[Tutorial #1] Making a Multiplier cheat

[Eiffel2018]

Hi, here is an example for using GDB making cheat
Edizon SE is good to match GDB environment

First of all, I want to make a cheat for getting fruit, it is 2 at the beginning

Search with U32 normally


make a change in the game


and search again


Repeat the steps until you get several results


May change them with different values, to test which one is correct and can be used.


After eating 2 fruits, it become 11

So, the third one should be used

now you can write down the address(es) by pen or notepad

---

Open a blank page in IDA PRO,
connect using GBD debugger


Set the processor as ARM64



Attach with correct PID



You can find the game is freezing now


Type "get info" in the GDB command line
Get get the address for Heap/Alias (Some game use Heap, some game use Alias), Stack, and Main

(or you can get them from EdizonSE)

There is a little difference between the length of main and alias, never-minded.

Now, we need to define the regions we use.


First, it is Alias. Just copy from Output window, and type in the end, mark the name and not executable



Then it is Stack, type in the Start and End address similarly


Finially, it is Main address,
Note: This time I need to fill in the Base address, i.e. Start Address exclude the ending 0.



Click a Hex View once, and press G, and type in the Address we found before


We may need to Press 4, to have a better view, that is the view I found before


Now, we change to the Breakpoints List Tab, and Press INS to insert a new breakpoint.
Make sure it is Hardware breakpoint, then Uncheck the Read, the Size 0x1 is not important, just leave it 0x1 is fine! (not necessary to change it as 0x4)


Press F9 to continue the game


The game should be freeze again, when you ate a fruit.


And the IDA PRO gives a message, just omit it.


Click the IDA View-PC tab, and there should be a STR command.


Don't forget to switch off or delete the breakpoint immediately (otherwise, it may have some issues, that's buggy!)

---

We should make change of the register W8, in order to make a mulitplier cheat,
let's take a look on the prior code first, scroll up to a certain address that ending with 0/4/8/C, and press C to compile it



it's rather simple in this case,
W8 is read from [x19,0x1C]. and then add 1, and then write back to [x19,0x1c]
So, the multiplier can simply change the line Add W8, W8, #1 as Add W8, W8, #5
it will become a 5x multiplier cheat.

How to make cheat code for it?
You can go to here and type your command, quite convenience for not heavy work



Beside this online converter, you can also use keystone to get the ASM code

After you get the asm code 11000508, you can use the change byte command and paste the code there
(I've set a shortcut for it, since I always use this function)



(By the way, I use py3 keystone + keypatch plugin for IDA PRO, so that I can just press CTRL+ALT+K and type tons of commands directly)



Anyway, the command changes, and you can continue the game (press F9) to test the cheat


Oh, it does not work as expected


OMG, I've wrongly used the first address, instead of the third one,
it should be 67FA5EFEC8, nevermind, insert another breakpoint

double click the breakpoint , I can check the current value for it, Yes, it is 0x13 , i.e. 19


Start again with F9, and the game freeze again when eating another fruit


Similarly, get more codes prior to there.


This time, it is changed with ADDS W8, W8, W20,
for a multiplier, we can simply add a LSL at the end, such as ADDS W8, W8, W20, LSL#3, it is 8x multiplier (2 to the power 3 is 8)

write 2B140D08 for it (or you can also type 08 0D 14 2B, they are the same)


F9, Test again.
It is fine. it works as expected.

Finally, tab to a Hex-view that sync with PC view


Press 4 to change its format as u32, and then highlight and Copy the codes

and add a 04000000 before 01D5349C 2B140D08 , that is.

Codes and spoilers in this group are for members. Join the Nintendo SWITCH Cheat Codes Download group to reveal them. It's free.

Register Log in

---

For the task that is too complex, such as Judge friend or foe, we need code cave. I may show it on the next tutorial

 

[wiitendo84]

What if I want to make it have 99 fruit instead of multiplying or being infinite. Could you still make it a button combo like press x for 99 fruit

 

[Eiffel2018]

Normally, just do something like MOV W8, #99 to replace the ADD statement

However, that game will 1-up when it over 99 and count again with 0. So, that kind of hack is not good for this game.

Besides, with Edizon SE, many users can search and make change himself
(although they do not get the pointer, it is easy for them edit themselves on the right time)

So, some cheats that do multiplier (or something does not decrease) is much more attractive and the game would be more funny

 

[patjenova]

What if I want to make it have 99 fruit instead of multiplying or being infinite. Could you still make it a button combo like press x for 99 fruit

yess than make a mov W8,#99 instead of add

 

[patjenova]

this is not a good game to explain codecaves. Not much room for it.

 

[arismendy64]

in this I am failing , and I do not know why.

Codes and spoilers in this group are for members. Join the Nintendo SWITCH Cheat Codes Download group to reveal them. It's free.

Register Log in

 

[Eiffel2018]

in this I am failing , and I do not know why.

Codes and spoilers in this group are for members. Join the Nintendo SWITCH Cheat Codes Download group to reveal them. It's free.

Register Log in

there are 3 region you have defined,
if you are main, you want to jump to an address of alias
Press G and then type alias:0123456789 <-- where 0123456789 is your address

or you can simply double click the alias region, and then type the address directly

---

For some case, I will not type the base of main, just left it 0 (when study the memory and pointers relationship)
if I need to go a certain main address, I can type "main+123456" it is also acceptable!

 

[arismendy64]

there are 3 region you have defined,
if you are main, you want to jump to an address of alias
Press G and then type alias:0123456789 <-- where 0123456789 is your address

or you can simply double click the alias region, and then type the address directly

Now I remember what I was doing wrong,
I didn't look or save the memory region of
Edizon.se, will continue after work.

And thanks for taking your time.

 

[FAST6191]

What if I want to make it have 99 fruit instead of multiplying or being infinite. Could you still make it a button combo like press x for 99 fruit

In basic cheats you tend to find addresses by the usual means, or maybe moving sideways (if luck goes up every 10 levels but atk every time then find atk and chances are luck is but a few bytes away. Or if you can reasonably make infinite basic starting town knives you can probably figure out how to turn that into infinite end game swords/bonus swords -- it will either be an identifier or a location, though some modern stuff goes other ways). More advanced stuff like this can narrow things down a bit quicker (if an on screen change happens you can usually find something that changes as a result and work backwards)

Normally the button check to do something is every frame (or some other choice point) you check the button states, or the debounced version thereof, and if your combo is there you fire the memory write (or register write if it is a value living on the registers).

Multiplication I would normally do with shifts (there is a reason most cheats of this form you ever see will be x0.25,x0.5,x2,x4,x8,x16,x32...), and many cheat engines will have this too. In case you were not familiar then logical shifts are the binary equivalent of multiplying and dividing by 10 in that you just shift the decimal place as it were by the relevant number of positions. Most more advanced cheat engines will have this, and code wise ARM processors used to be notorious for having super fast shifting options, if you are encountering floats or something fun in the anti cheat world it gets a bit more annoying but cross that bridge as and when. Indeed you will probably still be contemplating shifts even if you wanted say 3x (4x-x after all). That said it is the modern world and nice multiplication options are probably available as instructions these days that don't take too much thought/processing time.

If as mentioned there is a one up counter tied to this then there are other means to handle things. Here you would probably double down on the button combo idea and throw another IF ELSE (or cmp and branch if going for more arm assembly approaches) construction into the mix. In this case find some free area of memory, set a flag there and check the flag to in turn have some other code respond as you might want it to (if it goes back to 0 after giving you an extra life then you can always have it check the flag, set things back and disable the flag).

If you want to play in the game genie/assembly cheats world you have some other options as well for cheats rather than replicating the every vblank/hblank/choice interrupt approach of gameshark/action replay/codebreaker/... memory cheats -- the above stuff deals in vblanks so subverting it to do other things (which can also have other perks -- your health might be infinitely refilled but if knockback is proportional to damage that is unmodified then you might not get as much, or if the damage done is more than the full health of the character the refill might not come before the next check).

 

[wiitendo84]

In basic cheats you tend to find addresses by the usual means, or maybe moving sideways (if luck goes up every 10 levels but atk every time then find atk and chances are luck is but a few bytes away. Or if you can reasonably make infinite basic starting town knives you can probably figure out how to turn that into infinite end game swords/bonus swords -- it will either be an identifier or a location, though some modern stuff goes other ways). More advanced stuff like this can narrow things down a bit quicker (if an on screen change happens you can usually find something that changes as a result and work backwards)

Normally the button check to do something is every frame (or some other choice point) you check the button states, or the debounced version thereof, and if your combo is there you fire the memory write (or register write if it is a value living on the registers).

Multiplication I would normally do with shifts (there is a reason most cheats of this form you ever see will be x0.25,x0.5,x2,x4,x8,x16,x32...), and many cheat engines will have this too. In case you were not familiar then logical shifts are the binary equivalent of multiplying and dividing by 10 in that you just shift the decimal place as it were by the relevant number of positions. Most more advanced cheat engines will have this, and code wise ARM processors used to be notorious for having super fast shifting options, if you are encountering floats or something fun in the anti cheat world it gets a bit more annoying but cross that bridge as and when. Indeed you will probably still be contemplating shifts even if you wanted say 3x (4x-x after all). That said it is the modern world and nice multiplication options are probably available as instructions these days that don't take too much thought/processing time.

If as mentioned there is a one up counter tied to this then there are other means to handle things. Here you would probably double down on the button combo idea and throw another IF ELSE (or cmp and branch if going for more arm assembly approaches) construction into the mix. In this case find some free area of memory, set a flag there and check the flag to in turn have some other code respond as you might want it to (if it goes back to 0 after giving you an extra life then you can always have it check the flag, set things back and disable the flag).

If you want to play in the game genie/assembly cheats world you have some other options as well for cheats rather than replicating the every vblank/hblank/choice interrupt approach of gameshark/action replay/codebreaker/... memory cheats -- the above stuff deals in vblanks so subverting it to do other things (which can also have other perks -- your health might be infinitely refilled but if knockback is proportional to damage that is unmodified then you might not get as much, or if the damage done is more than the full health of the character the refill might not come before the next check).

I haven't done much with assembly cheats and the last time I made a cheat with a breakpoint address was back in the GameCube era for Army Men Sarge's War.

 

[FAST6191]

I haven't done much with assembly cheats and the last time I made a cheat with a breakpoint address was back in the GameCube era for Army Men Sarge's War.

While I am still dubious about the term assembly cheats then OK we can do the general overview.

Ignoring save game modding there are two general approaches to making cheats.

You insert a bit of code into something that runs often enough to suit your purposes, this usually means a vblank/vertical bank that happens 60 times a second (or 50Hz in some older PAL things) and has some other perks as far as screen updates. Can happily read controls, write areas of memory, compare to other areas of memory and write other areas of memory and thus do 99.99% of things people care about with cheating here, also dodges some of the pitfalls of the second method. Finding a vblank is also usually pretty easy. The main downside is timing issues -- if the check to see if you lost all your health happens at the start of a vblank then your edit that comes at the end might not overwrite it in time in case you lost everything, I usually pointed people at goldeneye here and told them to eat a rocket with gameshark cheats on vs with onboard cheats but think I am going to need a more modern example.

The other alternative is you know the address because you did the conventional cheat search method of lose/gain something, search for relevant change, lose/gain something, search for relevant change where "something" is life, ammo, money, mana, experience, items in a stack, stats... that you care about making a cheat for (

This download link is for members of the Nintendo SWITCH Cheat Codes Download group. Join the group to see it. It's free.

Register Log in

if you/those reading along at home wanted a nice little overview). In the case of health then something hitting you will ultimately subtract a number from your health (or maybe add it to total damage if the game rolls that way). Find this subtract and change it to an add, do a multiplier (assuming the game does not have its own multiplier you can fake out -- no damage, quick fight... I am sure you have played enough things with such rewards), a NOP (no-operation, basically getting the CPU to twiddle its thumbs) or similar and you have the other approach. You can also start to alter things on a more fundamental level -- getting hit might lose health, but you can go a bit further back and figure out where it detects you being hit in the first place and tell it to not go down the path of code it would if you were hit.
The troubles, other than the difficulty over basic memory approaches, tend to be when you have multiple things all attacking the same area -- most mario games I have looked at have their own death function that everything uses so not so bad but imagine rather than just holding a number that forms the lives counter you instead get to hunt down the subs that happen for pits, enemies, time, crushing, poison mushroom, hazards, too high drops, cold water...

There are all sorts of little tricks you can learn in cheat making to make this better still. I mentioned about stats there (I usually explain it along the lines of imagine you have 10 characters with stats in a spreadsheet -- some games will have columns in the hex in memory, others will take rows), items in inventory can also be this -- most cases you either have item identifiers and counts of the item, or the fixed location in the inventory memory holds the number of those items you have, more modern stuff can however wander off into custom XML setups or stats based affairs. This is how you might find out how to do rare stats without having to spend 10 hours to increase levels "normally" to find it, or find end game swords (if item identifier 1 is starter knife then identifier 20 might be end game bonus sword) that might only have the option to get 1 in the entire game (hard to lose/gain back, though you do have savestates I suppose). Moon jump either being stats that did it, fiddling with gravity or double jump flags being disabled being another sort thing some of the better cheat makers will know over those that just know how to make infinite potions.

Breakpoint fundamentals as well because why not.
You have three basic breakpoint types, multiplying to 6 if you include log points (rather than halting, aka breaking -- there is a reason that little pause-break button is next to the numpad on your keyboard, it just notes it all down for your later perusal, which can be useful in the case of rarely executed aspects of functions) that also correspond to the 3 main things memory might do in the basic concept of computing.
1) Read. Data is fetched from this location. This leads to break on read aka BPR in most setups.
2) Write. Fairly self explanatory really in that the memory gets written. This leads to break on write aka BPW in most setups.
3) Execute. The CPU actually looks at this address for code to run. BPE in some setups, BOE in others.

Run to line is a more primitive form of break on execute and might be the more basic one implemented first when the debugging options are being made.
Some will have break on access which might just combine all three of the breakpoint types.
Some more advanced ones still will have conditional breakpoints like if this value is between these values then tell me, or do this boolean operation and tell me if (can be useful if you only care about 1 bit being set).

The other major feature in debuggers is code logging but not all will have that, and even if they do it can be a big buggy or demanding (logs ending up in the gigs is reasonable for some setups). Here the debugger will note code being executed and ignore things it has seen before. Here you would do everything but what you care about and have the thing you care about be the last thing. Say you wanted to learn about the jumping function in a platform game. You could find the position in the world (or the position of the world if it is one of those games that moves the world instead) and try to do something that changes that and work backwards, or you could fire up the code logger. I would probably still find a quiet point of the game but play it as you will. Here you would do everything but jump -- move, idle, look around, duck... and in doing so it will hopefully have also seen any music, background animations, timers counting down... that happen in the background as well, now jump and the last new thing it saw will be the jump command.

Hopefully you know about the major classes of assembly instructions.
I usually break it down into
1) Maths. Computers do it a lot and forms the bulk of what gets done. Will extend to include boolean logic (AND, NAND, NOR, OR, XOR and such) and anything you might see in the fancy list of a spreadsheet program https://help.libreoffice.org/Calc/Mathematical_Functions as well.

2) System management. 32 bit or 64 bit registers and maybe only a few dozen of them (or 3 for some intents and purposes if you drop back to the NES), memory usefully still measured in megabytes... you are going to need to cycle things in and out of the CPU and memory to do things. This is what this is about. MOV and memory handling (assuming it is different for your given system) then being the basics here. Related to this is push and pop,push takes registers and puts them on the stack, pop takes the pushed things and restores if after you are done, this is one reason you are told not to call a function within a function, the other being because you might only have a single return register and that can be tricky to have to keep track of but that is more of what we are about to cover

3) Program flow. Branches, jumps and all that fun. You will meet it early on in normal programming, some of the terms might be different here (IF ELSE not really being a thing in assembly, but compare and branch/branch if not equal will look kind of similar, adding 1 to a place in RAM at the end of instructions you care about and when it gets above a certain value then doing something else should probably remind you of WHILE...) but still going to be the same thing underneath it all. I occasionally meet people that want to alter saves. Saves have hashes using often custom or complicated processes to make a hash. It will probably still at some level compare the hash to the one it expects, if it matches then great, if not then say save it corrupt. You change it to always take the "it matches path" by whatever means you like (you are an assembly coder now, there are options to do many things here) and bam you bypassed a save hash check, with the added bonus that the game will probably generate a valid hash when it saves next that will work on a stock game.


Take all this, figure out something that changes, work backwards to something you care about and alter how the program works and this is the world of what is classically known as game genie but here people seem to want to favour assembly cheats, which is probably a more understandable term but oh well.

 

[Eiffel2018]

What if I want to make it have 99 fruit instead of multiplying or being infinite. Could you still make it a button combo like press x for 99 fruit

I found that I misunderstood your question

For handling button with ASM cheat, just like the pointer one,
You can write down the normal code first, e.g. 04000000 01D5349C 2B140108
then made a button condition and include the new code

Codes and spoilers in this group are for members. Join the Nintendo SWITCH Cheat Codes Download group to reveal them. It's free.

Register Log in

However, it does not work in Ryujinx or Yuzu!
To make this code compatible with the emulator, we need to define a memory for storing ON/OFF status
The ASM function read the status to decide how it execute, and your cheat code make change to this status
This is rather difficult for beginner, you need to find out a writable memory and make change on it.

 

[Retrojunkies]

looks complicated but interesting read to learn something new.

i always forget things me, like increase/decrease value of an address like when i did the Resident Evil inventory cycle mod using button activators to change item/item amount.

my notes clearly were not clear enough as i have forgotten how to do it on static address or pointers

 

[wiitendo84]

I found that I misunderstood your question

For handling button with ASM cheat, just like the pointer one,
You can write down the normal code first, e.g. 04000000 01D5349C 2B140108
then made a button condition and include the new code

Codes and spoilers in this group are for members. Join the Nintendo SWITCH Cheat Codes Download group to reveal them. It's free.

Register Log in

However, it does not work in Ryujinx or Yuzu!
To make this code compatible with the emulator, we need to define a memory for storing ON/OFF status
The ASM function read the status to decide how it execute, and your cheat code make change to this status
This is rather difficult for beginner, you need to find out a writable memory and make change on it.

This helps out when I find a few things. Appreciate all the help.

 

[Idrolitina]

Thank you for this tutorial!
I have always wanted to give it a try.

In case of updating a cheat do you suggest starting from zero or do you generally work it backward from the cheat you already have? I suppose is the first ... but what about those codes that do not show us searchable values like speed multiplier? How do I look for those?
As a concrete example: in Kingdom Two Crowns cheats archive there is a speed multiplier code and the character moves faster. The game was updated and I would like to work on the cheats and update them. I can find things like gold and diamonds easily just using Edizon but I cannot understand what value to search for to locate the speed. Should I go from more than 0 and try to run and search for the value that increased?

Thank you again!

 

[FAST6191]

For things between regions, v1.1 and such then it varies. You can have success moving sideways -- if gold is 50 bytes away from what you care about then chances are good it will still be 50 bytes away, or at least close enough that you can figure it out by looking at what changed in the original and what changed in the updated/region/2 in 1/...

Speed multipliers are not necessarily multipliers in the sense that this tutorial and posts are discussing. Many games will have speed as it its own variable within a game and you can edit that like you edit other stats, or if you can guzzle a potion to increase speed (or maybe a hidden feature for cutscenes or something) then potentially a flag within the game, or if different characters have different speeds but still use the same fundamental engine then something in that. That then tends to dictate the approach you use, though there are potentially others if people twist the animations or other hidden aspects to do the same thing.
If it is a stat then hopefully you can equip enough things to improve it, or level up (might have to make say an experience cheat for that, or indeed find more common stats and move sideways -- quite often such stats are right next to other common/easy to change stats, or a fixed distance in the case of "here is the atk stat for everything in the party, here is the def, here is the int, here is...").
If it is a flag then they can be annoying to find, especially if you don't have savestates to revert back before you drank the potion for a simple comparative search and time to wear off is long (and there are no dispel magic effects). If there are multiple potions having multiple effects that can also be used to change flags. Otherwise you either go for assembly approaches and follow changes in code after pressing go on drink a potion/equip an item/viewing in game speed related variables (sprite and model positions being the easier to follow things, even if usually somewhat removed from internal values. Sprite stuff tends to be easier from where I sit, but plenty prefer 3d approaches and I can see that too).

 

[Eiffel2018]

Thank you for this tutorial!
I have always wanted to give it a try.

In case of updating a cheat do you suggest starting from zero or do you generally work it backward from the cheat you already have? I suppose is the first ... but what about those codes that do not show us searchable values like speed multiplier? How do I look for those?
As a concrete example: in Kingdom Two Crowns cheats archive there is a speed multiplier code and the character moves faster. The game was updated and I would like to work on the cheats and update them. I can find things like gold and diamonds easily just using Edizon but I cannot understand what value to search for to locate the speed. Should I go from more than 0 and try to run and search for the value that increased?

Thank you again!

For beginner, I suggest you upgrade those cheats with ASM codes.
So that you can learn how the others hack the game.

Just open the main.elf in the older version with IDA PRO
and then compare with that of newer version in the second IDA PRO.
(Open 2 IDA PRO at the same time and put in both sides of your windows, press WIN+Left Arrow or WIN+Right ARROW)

Most upgrade of games do not change the codes a lot, so you can just use ALT+B search the corresponding codes with a large immediately value or a local jumping address (explain later). Since they are easily to find and you may get only 1 result

1. immediate value such as LDA X8, [X0, #0x3B0],
#0x3B0 is an immediate value
MOV W3, #0x270F is also a command with immediate value, they are easily to search

e.g. the above cheat at 5C8614, I will search with 4B C5 03 39 3F 89 01 71 4A 0C 80 52
only a few results will be come out

2. local jumping address, the command like BNE, BEQ, BCC, BGE, CBZ, CBNZ, TBZ, TBNZ etc follows a nearby address, such as the yellow one in the figure.

They are also good choices for searching, in the other elf file you want to compare.

Note, you must better skip the far jumping address, such as BL, ADRP etc, and the SP register address also may change frequently.

3. If that are more than one result you get

you can choose those with the near value of address, and the first 3 and the last digit are always the same. Just open it and check the graphs on both side of IDA, are they alike.
After open one of the occurrences, you must check the offset on the status below

sub_105B50+8C, this 8c is the offset from the subroutine start, so if your code is not well analysis you can press G and type -8c, go to the subroutine head and press c check whether it is a head of the subroutine. or you can press p to make it become a subroutine
These offsets are important, with them we don't need to check it on the graph or in the game, they are 99% correct when the codes with the same offset and same ASM code

4. There are some exception, such as Mario Golf is an odd one. Most Registers and immediate values were change in the current version. BINDIFF is a good mod for IDA PRO that help me found out the same subroutines.
However, normally I seldom open it since it needs more than one hour for the de-compiler works until idle.

5. https://cit.dixie.edu/cs/2810/arm64-assembly.html this webpage is helpful for ASM learning

6, After you learn everything, you can try to upgrade a pointer cheat as an asm cheat.
IDA with GDB is useful, you can follow the pointers in HEX view with address name

finally make a break point on the last value, and get the corresponding asm code

 

[Jasonclarke1986]

ok so i just got a laptop and thought id give asm a whirl, got lucky with the first one all it needed was a nop and it was done. tried to do plants vs zombies cooldown of skills, there was so man lines of code i was out of my depth and had no clue what to change, tried changing a line and all it did was freeze the cooldown not remove.... gave up. moved onto an npcs odyssey and found its not arm64... already confused. needless to say not having fun. need some form of guide which gives you clues on how to get what you want from the code, and what each does like a cheat sheet of some kind. anyway that's been my first night looking at it and now I'm going to sleep seeing codes and functions....

 

[velvetmxo]

Hi, here is an example for using GDB making cheat
Edizon SE is good to match GDB environment

First of all, I want to make a cheat for getting fruit, it is 2 at the beginning
View attachment 286514
Search with U32 normally
View attachment 286515

make a change in the game
View attachment 286516

and search again
View attachment 286517

Repeat the steps until you get several results
View attachment 286518

May change them with different values, to test which one is correct and can be used.
View attachment 286519

After eating 2 fruits, it become 11
View attachment 286520
So, the third one should be used

now you can write down the address(es) by pen or notepad

---

Open a blank page in IDA PRO,
connect using GBD debugger
View attachment 286474

Set the processor as ARM64

View attachment 286475

Attach with correct PID

View attachment 286476

You can find the game is freezing now

View attachment 286478
Type "get info" in the GDB command line
Get get the address for Heap/Alias (Some game use Heap, some game use Alias), Stack, and Main

(or you can get them from EdizonSE)
View attachment 286480
There is a little difference between the length of main and alias, never-minded.

Now, we need to define the regions we use.
View attachment 286481

First, it is Alias. Just copy from Output window, and type in the end, mark the name and not executable
View attachment 286484
View attachment 286482

Then it is Stack, type in the Start and End address similarly
View attachment 286485

Finially, it is Main address,
Note: This time I need to fill in the Base address, i.e. Start Address exclude the ending 0.
View attachment 286486


Click a Hex View once, and press G, and type in the Address we found before
View attachment 286487

We may need to Press 4, to have a better view, that is the view I found before
View attachment 286488

Now, we change to the Breakpoints List Tab, and Press INS to insert a new breakpoint.
Make sure it is Hardware breakpoint, then Uncheck the Read, the Size 0x1 is not important, just leave it 0x1 is fine! (not necessary to change it as 0x4)
View attachment 286489

Press F9 to continue the game
View attachment 286490

The game should be freeze again, when you ate a fruit.
View attachment 286493

And the IDA PRO gives a message, just omit it.
View attachment 286494

Click the IDA View-PC tab, and there should be a STR command.
View attachment 286495

Don't forget to switch off or delete the breakpoint immediately (otherwise, it may have some issues, that's buggy!)

View attachment 286497

---

We should make change of the register W8, in order to make a mulitplier cheat,
let's take a look on the prior code first, scroll up to a certain address that ending with 0/4/8/C, and press C to compile it

View attachment 286496

it's rather simple in this case,
W8 is read from [x19,0x1C]. and then add 1, and then write back to [x19,0x1c]
So, the multiplier can simply change the line Add W8, W8, #1 as Add W8, W8, #5
it will become a 5x multiplier cheat.

How to make cheat code for it?
You can go to here and type your command, quite convenience for not heavy work
View attachment 286586


Beside this online converter, you can also use keystone to get the ASM code

After you get the asm code 11000508, you can use the change byte command and paste the code there
(I've set a shortcut for it, since I always use this function)
View attachment 286501


(By the way, I use py3 keystone + keypatch plugin for IDA PRO, so that I can just press CTRL+ALT+K and type tons of commands directly)
View attachment 286498


Anyway, the command changes, and you can continue the game (press F9) to test the cheat
View attachment 286513

Oh, it does not work as expected
View attachment 286521

OMG, I've wrongly used the first address, instead of the third one,
it should be 67FA5EFEC8, nevermind, insert another breakpoint
View attachment 286524
double click the breakpoint , I can check the current value for it, Yes, it is 0x13 , i.e. 19
View attachment 286525

Start again with F9, and the game freeze again when eating another fruit
View attachment 286528

Similarly, get more codes prior to there.
View attachment 286531

This time, it is changed with ADDS W8, W8, W20,
for a multiplier, we can simply add a LSL at the end, such as ADDS W8, W8, W20, LSL#3, it is 8x multiplier (2 to the power 3 is 8)
View attachment 286583
write 2B140D08 for it (or you can also type 08 0D 14 2B, they are the same)
View attachment 286533

F9, Test again.
It is fine. it works as expected.

Finally, tab to a Hex-view that sync with PC view
View attachment 286534

Press 4 to change its format as u32, and then highlight and Copy the codes
View attachment 286535
and add a 04000000 before 01D5349C 2B140D08 , that is.

Codes and spoilers in this group are for members. Join the Nintendo SWITCH Cheat Codes Download group to reveal them. It's free.

Register Log in

---

For the task that is too complex, such as Judge friend or foe, we need code cave. I may show it on the next tutorial

Great stuff sir. will motivate and encourage those looking to help the community.

 

[team-knight-rider]

Hi,
thanks