ROM Hack Pokemon distro carts "hacking"

[Aurora Wright]

Since there was no such guide yet, I decided to make one.
This covers all of the ROMs out until now

What you need:
- The distro ROM (illegal to ask, Google is your friend)

- The pcd file(s) of the WonderCard(s) you want to inject
- An Hex Editor (I use UltraEdit on Windows)
- dslazy

General steps:
1) Open the ROM with dslazy and unpack it.
2) In the dslazy folder you will now have a NDS_UNPACK folder
3) Do the necessary modifications with the Hex Editor to arm9.bin and the files in /data (find the specific ROM instructions below)
- The "GGID" is a 4 bytes value that determines the region of the carts that can communicate with the distro ROM.
- The date limit (based on your DS's internal date) determines when the distribution is available
- The WonderCard contains a "mystery gift" for the receiving cartridge. You can edit it with Pokemon Mystery Gift Editor or Pokesav.
4) Repack the ROM and enjoy!

Deoxys/Dragonite American distro ROMs:
These are the easiest to "hack".
- WonderCard file: data\data.bin.
- The GGID is in data\ggid.dat.
- The date limit is in data\limit.bin. The first 4 bytes represent the starting date (YY00MMDD) in hex format (you can just replace them with 00000000), the remaining 4 are the ending date (replace them with FFFFFFFF).
- Unused files: data\decchi.bin, data\debug.lz

Shaymin European distro ROM:
This one actually contains 5 WonderCards and 5 GGIDs, one for each language. A different GGID and WonderCard will be used depending on your DS's language.
- WonderCard files: data\en.bin, it.bin, fr.bin, sp.bin, ge.bin
- arm9.bin contains both the date limit (in hex format) and the 5 GGIDs, here are the offsets:

0xCAC - Year (2009)

0xCB4 - Starting month (March)
0xCC0 - Starting day (24)
0xCCC - Ending month (June)
0xCD8 - Ending day (25)

0xD94 - English GGID
0xD70 - French GGID
0xD7C - German GGID
0xD84 - Italian GGID
0xD8C - Spanish GGID

So, it's impossible to achieve an "unlimited" distribution, you can make it last a year maximum.
- Unused files: data\decchi.bin, data\debug.lz, data\data.bin, data\limit.bin, data\ggid.dat

Pichu+Jirachi American dual distro ROM:
The ROM contains two different WonderCards (it chooses between them depending on the DS date), and obviously only handles one GGID.
- WonderCard files: data\p1.bin, p2.bin
- arm9.bin contains both the date limit (in hex format) and the GGID, here are the offsets:

0xC18 - (English) GGID

1st WonderCard (p1.bin):

0x14E4 - Year (2010)

0x14EC - Starting month (January)
0x14F4 - Starting day (23)
0x1500 - Ending month (February)
0x1508 - Ending day (15)

2nd WonderCard (p2.bin):

0x152C - Year (2010)

0x1534 - Starting month (February)
0x150C - Starting day (20)
0x1548 - Ending month (March)
0x1550 - Ending day (14)

It's impossible to achieve an "unlimited" distribution for this one too, you can make it last two years (one for each WonderCard) maximum.
- Unused files: data\decchi.bin, data\debug.lz, data\data.bin, data\limit.bin

Arceus European distro ROM:
5 WonderCards and 5 GGIDs in this ROM too, one for each language. A different GGID and WonderCard will be used depending on your DS's language.
- WonderCard files: data\en.bin, it.bin, fr.bin, sp.bin, ge.bin
- arm9.bin contains just the 5 GGIDs, here are the offsets:

0xD1C - French GGID
0xD28 - German GGID
0xD30 - Italian GGID
0xD38 - Spanish GGID
0xD40 - English GGID

- The date limit is in data\limit.bin (again?

). The first 4 bytes represent the starting date (YY00MMDD) in hex format (you can just replace them with 00000000), the remaining 4 are the ending date (replace them with FFFFFFFF).
- Unused files: data\decchi.bin, data\debug.lz, data\growtbl.narc, data\personal.narc, data\waza_tbl.narc, data\wotbl.narc, data\ggid.dat

Editing the WonderCard files:
- Open both the WonderCard ROM file that needs to be edited and the .pcd file.
- Copy the 80 bytes 0x104 - 0x153 in the .pcd to 0x0 - 0x4F in the ROM file:

Spoiler

to

- Copy the WHOLE .pcd to the remaining part of the ROM file (from 0x50 onwards):

Spoiler

- Finally, fill the last 8 bytes of the ROM file with zeros:

Spoiler

GGID list:
Here are the GGIDs for all the client cartridges.

English: 18 03 40 00
French: CD 00 80 00
German: CE 00 80 00
Italian: CF 00 80 00
Spanish: D0 00 80 00
Japanese: 45 03 00 00
Korean: 18 00 C0 00

Note: how to convert from decimal to hex (for dates).
If you didn't know, you can do this easily with the Windows/OSX calculator. Just set the "scientific" (programmer in OSX) view, write something in decimal and click on "Hex", and it will output the date in hex

Huge thanks to:
- Chamillionaire for finding half of the GGIDs and for writing the original guide for the first distro ROM;
- Kyohack for his independent research on the Arceus ROM, and for his automatic distro ROM editor.

 

[mrgone]

i'm not into pokemon at all,

but thats a very nice guide

 

[TM2-Megatron]

That's a great guide, and very useful. So its those GGIDs that determine the regionalization... that's good to know.

 

[Poryhack]

How'd you find those offsets in arm9?

Very handy btw.

 

[Aurora Wright]

How'd you find those offsets in arm9?

Very handy btw.

Trial and error, with some luck too

 

[Deleted-236924]

By the way, it isn't Darkrai distribution rom, it's Deoxys distribution rom.

 

[Poryhack]

By the way, it isn't Darkrai distribution rom, it's Deoxys distribution rom.

I was gonna say that as well. While there was a darkrai distribution, very few if any people have the ROM of it. The deoxys on the other hand was a scene release.

 

[Deleted-236924]

I believe the Darkrai distribution one was held in one of these big black cartridges that could only be read by debug units.
I've read that in the European Shaymin NFO from DS-Scene.


On a side note, would it be possible to edit the Deoxys distribution rom to remove all these ClearFlag and replace them with item names from Pt/HG/SS?

 

[Poryhack]

The American darkrai given out at TRU was not on a developer card, but the European one apparently was.

Not sure what you mean by "ClearFlag".

 

[Deleted-236924]

Really, it makes sense that the European Darkrai was on a developer card.
After all, they talked about the Darkrai and Regigigas distribution rom on the European Shaymin NFO.

As for ClearFlag, you know, when you put the Secret Key pcd file in the Deoxys Distribution rom, it will show up as "Distributing ClearFlag"?

I can confirm the dual distribution cart shows "Distributing the Secret Key" when it got the Secret Key in it.

 

[mikeac]

--REMOVED LINK--
I have a guide on how to make distro roms that CAN be unlimited. Just download my software bundle, I really didn't make the software though. It is still a noobish guide.

EDIT: Still forgot to remove link, soz.

 

[Deleted User]

.

 

[Deleted-236924]

I actually got one question.

What is the black screen with "Channel" on it for?
I thought it was for version distribution...

However, I have three different distribution roms that both can only distribute to Platinum.
One of them show "Channel 1", one shows "Channel 7" and one shows "Channel 13"

It's also worth mentionning that the roms I got that can distribute to D/P/Pt all show a different number, while the ones that can only give to D/P also show a different number. I did notice I only get "Channel 1", "Channel 7" and "Channel 13"

 

[Poryhack]

It's just the frequency that the DS decides to broadcast at. It scans all the available channels on startup and chooses one with the least interference.

 

[TM2-Megatron]

I'm just curious about something... in PCDs that've been ripped from save files, obviously the field for "date recieved" is going to have a value. But in the actual distro cart, the value is zeroed out (waiting until it's injected into a game to acquire one, I guess). Do you think it's necessary to zero this value again when patching a new PCD into a distribution cart?

 

[Poryhack]

Try it if you really must know. All the editing guides I've seen have said to zero it.

 

[Morfeo]

[english]
Hello, thank you very much for posting this. For days I was looking for this.
With regard to hacking the ROM of European Shaymin I can only doubt and I wonder if they have the answer.

I'm trying to replace the "ggid" Italian for "ggid" Japanese, so in this way can distribute the Wonder Card to Japanese version, which has already successfully achieved. But to distribute to Japanese versions, I have to change the language of NDS into Italian.
The question is: Is there any way to modify the ROM to indicate that if the NDS has selected the Japanese Language, Wonder Card that can be distributed to Japanese versions without changes in Italian language?

I hope you can respond and there is some way. In advance thank you very much

P.D. Sorry for my bad English, but I speak Spanish and helped me with a translator


[spanish]
Hola, muchas gracias por publicar esto. Hace días que lo estaba buscando esto.
En relación al hackeo del ROM de Shaymin Europeo solo me queda una duda y quisiera saber si tienen la respuesta.

Estoy tratando de sustituir el “ggid” Italiano por el “ggid” japonés, para que de esta forma pueda distribuir la Wonder Card hacia versiones Japonesas, lo cual ya logre con éxito. Pero para poder distribuir hacia versiones japonesas, tengo que cambiar el idioma del NDS al italiano.
La pregunta es: ¿Hay alguna forma de modificar el ROM para indicar que si el NDS tiene seleccionado el Idioma Japonés, pueda distribuir dicha Wonder Card hacia versiones japonesas sin tener que cambia en idioma Italiano?

Espero que ustedes me puedan responder y exista alguna forma. De antemano muchas gracias

P.D. Perdón por mi mal Ingles, pero yo hablo Español y me ayudo con un traductor

 

[pokefan92]

It would be a good Idea Morfeo, but I think it is part of the structure of the rom and It can't be changed... It's like we wanted to make the previous years, making it region free... I think we should have to wait... But there is one thing I think it could be interesting. Shaymin Distribution Cart has 5 WCD... What if we put it 6? (The Japanese one). Between every GGID there are unknown values:
C0 76 02 02 24 74 02 02
2C 74 02 02
34 74 02 02
3C 74 02 02
44 74 02 02

So, i Think that if we put here the japanese GGID and then we add 4C 74 02 02, it should recognise japanese versions! Then, we only have to put the jp.bin, and that's all! What do you have to say? Do you think it is possible? Thanks in advance

Español [Para ti, Morfeo xD]
Lo que dices seria buena idea, pero creo que, al formar parte de la estructura del juego, es como el Region Free en lo del Deoxys, habria que esperar a que saliera una nueva Rom cuya estructura este preparada para ello... Aun asi tengo una idea.... ¿Porque no le metemos la sexta wondercard a la japonesa? Si fijas, hay una similitud entre esos valores desconocidos que hay entre cada uno de los GGID del arm9.bin

C0 76 02 02 24 74 02 02
2C 74 02 02
34 74 02 02
3C 74 02 02
44 74 02 02

Pues he pensado, que si despues de esto le metemos la GGID japonesa y le ponemos 4C 74 02 02, reconoceria juegos japoneses sin tener que quitar el italiano!!!! Despues habria que crear uno que fuera el jp.bin, y listo

. Bueno, dime, como lo ves tu?

 

[Deleted User]

.

 

[Poryhack]

Those "unknown values" seem to be some kind of offset for the wondercard files (en.bin, etc). When I messed with them and went to download the wondercard onto Diamond I saw that it was trying to retrieve the wondercard title from somewhere that there wasn't one (it appeared on diamond as a bunch of garbled characters).

I have a feeling there's more to it then this anyway. Everything about this ROM is pretty much hard-coded; you'd have to also find and edit the part that loads the bin files, and probably the part that reads the language settings from the DS's firmware (I'm pretty sure this isn't it).

I did notice one interesting and potentially useful thing when I was messing around though. When the ROM peeks at the DS's language settings it's looking for either French, German, Italian, Spanish, or English. When it doesn't find any of those (aka when it's set to Japanese) it falls back to English. What this means is that you can replace the English GGID with the Japanese one and you will be able to distribute to Japanese clients with the DS language set to Japanese. The only downside to this is that you lose functionality with English clients. Morfeo was willing to lose functionality with Italian clients, so I can't imagine English would be much worse.