Hacking Hyrule Warriors save editing

[RemixDeluxe]

Which node exactly?

I'm not at home right now but it's somewhere on the bottom left of the map.

Seriously? o.o I wish I knew that before >o<

Yeah seriously, I got all my characters to lv 250 before I had access to Wii U homebrew. I would of preferred to have cheated so I didn't waste all that time lol

 

[Deathwing Zero]

@BtEtta As per your request in the first post, here is the data for the 3 remaining Adventure maps. Twilight and Termina for some reason have empty data between some items, I have no idea why and frankly the un-uniformity of it annoys the crap out of me. I digress.

Master Quest Map
0x19240 - 0x1924B (1 byte)
    Compass
    Bombs
    Candles
    Ladders
    Power Bracelets
    Water bombs
    Digging Mitts
    Ice Arrows
    Rafts
    Hookshots
    Recorders
    Goddess Harps

This is where things get messy. I'm unsure how I should format, so change it as you see fit.

Twilight Map
0x1BA6E - 0x1BA6F (1 byte)
    Compass
    Bombs

0x1BA73 - 0x1BA74 (1 byte)
    Water Bombs
    Digging Mitts

0x1BA78 - 0x1BA7F (1 byte)
    Lanterns
    Jars
    Fishing Rods
    Clawshots
    Spinners
    Ooccoo
    Tears of Light
    Tears of Twilight

Termina Map
0x1E29A - 0x1E29B (1 byte)
    Compass
    Bombs

0x1E2A2 (1 byte)
    Ice Arrows

0x1E2AC - 0x1E2B3 (1 byte)
    Song of Time
    Inverted Song of Time
    Deku Sticks
    Deku Mask
    Goron Mask
    Zora Mask
    Mask of Truth
    Majora's Mask

0x1E2B7 (1 byte)
    Giant Summon

I haven't tested but I believe this byte controls the number of "Hours" remaining on the Termina map.
0x208B8 (1 byte)

 

[BtEtta]

I'm dumping my save file right now so I have something current to look at, and will continue with that once I get the memory addresses sorted out.

Data Structure is as follows:
00 00 00 36 = weapon ID (Ghirrahim Demon Blade leve 1)
00 50 = Weapon Base Strength
00 01 = Weapon Stars
11 11 11 11 = Slot 1 Information (00 00 00 03 = Strength 3)
22 22 22 22 = Slot 2
33 33 33 33 = Slot 3
44 44 44 44 = Slot 4
55 55 55 55 = Slot 5
66 66 66 66 = Slot 6
77 77 77 77 = Slot 7
88 88 88 88 = Slot 8
99 99 99 99 = Kills to Unlock Slot 1
AA AA AA AA = Kills to Unlock Slot 2
BB BB BB BB = Kills to Unlock Slot 3
CC CC CC CC = Kills to Unlock Slot 4
DD DD DD DD = Kills to Unlock Slot 5
EE EE EE EE = Kills to Unlock Slot 6
FF FF FF FF = Kills to Unlock Slot 7
10 10 10 10 = Kills to Unlock Slot 8
03 00 00 00 = Weapon Identifier (See Pastebin)

Not quite. The weapon identifier (I used the term type) is at the start of the structure, not the end. So the data starts at 0x8D74C (and the last structure starts at 0xA08C8)

I've spent my evening building and verifying a spreadsheet to translate the raw data into readable info. I haven't verified every weapon in my file but those I have are all correct. I made extensive use of ScarletKohaku's pastebin, but also doing some text dumps from the game files because the strings always seem to be listed in the correct ascending order for the relevant Weapon/Skill IDs.

Haven't figured how best to document it all for this post though.

https://drive.google.com/file/d/0B0YIN5YdJt0GVGM4bElsMzFjM0k/view?usp=sharing

If you're looking to insert your own data into the sheet for browsing purposes you need to get the hex values for the range 0x8D74C - 0x9189B exported as plain text with tabs between each byte and line-wrapped every 76 bytes (see the attached for an example). Once that's done it'll paste into Excel or LibreOffice with each byte going into the correct cell.

Ignore the 3DS portions of the sheet for now, it's incomplete, more curiosity than anything, and probably incorrect.

Edit: Thanks for the items, added to the first post. Regarding the missing spaces I gaps seem to mostly match up to 'missing' items from the original Adventure Map list that aren't included in the Twilight/Termina maps.

 

[Alizor]

I made a small python (2.7) console app to max rupees.

import struct, sys

if __name__ == '__main__':
    if len(sys.argv) != 2:
        print 'Usage: rupee.py app.bin'
    else:
        try:
            f = open(sys.argv[1], 'r+')
        except:
            print "Couldn't open the file."
            sys.exit(1)
        f.seek(0x14C, 0)
        f.write(struct.pack(">L",0x98967F))
        print "Done!"
        f.close()
    sys.exit(1)

Create a file (rupee.py or whatever) and put APP.BIN on the same dir and use rupee.py app.bin to modify your save.
Make a backup as always and have fun.

 

[RemixDeluxe]

This is probably killing your fun on finding out the values for this stuff but if you don't want to worry about the hour countdown just cheat for the giant item cards, beat the moon and then you'll have unlimited time. Alternatively you can also cheat the Ocarina item as many of them as needed.

 

[Deathwing Zero]

Not quite. The weapon identifier (I used the term type) is at the start of the structure, not the end. So the data starts at 0x8D74C (and the last structure starts at 0xA08C8)

You are correct, I forgot to reverse that byte.

This is probably killing your fun on finding out the values for this stuff but if you don't want to worry about the hour countdown just cheat for the giant item cards, beat the moon and then you'll have unlimited time. Alternatively you can also cheat the Ocarina item as many of them as needed.

It may be, it may not be. It's difficult to say, due to my moods. For what it's worth, however, I accepted your request to look because I enjoy doing this type of thing and I had been meaning to do it since my original post in this thread, just couldn't be bothered. I figured since I was at it I would find the data needed for the save file as well, and then help with the adventure mode items. Simple as that.

 

[Nevermore]

Boot up Hex Workshop and played with the save. Got Link to level 255 easily lol (did one less exp so he leveled up in one go).

Now I just use the TCPGecko code to poke max rupees each time to level up the rest.

Woot. Saved myself so much time grinding lol.

EDIT: That's a lot of rupees lol

Spoiler

 

[RemixDeluxe]

What do you guys do to dump your game save (and reinject it?) I'm ready to go edit now.

 

[Deathwing Zero]

What do you guys do to dump your game save (and reinject it?) I'm ready to go edit now.

Saviine DDD might dump the save, but I don't know. I use Saviine. It does require the Loadiine/Homebrew Loader Kernel explot (k10) so you can't use JGeckoU with it. It should work on 5.5.1.

 

[RemixDeluxe]

Saviine DDD might dump the save, but I don't know. I use Saviine. It does require the Loadiine/Homebrew Loader Kernel explot (k10) so you can't use JGeckoU with it. It should work on 5.5.1.

I'm currently on 5.5.1, I'll let you know how that goes.

 

[RemixDeluxe]

So are the 8-bit weapons treated as the same values as the star weapons from the 3DS version? I forgot if they are in this game too, didnt finish the Termina map.

 

[I pwned U!]

Boot up Hex Workshop and played with the save. Got Link to level 255 easily lol (did one less exp so he leveled up in one go).

Now I just use the TCPGecko code to poke max rupees each time to level up the rest.

Woot. Saved myself so much time grinding lol.

EDIT: That's a lot of rupees lol

Spoiler

Can you please help me fix my Ganondorf EXP data?

I made a bad RAM edit a while back, and now he is unable to level up anymore. He is currently stuck at Level 197.

(the attached save is now outdated, but I can always dump my latest one if that would help)

 

[RemixDeluxe]

I think I dumped my Gamesave?

Is it suppose to be 3mb with no common file?

 

[I pwned U!]

I think I dumped my Gamesave?

Is it suppose to be 3mb with no common file?

Yes, it is just a 3 MB APP.BIN file.

 

[RemixDeluxe]

Yes, it is just a 3 MB APP.BIN file.

I guess I did it right then, thank you.

I'm trying to figure out the IDs for the 8-bit weapons. Remember these werent in the 3DS version, if I discover what may be my 8-bit weapons I'll report back.

--------------------- MERGED ---------------------------

Alright I found my 8-Bit Wooden Sword and its ID is 3E, but in the 3DS version that was Magic Rod lv 4. How interesting........

I'll report back more on my findings and compile a list.

 

[RemixDeluxe]

Everytime I inject the data it just erases everything. Is there an explanation why everything would just get erased like that?

Heres the log entry

Spoiler

C:\Users\xxxxx\Desktop\Wii U\saviine03\server>saviine_server.exe inject
Injection mode!
[listener] Listening on 7332
connected
[0] Accepted connection from client xx.xxx.xxx.xxx:xxxx
[0] TitleID: 00050000-1017D800
connected
[1] Accepted connection from client xx.xxx.xxx.xxx:xxxx
[1] TitleID: 00050000-1017D800
-> inject mode
-> allocated 102912 bytes
0
-> injecting new userdata in 80000001
-> deleting user save
-> remove files in dir /vol/save/80000001
-> deleting /vol/save/80000001/APP.BIN
-> remove files in dir /vol/save/80000001/ProjectZ-SAVEDATA
-> deleting /vol/save/80000001/ProjectZ-SAVEDATA/APP.BIN
-> deleting /vol/save/80000001/ProjectZ-SAVEDATA
-> injecting files
-> file: /APP.BIN size: 3145728
-> newpath: /vol/save/80000001/APP.BIN
--> 13% ( 402 kB / 3072 kB)-> journal or storage is full, flushing it n
ow.
-> success
--> 100% (3072 kB / 3072 kB)
-> injected 1 files
-> Flushing data now
-> success
[0] Attempted to read past the end of the stream.
[0] Exit
[1] Attempted to read past the end of the stream.
[1] Exit

Also this shows up on the gamepad
https://dl.dropboxusercontent.com/u/87121071/20160512_050958.jpg

 

[BtEtta]

Deleting first just the way saviine works. I'm unsure why the inject is failing though. I assume you actually have plenty of free storage?

The 8-Bit Wooden Sword value is one off from the 3DS Magical Sword + because there's a gap in the weapon values for the Wii U version. 0x00-0x3B line up between the two versions but then on the Wii U at 0x3C there's what's probably the remnant of a deleted weapon (perhaps the Master Sword was originally going to be two separate weapons depending on whether you'd unlocked its true power or not) which I've not tested for actually putting one into the game (The in-game strings identify it as "Balloon" but it's not Tingle's Balloon)

So from Master Sword onwards the Wii U and 3DS are de-synced with the remaining weapons starting at 0x3D on the Wii U and 0x3C on the 3DS. Aside from that the 8-Bit weapons do line up to the Level 4 weapons correctly. The full (untested) list should be as in the spreadsheet I linked.

 

[RemixDeluxe]

Deleting first just the way saviine works. I'm unsure why the inject is failing though. I assume you actually have plenty of free storage?

The 8-Bit Wooden Sword value is one off from the 3DS Magical Sword + because there's a gap in the weapon values for the Wii U version. 0x00-0x3B line up between the two versions but then on the Wii U at 0x3C there's what's probably the remnant of a deleted weapon (perhaps the Master Sword was originally going to be two separate weapons depending on whether you'd unlocked its true power or not) which I've not tested for actually putting one into the game (The in-game strings identify it as "Balloon" but it's not Tingle's Balloon)

So from Master Sword onwards the Wii U and 3DS are de-synced with the remaining weapons starting at 0x3D on the Wii U and 0x3C on the 3DS. Aside from that the 8-Bit weapons do line up to the Level 4 weapons correctly. The full (untested) list should be as in the spreadsheet I linked.

I dont have a lot of space on my SD card (a little over 1GB left), but my Wii U itself has 11GB of free space. Do you think I should make room on the SD card or is that not the problem?

I got some more news to share about the weapon values but I cant 100% confirm it until my save gets injected back. Worse comes to worst I made a backup officially before messing with saviine so I dont mind restarting the edits I made if I have to.

 

[MDFang]

Hey, nice work you've done! What is your process for discovering data locations in the save file? I want to do something similar for Pokken (and it helps that Loadiine makes for easy access to save data).

Did you just copy the save, make a small change in-game, then copy the new save, and compare the two to see what changed? Is it really just a trial and error kind of process, or are there other methods? Would be cool if you could let me know, thanks!

 

[RemixDeluxe]

Hey, nice work you've done! What is your process for discovering data locations in the save file? I want to do something similar for Pokken (and it helps that Loadiine makes for easy access to save data).

Did you just copy the save, make a small change in-game, then copy the new save, and compare the two to see what changed? Is it really just a trial and error kind of process, or are there other methods? Would be cool if you could let me know, thanks!

Deathwing Zero already documented how it was done on the first page. All I did was found the identifying values for my existing data and edited from there. Nothing special.

I really wish this injecting would work so I could confirm whether these weapon values are valid or not.