Pokemon distro carts "hacking"

Discussion in 'NDS - ROM Hacking and Translations' started by Aurora Wright, Feb 22, 2010.

Feb 22, 2010
  1. Aurora Wright
    OP

    Member Aurora Wright GBAtemp Maniac

    Joined:
    Aug 13, 2006
    Messages:
    1,388
    Country:
    Italy
    Since there was no such guide yet, I decided to make one.
    This covers all of the ROMs out until now [​IMG]

    What you need:
    - The distro ROM (illegal to ask, Google is your friend) [​IMG]
    - The pcd file(s) of the WonderCard(s) you want to inject
    - An Hex Editor (I use UltraEdit on Windows)
    - dslazy

    General steps:
    1) Open the ROM with dslazy and unpack it.
    2) In the dslazy folder you will now have a NDS_UNPACK folder
    3) Do the necessary modifications with the Hex Editor to arm9.bin and the files in /data (find the specific ROM instructions below)
    - The "GGID" is a 4 bytes value that determines the region of the carts that can communicate with the distro ROM.
    - The date limit (based on your DS's internal date) determines when the distribution is available
    - The WonderCard contains a "mystery gift" for the receiving cartridge. You can edit it with Pokemon Mystery Gift Editor or Pokesav.
    4) Repack the ROM and enjoy!

    Deoxys/Dragonite American distro ROMs:
    These are the easiest to "hack".
    - WonderCard file: data\data.bin.
    - The GGID is in data\ggid.dat.
    - The date limit is in data\limit.bin. The first 4 bytes represent the starting date (YY00MMDD) in hex format (you can just replace them with 00000000), the remaining 4 are the ending date (replace them with FFFFFFFF).
    - Unused files: data\decchi.bin, data\debug.lz

    Shaymin European distro ROM:
    This one actually contains 5 WonderCards and 5 GGIDs, one for each language. A different GGID and WonderCard will be used depending on your DS's language.
    - WonderCard files: data\en.bin, it.bin, fr.bin, sp.bin, ge.bin
    - arm9.bin contains both the date limit (in hex format) and the 5 GGIDs, here are the offsets:
    Code:
    0xCAC - Year (2009)
    
    0xCB4 - Starting month (March)
    0xCC0 - Starting day (24)
    0xCCC - Ending month (June)
    0xCD8 - Ending day (25)
    
    0xD94 - English GGID
    0xD70 - French GGID
    0xD7C - German GGID
    0xD84 - Italian GGID
    0xD8C - Spanish GGID
    So, it's impossible to achieve an "unlimited" distribution, you can make it last a year maximum.
    - Unused files: data\decchi.bin, data\debug.lz, data\data.bin, data\limit.bin, data\ggid.dat

    Pichu+Jirachi American dual distro ROM:
    The ROM contains two different WonderCards (it chooses between them depending on the DS date), and obviously only handles one GGID.
    - WonderCard files: data\p1.bin, p2.bin
    - arm9.bin contains both the date limit (in hex format) and the GGID, here are the offsets:
    Code:
    0xC18 - (English) GGID
    
    1st WonderCard (p1.bin):
    
    0x14E4 - Year (2010)
    
    0x14EC - Starting month (January)
    0x14F4 - Starting day (23)
    0x1500 - Ending month (February)
    0x1508 - Ending day (15)
    
    2nd WonderCard (p2.bin):
    
    0x152C - Year (2010)
    
    0x1534 - Starting month (February)
    0x150C - Starting day (20)
    0x1548 - Ending month (March)
    0x1550 - Ending day (14)
    It's impossible to achieve an "unlimited" distribution for this one too, you can make it last two years (one for each WonderCard) maximum.
    - Unused files: data\decchi.bin, data\debug.lz, data\data.bin, data\limit.bin

    Arceus European distro ROM:
    5 WonderCards and 5 GGIDs in this ROM too, one for each language. A different GGID and WonderCard will be used depending on your DS's language.
    - WonderCard files: data\en.bin, it.bin, fr.bin, sp.bin, ge.bin
    - arm9.bin contains just the 5 GGIDs, here are the offsets:
    Code:
    0xD1C - French GGID
    0xD28 - German GGID
    0xD30 - Italian GGID
    0xD38 - Spanish GGID
    0xD40 - English GGID
    - The date limit is in data\limit.bin (again? [​IMG] ). The first 4 bytes represent the starting date (YY00MMDD) in hex format (you can just replace them with 00000000), the remaining 4 are the ending date (replace them with FFFFFFFF).
    - Unused files: data\decchi.bin, data\debug.lz, data\growtbl.narc, data\personal.narc, data\waza_tbl.narc, data\wotbl.narc, data\ggid.dat

    Editing the WonderCard files:
    - Open both the WonderCard ROM file that needs to be edited and the .pcd file.
    - Copy the 80 bytes 0x104 - 0x153 in the .pcd to 0x0 - 0x4F in the ROM file:
    Warning: Spoilers inside!
    - Copy the WHOLE .pcd to the remaining part of the ROM file (from 0x50 onwards):
    Warning: Spoilers inside!
    - Finally, fill the last 8 bytes of the ROM file with zeros:
    Warning: Spoilers inside!

    GGID list:
    Here are the GGIDs for all the client cartridges.
    Code:
    English: 18 03 40 00
    French: CD 00 80 00
    German: CE 00 80 00
    Italian: CF 00 80 00
    Spanish: D0 00 80 00
    Japanese: 45 03 00 00
    Korean: 18 00 C0 00
    Note: how to convert from decimal to hex (for dates).
    If you didn't know, you can do this easily with the Windows/OSX calculator. Just set the "scientific" (programmer in OSX) view, write something in decimal and click on "Hex", and it will output the date in hex [​IMG]

    Huge thanks to:
    - Chamillionaire for finding half of the GGIDs and for writing the original guide for the first distro ROM;
    - Kyohack for his independent research on the Arceus ROM, and for his automatic distro ROM editor
    .
     
    B4rtj4h likes this.


  2. mrgone

    Member mrgone GBAtemp Advanced Fan

    Joined:
    Nov 6, 2002
    Messages:
    728
    Country:
    Germany
    i'm not into pokemon at all,

    but thats a very nice guide

    [​IMG]
     
  3. TM2-Megatron

    Member TM2-Megatron Predacon Commander

    Joined:
    Feb 10, 2009
    Messages:
    1,187
    Location:
    Toronto, Ontario, Canada
    Country:
    Canada
    That's a great guide, and very useful. So its those GGIDs that determine the regionalization... that's good to know.
     
  4. Poryhack

    Member Poryhack GBAtemp Fan

    Joined:
    Oct 18, 2009
    Messages:
    330
    Country:
    United States
    How'd you find those offsets in arm9?

    Very handy btw.
     
  5. Aurora Wright
    OP

    Member Aurora Wright GBAtemp Maniac

    Joined:
    Aug 13, 2006
    Messages:
    1,388
    Country:
    Italy
    Trial and error, with some luck too [​IMG]
     
  6. Ammako

    Member Ammako GBAtemp Guru

    Joined:
    Dec 22, 2009
    Messages:
    6,372
    Country:
    Canada
    By the way, it isn't Darkrai distribution rom, it's Deoxys distribution rom.
     
  7. Poryhack

    Member Poryhack GBAtemp Fan

    Joined:
    Oct 18, 2009
    Messages:
    330
    Country:
    United States
    I was gonna say that as well. While there was a darkrai distribution, very few if any people have the ROM of it. The deoxys on the other hand was a scene release.
     
  8. Ammako

    Member Ammako GBAtemp Guru

    Joined:
    Dec 22, 2009
    Messages:
    6,372
    Country:
    Canada
    I believe the Darkrai distribution one was held in one of these big black cartridges that could only be read by debug units.
    I've read that in the European Shaymin NFO from DS-Scene.


    On a side note, would it be possible to edit the Deoxys distribution rom to remove all these ClearFlag and replace them with item names from Pt/HG/SS?
     
  9. Poryhack

    Member Poryhack GBAtemp Fan

    Joined:
    Oct 18, 2009
    Messages:
    330
    Country:
    United States
    The American darkrai given out at TRU was not on a developer card, but the European one apparently was.

    Not sure what you mean by "ClearFlag".
     
  10. Ammako

    Member Ammako GBAtemp Guru

    Joined:
    Dec 22, 2009
    Messages:
    6,372
    Country:
    Canada
    Really, it makes sense that the European Darkrai was on a developer card.
    After all, they talked about the Darkrai and Regigigas distribution rom on the European Shaymin NFO.

    As for ClearFlag, you know, when you put the Secret Key pcd file in the Deoxys Distribution rom, it will show up as "Distributing ClearFlag"?

    I can confirm the dual distribution cart shows "Distributing the Secret Key" when it got the Secret Key in it.
     
  11. mikeac

    Newcomer mikeac Member

    Joined:
    Sep 12, 2009
    Messages:
    14
    Country:
    United States
    --REMOVED LINK--
    I have a guide on how to make distro roms that CAN be unlimited. Just download my software bundle, I really didn't make the software though. It is still a noobish guide.

    EDIT: Still forgot to remove link, soz.
     
  12. Chamillionaire

    Member Chamillionaire GBAtemp Regular

    Joined:
    Nov 8, 2006
    Messages:
    175
    Country:
    Germany
    Bull.
    These black cartridges are flashcarts, they hold only one software though, to "simulate" normal cartridges as best as possible.
    Every DS can read them, not just debugs.
     
  13. Ammako

    Member Ammako GBAtemp Guru

    Joined:
    Dec 22, 2009
    Messages:
    6,372
    Country:
    Canada
    I actually got one question.

    What is the black screen with "Channel" on it for?
    I thought it was for version distribution...

    However, I have three different distribution roms that both can only distribute to Platinum.
    One of them show "Channel 1", one shows "Channel 7" and one shows "Channel 13"

    It's also worth mentionning that the roms I got that can distribute to D/P/Pt all show a different number, while the ones that can only give to D/P also show a different number. I did notice I only get "Channel 1", "Channel 7" and "Channel 13"
     
  14. Poryhack

    Member Poryhack GBAtemp Fan

    Joined:
    Oct 18, 2009
    Messages:
    330
    Country:
    United States
    It's just the frequency that the DS decides to broadcast at. It scans all the available channels on startup and chooses one with the least interference.
     
  15. TM2-Megatron

    Member TM2-Megatron Predacon Commander

    Joined:
    Feb 10, 2009
    Messages:
    1,187
    Location:
    Toronto, Ontario, Canada
    Country:
    Canada
    I'm just curious about something... in PCDs that've been ripped from save files, obviously the field for "date recieved" is going to have a value. But in the actual distro cart, the value is zeroed out (waiting until it's injected into a game to acquire one, I guess). Do you think it's necessary to zero this value again when patching a new PCD into a distribution cart?
     
  16. Poryhack

    Member Poryhack GBAtemp Fan

    Joined:
    Oct 18, 2009
    Messages:
    330
    Country:
    United States
    Try it if you really must know. All the editing guides I've seen have said to zero it.
     
  17. Morfeo

    Newcomer Morfeo Newbie

    Joined:
    Mar 6, 2010
    Messages:
    6
    Location:
    México
    Country:
    Mexico
    [english]
    Hello, thank you very much for posting this. For days I was looking for this.
    With regard to hacking the ROM of European Shaymin I can only doubt and I wonder if they have the answer.

    I'm trying to replace the "ggid" Italian for "ggid" Japanese, so in this way can distribute the Wonder Card to Japanese version, which has already successfully achieved. But to distribute to Japanese versions, I have to change the language of NDS into Italian.
    The question is: Is there any way to modify the ROM to indicate that if the NDS has selected the Japanese Language, Wonder Card that can be distributed to Japanese versions without changes in Italian language?

    I hope you can respond and there is some way. In advance thank you very much

    P.D. Sorry for my bad English, but I speak Spanish and helped me with a translator


    [spanish]
    Hola, muchas gracias por publicar esto. Hace días que lo estaba buscando esto.
    En relación al hackeo del ROM de Shaymin Europeo solo me queda una duda y quisiera saber si tienen la respuesta.

    Estoy tratando de sustituir el “ggid” Italiano por el “ggid” japonés, para que de esta forma pueda distribuir la Wonder Card hacia versiones Japonesas, lo cual ya logre con éxito. Pero para poder distribuir hacia versiones japonesas, tengo que cambiar el idioma del NDS al italiano.
    La pregunta es: ¿Hay alguna forma de modificar el ROM para indicar que si el NDS tiene seleccionado el Idioma Japonés, pueda distribuir dicha Wonder Card hacia versiones japonesas sin tener que cambia en idioma Italiano?

    Espero que ustedes me puedan responder y exista alguna forma. De antemano muchas gracias

    P.D. Perdón por mi mal Ingles, pero yo hablo Español y me ayudo con un traductor
     
  18. pokefan92

    Newcomer pokefan92 Advanced Member

    Joined:
    May 29, 2009
    Messages:
    78
    Country:
    Spain
    It would be a good Idea Morfeo, but I think it is part of the structure of the rom and It can't be changed... It's like we wanted to make the previous years, making it region free... I think we should have to wait... But there is one thing I think it could be interesting. Shaymin Distribution Cart has 5 WCD... What if we put it 6? (The Japanese one). Between every GGID there are unknown values:
    C0 76 02 02 24 74 02 02
    2C 74 02 02
    34 74 02 02
    3C 74 02 02
    44 74 02 02

    So, i Think that if we put here the japanese GGID and then we add 4C 74 02 02, it should recognise japanese versions! Then, we only have to put the jp.bin, and that's all! What do you have to say? Do you think it is possible? Thanks in advance

    Español [Para ti, Morfeo xD]
    Lo que dices seria buena idea, pero creo que, al formar parte de la estructura del juego, es como el Region Free en lo del Deoxys, habria que esperar a que saliera una nueva Rom cuya estructura este preparada para ello... Aun asi tengo una idea.... ¿Porque no le metemos la sexta wondercard a la japonesa? Si fijas, hay una similitud entre esos valores desconocidos que hay entre cada uno de los GGID del arm9.bin

    C0 76 02 02 24 74 02 02
    2C 74 02 02
    34 74 02 02
    3C 74 02 02
    44 74 02 02

    Pues he pensado, que si despues de esto le metemos la GGID japonesa y le ponemos 4C 74 02 02, reconoceria juegos japoneses sin tener que quitar el italiano!!!! Despues habria que crear uno que fuera el jp.bin, y listo [​IMG]. Bueno, dime, como lo ves tu?
     
  19. Chamillionaire

    Member Chamillionaire GBAtemp Regular

    Joined:
    Nov 8, 2006
    Messages:
    175
    Country:
    Germany
    You guys should try that [​IMG]
     
  20. Poryhack

    Member Poryhack GBAtemp Fan

    Joined:
    Oct 18, 2009
    Messages:
    330
    Country:
    United States
    Those "unknown values" seem to be some kind of offset for the wondercard files (en.bin, etc). When I messed with them and went to download the wondercard onto Diamond I saw that it was trying to retrieve the wondercard title from somewhere that there wasn't one (it appeared on diamond as a bunch of garbled characters).

    I have a feeling there's more to it then this anyway. Everything about this ROM is pretty much hard-coded; you'd have to also find and edit the part that loads the bin files, and probably the part that reads the language settings from the DS's firmware (I'm pretty sure this isn't it).

    I did notice one interesting and potentially useful thing when I was messing around though. When the ROM peeks at the DS's language settings it's looking for either French, German, Italian, Spanish, or English. When it doesn't find any of those (aka when it's set to Japanese) it falls back to English. What this means is that you can replace the English GGID with the Japanese one and you will be able to distribute to Japanese clients with the DS language set to Japanese. The only downside to this is that you lose functionality with English clients. Morfeo was willing to lose functionality with Italian clients, so I can't imagine English would be much worse.
     

Share This Page