to depth=0 node will have this name. You can do pointer search for many targets in parallel.


In this example two targets "ammo" and "hp" were added. Pressing "Start" button will start the -1_scan which search for pointers that will lead to these nodes within the range specified by "search_range". When the scan is complete you will see the number of source that points to these targets. There are 6 source address having pointers that points to ammo and 3 source address having pointers that points to hp.

Pressing "Analyse" on the ammo node brings you to this screen. Here you see the break down on the 6 source addresses. d= is the distance between what the pointer points to and the target (the offset). You will not see anything larger than 0x800 as that was set as the limit of the search, you can set this limit to be as large as 0x4000. "d=218 694152f6d0 1 69c153be08" means the address 694152f6d0 is pointed by 1 pointer located at address 69c153be08 and the distance between 694152f6d0 and 694152f8e8(ammo) is 218. d=228 has 21 sources, this means it is very popular and you would want to make sure this line is being taken for the next step. "num_offsets=" button let you set how many of these offsets are used for transition to the next depth (jumping back). =3 means only the first three will be taken when you press "next depth"


Now the list of targets has been expended to 299. That is the sum of all the sources taken from 3 offsets (as specified before you press "next depth"). Now your depth is 1, you have jumped back one level towards the ultimate source(main)


Pressing "Start" will scan for sources to these targets within the range set by "search_range".


Pressing "next depth" takes the sources of first 3 offsets(num_offsets=3) of each target notes and make them the new targets. Now you are at depth 2 and have 4524 targets. "BM 4" on the status line means you have now found four pointer chain that will take you from main to either "hp" or "ammo". These have been added as four bookmarks. Use "Bookmark menu" if you want to take a look at these four.


Here you can see that four pointer chains were found for hp and the depth of the pointer chain is 2.
You may want to select a bookmark file that isn't already cluttered with previous search before you proceed.
You can also switch bookmark file anytime during the search and the newly found will be send to that file.
You can go "Back" to find more

Here you are at depth 4 and 2318 pointer chains had been found. You need to keep watch of the number of targets before you go "next depth". This app has no check before consuming memory and when you run out of memory your Switch will crash.
How big you can go will depend on the game and the setting you have for "num_offsets" and "search_range".

Now at 147826 it is very likely to cause a crash if you go next step by consuming all the memory available to applet. If may crash earlier even depending on actually how many sources were found by the scan.

I have set the limit of depth to 7. You are not allowed to go further.

If you want BM of one more depth when you reach the limit of either memory or depth of 7 you can use "get depth+1 ptr"

If you press "do B8 scan" it will set the next offset to B8 and find pointers that would reach main. These pointer will be of depth +2 but will be limited to the next offset being B8. (usually for unity game B8 is something special)

If you want to go to a certain depth without changing the setting of "num_offsets" and "search_range" between depth you can use "search_depth=" and "Goto depth" as a one step solution. No need to keep pressing "Start" and "next depth" to get there.

If you press "next depth" without pressing "Start" it will do "Start" then "next depth" for you.

The progress is preserved when you exit the JumpBack menu but not when you exit Breeze. You can re-enter JumpBack menu from the main menu. If you want to start from scratch exit Breeze.

Not all of the bookmarks will be good over time. You need to play the game a bit, reload a few time and check which one are good. You can use "Check pointers" to get rid of those that are not able to resolve to valid address and "SearchBookmark" to find those that are pointing to the correct value. "SearchBookmark" will ask where you want to results found to go, you are recommended to use a new bookmark file.

When you are happy with a bookmark you can use the "Bookmark to Cheat" button to create a cheat code.


Below is older post which has since been superseded by above:

Here is what the "Select" and "Analyse" buttons do. You can use it for every depth to peek into the landscape if you wish.


When you press "Select" it will take to memory explorer to look at what around 3f79c98ef0. If you press "Analyse" it will let you analyse those 40 potential next depth targets.


Pressing "Select" will take you to memory explorer to look at memory region of next depth target 3f79c98ed0.
d=20 means 0x20 is the distant to current depth target. There are 5 sources pointing to address 3f79c98ed0 and the first 3 is listed next. "Analyse" let you take a closer look at the 5. "num_offsets=2" means only the first two lines of this list will be used for next depth. 5+2 next depth targets will be added due to this current depth target you are analysing. If you change it to 3 then 5+2+2 will be added and so on.

"Select" will take you to memory explorer. "Analyse" has nothing further to do.





Below is older post which has since been superseded by above:

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

Calling users of Breeze who do pointer searcher on PC to give it a try, be warn that you may get crash.

Please provide feedback here

If you have existing pointers that you can try it on please do and let me know if you are able to locate it with Breeze


Upon entering you see a list of targets for manual exploring of jump back.
To do automated pointer search press R.
Target size is the current target the tool is searching for source to, BM 20 means 20 bookmark has been added. These bookmark need to be checked to see if they are the real pointers

As with PC pointer search going to aggressive with depth will generate a lot of candidates. Currently there is no feedback on progress when adding bookmark so you can see Breeze freeze for a while. ( it's either working hard or crashed, you can't tell until some time, please let me know how far it can go and how long you waited. I got 30+K bookmark once )

I try to push for fast with limited memory and it can run out of memory and crash.

Post automatically merged: Oct 27, 2023

Need people with known good pointers to check if there are holes in the algorithm that would let them escape

 

[dsrules]

speed depends on the game, on 1 game depth 3 might only have a few results
on another game , it might have thousands of results

this took less than a min to find


btw, how do you remove redundant bookmark results? choose To Delete only marks them To delete, doesn't get rid of them upon relaunch Breeze
also choose Add bookmark in JumpBack Menu crashes Atmosphere

update: Super Mario Wonder coins, depth 7, took around 80-90 seconds to save 2880 bookmarks
total process took a little bit over 2mins, which is very good speed for this game

 

[dsrules]

@TomSwitch , just had 2 crashes on the same game when using R Jumpback
searching for depth 5 crashes at 9x% BM 140



searching for depth 5 , froze at 100% BM 20 then crashes after a minute or so


Update: failed 4 times, not able to survive depth 5 search on this game, so have to go with the traditional way (memory dump and pointer searcher se)
https://gbatemp.net/threads/cheat-codes-ams-and-sx-os-add-and-request.520293/post-10279039

 

[TomSwitch]

did you try 84i, that is more restrictive so will have fewer results ( right now I am collecting more data than needed so potential of not doing and extend the depth )

I will make use of forward search in future release, each step in either direction expand exponentially and memory limit when running as an applet will limit the depth it can go, by meeting half way it may mean multiplying the depth by 2

did the crash come after reaching more than 90% ? if it is may be the bm output routine is overwhelmed, which is something that I have not optimized.

I will be away for about 20 days during which can only talk. After that will come back to making pointer search on Breeze.

I have a feeling that I can make it much better than pointer searcher se ( other than the brute force part which an applet on Switch can never match any PC )

I could improve the PC search but have no desire to do so. It is IMO good enough. I want Switch to match the typical use case and go beyond to provide for those game value that don't have a pointer that originate from main. For these it is impossible to get good pointer from main because the game never had one. To have something that a pointer from main don't exist is very easy to create and I could if I wasn't lazy to have non of the class instant in Breeze to have pointer from main. ( Just have to pass the pointer around ). It is actually not good practice to use global ( but oh so lazy and nice until it bites ). I wrote most of the menu in Breeze to be chain-able, the example that is frequently used to chain is the memory explorer menu, you will never find a main pointer to that menu as I will never assign an instant of it to any global. main menu has a global but then the chain from main menu to the other menu will not be consistent so you will end up with a unreliable pointer chain and you can get to something in the memory explorer menu when you search but then you can't rely on it

In C++ there is "this" which is the pointer to the class instant, Jump back to find "this" would be the goal. If "this" to say a class call inventory is found then hacking inventory is easy, if "this" to a class call enemy is found then you can do anything to enemy. But how to jump back from enemy HP to it is the challenge. The good news is there is normally multiple enemies, so all of them should all JumpBack to this class that have a list of all the enemies but not the heroes.

on this screen https://gbatemp.net/attachments/2023102709150200-ccfa659f4857f96dda29afedb2e166e6-jpg.401238/
popularity is a number of interest, it shows how many pointer points to this target location and high surely makes it more likely to be something important. Unfortunately the converse is not true, can't ignore something that has only one, at lease not for blanket search. Distance is another number of interest, the further away the higher chance that it wasn't related but just happen to be adjacent. One of them is likely a "this" and I can only guess it is the d=188 but with only this screen it is hard to tell. JumpBack and find "this" a few times and you will hit the jackpot ( the only question is how to identify the "this" ).

 

[dsrules]

had 4 crashes, 3 were at 9x% and 1 at 100%
somehow, this time, 84h was able to complete the depth 5 search after searching with 84i then switch to 84h
with 84i Fond 270,949 BM 4248 and 84h Fond 306,741 BM 9136

I guess, the crash was caused by too many results found (no problem searching depth 7 on the first game where the address is in Heap and less than Fond 1000)
for address that are in Base, any pointer distance bigger than 0xb8 seems unreliable, 99% of the pointers that are not start with +B8 will likely to be bad pointers, able to adjust the distance might be 1 way to avoid some of the crashes

 

[TomSwitch]

had 4 crashes, 3 were at 9x% and 1 at 100%
somehow, this time, 84h was able to complete the depth 5 search after searching with 84i then switch to 84h
with 84i Fond 270,949 BM 4248 and 84h Fond 306,741 BM 9136

I guess, the crash was caused by too many results found (no problem searching depth 7 on the first game where the address is in Heap and less than Fond 1000)
for address that are in Base, any pointer distance bigger than 0xb8 seems unreliable, 99% of the pointers that are not start with +B8 will likely to be bad pointers, able to adjust the distance might be 1 way to avoid some of the crashes

Thanks for testing. In Beta94j I have re-arranged the sequence of update so now you get to see 100% complete before it goes into BM scan. Now can tell if it gets to 100% or not so we can tell if it was the BM process or the scan that crash.

Next I will work on showing progress in the BM process so can tell if it hang or is just very busy.

 

[dsrules]

Thanks for testing. In Beta94j I have re-arranged the sequence of update so now you get to see 100% complete before it goes into BM scan. Now can tell if it gets to 100% or not so we can tell if it was the BM process or the scan that crash.

Next I will work on showing progress in the BM process so can tell if it hang or is just very busy.

84j 100% 0 Fond 346,934 Target Size 1600, BM 4
Search Completed, Fond 346,934
been stuck there for 8+ mins,
84h Fond 355k instant crashes while still counting up, I guess Fond 3xxK+ is not a safe number for now

 

[dsrules]

@TomSwitch, is it a bug or beta84 search and bookmark are not compatible with older versions? for example, after searching and adding bookmark with beta84, then open beta82 and go to Search Manager, all searches will be deleted, goto Bookmarks, all Bookmarks will be deleted. Samething if search and add bookmark with beta82 then open with beta84

also Jump Forward is still not fixed, still does a Jump Back instead

 

[TomSwitch]

@TomSwitch, is it a bug or beta84 search and bookmark are not compatible with older versions? for example, after searching and adding bookmark with beta84, then open beta82 and go to Search Manager, all searches will be deleted, goto Bookmarks, all Bookmarks will be deleted. Samething if search and add bookmark with beta82 then open with beta84

also Jump Forward is still not fixed, still does a Jump Back instead

Try the later 84, I changed and reverted the change with breeze file. Most things are stored in breeze file and when I change the formate the older files are auto deleted.

I added extra data in breeze file header and later squeeze those data by reducing the file name size

 

[dsrules]

Try the later 84, I changed and reverted the change with breeze file. Most things are stored in breeze file and when I change the formate the older files are auto deleted.

I added extra data in breeze file header and later squeeze those data by reducing the file name size

yeah, already tried 84j 84k, Jump Forward broken since beta83, thats why need to use beta82 to use jump Forward

Post automatically merged: Nov 12, 2023

@TomSwitch , somehow now Jump Forward is working on beta84, tested on 5 different games, so not sure what happened
before it didn't work, that's why I switched to beta82

 

[dsrules]

got a Fond 540+k BM 0 and no crash

 

[WiduraGoez]

I have Been use This JumpBack Menu for creating Cheat code..Its awesome.....It works with Naruto x Boruto game and Other games...Of Course I m still new in this Creating cheat..But sometimes..it make crash when im look after the depth of 7...Like in Jojo Bizzare game..I found the address..but using the jumpback menu..still not found the bookmark untuk depth of 7..after that it crash....so can you help....Also when i searching for the address for some health.....first I find the first Adress that match..but second time I restart the game..The address not working anymore..so I search it again...and found different address....I restart Again..not working again..can you help..How to Find the correct Address.....I'm sorry My Post Is too long..but im still learning to make a cheat code..so there is a lot of stuff that I need to learn..thank you very much for your concern and help

 

[TomSwitch]

I have Been use This JumpBack Menu for creating Cheat code..Its awesome.....It works with Naruto x Boruto game and Other games...Of Course I m still new in this Creating cheat..But sometimes..it make crash when im look after the depth of 7...Like in Jojo Bizzare game..I found the address..but using the jumpback menu..still not found the bookmark untuk depth of 7..after that it crash....so can you help....Also when i searching for the address for some health.....first I find the first Adress that match..but second time I restart the game..The address not working anymore..so I search it again...and found different address....I restart Again..not working again..can you help..How to Find the correct Address.....I'm sorry My Post Is too long..but im still learning to make a cheat code..so there is a lot of stuff that I need to learn..thank you very much for your concern and help

The pointer search is memory intensive and it gets bigger after each iteration. Wait for future release or use pointer searcher se.

 

[TomSwitch]

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

Please test and feedback. Now pointer search is simply jump back then next depth until you get some bookmarks added.

I expect it to find the same pointers as the PC version. I limited the depth to 7 on switch.

 

[dsrules]

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

Please test and feedback. Now pointer search is simply jump back then next depth until you get some bookmarks added.

I expect it to find the same pointers as the PC version. I limited the depth to 7 on switch.

for cheat address that are in Base region, is it possible to add a setting to Enable/Disable only add to bookmark when the 1st depth is B8?
9x% pointers found that doesn't start with B8 will fail, for example, just tested beta85 and found 4000+ BMs on depth 6, only 1 pointer begins with B8 works after a reboot

 

[TomSwitch]

for cheat address that are in Base region, is it possible to add a setting to Enable/Disable only add to bookmark when the 1st depth is B8?
9x% pointers found that doesn't start with B8 will fail, for example, just tested beta85 and found 4000+ BMs on depth 6, only 1 pointer begins with B8 works after a reboot

Thank you for the feedback.

Yes, it is possible, there are many fine tuning opportunities along the search, I will be considering adding options for next release. Right now there is only two options that affects the search, the number of offsets and the range, I will bring those two setting to the jump back menu for easier use, you can adjust them every depth of the search. I am also considering saving the previous depths, right now they are just discarded to save memory.

How long did Breeze take to clear the 4000+ bookmark? Between repeating the search by first trying with the B8 filter then repeat without when not found is it worth it?

There are many bookmarks that is almost immediately not valid, this is the case with PC search too but you don't get to see it as the import step already clear it.

 

[dsrules]

How long did Breeze take to clear the 4000+ bookmark? Between repeating the search by first trying with the B8 filter then repeat without when not found is it worth it?

clear? delete all bookmarks should be instant

 

[TomSwitch]

clear? delete all bookmarks should be instant

You don't want to delete without checking, how you know only one work? The one with B8 has a good chance but is not always the one

"Check pointers" will get rid of those that can't be resolved. "SearchBookmark" will find those that have the correct value

Post automatically merged: Dec 31, 2023

Pointer search on Breeze can be used to search for pointer chain that reside in main.
While it will add BM every step of the way it don't stop until it is 6+1.

 

[dsrules]

You don't want to delete without checking, how you know only one work? The one with B8 has a good chance but is not always the one

"Check pointers" will get rid of those that can't be resolved. "SearchBookmark" will find those that have the correct value

View attachment 411040

Post automatically merged: Dec 31, 2023

Pointer search on Breeze can be used to search for pointer chain that reside in main.
While it will add BM every step of the way it don't stop until it is 6+1.

I manually scan through 4000+ using page down on 1st, 12th, 23rd, etc.. and only found 1 result with good value after reboot and recheck the pointer a few times, so not sure what's the speed on Check pointers

 

[TomSwitch]

I manually scan through 4000+ using page down on 1st, 12th, 23rd, etc.. and only found 1 result with good value after reboot and recheck the pointer a few times, so not sure what's the speed on Check pointers

My patient will beak long before 4000. Try using that 2 buttons to narrow down and see whether you still want a pre-filter for the B8. Breeze can handle a few K import from pointer searcher SE so I would guess 4K won't be that much worst for my patient and for you surely no problem.