content search

Cursor Hacking and Advanced Tracing

in article > Guides: Gameboy Advanced

Cursor Hacking and Advanced Tracing
Written By Labmaster

Megaman Battle Network 4.5 Real Operations (J) - Unlock all Navis

Do not be put off by the fact that we are hacking a Japanese game, this tutorial contains many useful techniques for ASM hacking.

It is taken that you have read Kenobi GBA ASM tutorials, and have a working knowledge of THUMB assembly. You will need
  • VBA Normal (or H version)
  • VBA SDL (k or H version)
  • Goldroad (optional, for the custom ASM routines)
  • The GBA Technical Document
  • A MMBN4.5 ROM


The first step is to locate the actual address of the Navi Flags. We will be using a technique I like to call Cursor Hacking to obtain this. Cursor hacking basically involves using the address of a cursor value as a basis for an ASM trace. You could find the Navi Flags using the traditional not-equal searches, but in this case, the game had just come out, and I really did not want to wade through a game I did not understand to unlock some characters (not knowing how exactly this is accomplished) to get the code.

Load up the ROM in VBA. Start up a new game, and get up to the Navi Selection screen (for those unfamiliar with MMBN (or japanese), it\'s the screen where you can choose between 4 pictures).
The point of cursor hacking, is to first try to find the value which holds the position of the cursor. So, do greater than searches when you move the cursor right, less than when it goes left, and equal when it\'s in the same spot.

Looking at the results, it\'s either 0200f55c or 0200fdc6. Freeze (using \'Add Cheat) the first address to 0, the second to 1. You\'ll see it goes to the first pic, and as the value is a 0-based index, it\'s the first address we are interested in.

Next, remove the cheats, make a savegame on the selection screen then load the ROM up in SDL. We are now going to snoop around the routine which writes the cursor value to try and find the flags. Stick a bpw on 0200f55c for 1 byte. Move the cursor and we\'ll break at 08039204. Take a look at the routine in VBA\'s (normal) Disassembler (THUMB mode).
080391fa 2200 mov r2, #0x0
080391fc 5cb8 ldrb r0, [r7, r2]
080391fe 4200 tst r0, r0
08039200 d0f1 beq $080391e6
08039202 732a strb r2, [r5, #0xc]
08039204 bd90 pop {r4,r7,pc}


tst rx, rx instructions are used to check if a byte is 1\'set\' or not. It\'s quite likely that the value loaded at 080391fc is important.

From your breakpoint, you\'ll see that r7 + r2 = 0201e80x, depending on which Navi you had the cursor over. Go into normal VBA, load up your Navi-select screen savestate, and goto 0201e800. You\'ll see that the first 4 bytes are set to \'01\', the remainder are \'0\'. And there\'s four Navi\'s that you can currently select...

Add 3201e804 0001 (CBA code). This sets the 5th byte to 0. Now try and select the 5th Navi - you won\'t see it, but it\'s there, and selectable.

However, these aren\'t the actual flags. If you reset the game, enable the codes then go to the selection screen, the Navi won\'t be there (even though you can \'select\' it). We\'ve only found an intermediate value, and whilst you may be tempted to use this as a code, it\'s not very impressive.

The game will write these bytes before the Navi screen is displayed, so switch back to SDL, disable any breakpoints, and reset the game. Get to the screen before the selction screen (a confirmation box, by the look of it) and stick a bpw on 0201e800 (the byte corresponding to the first Navi) for 1 byte.
Breakpoint (on write) address 0201e800 old:11 new:01
R00=00000001 R04=0201e800 R08=00000000 R12=00004210
R01=00000080 R05=00000000 R09=03005c7f R13=030076e0
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=02004dc6 R07=0200f2c0 R11=00000000 R15=080394f2
CPSR=0000003f (......T Mode: 1f)
080394f0 3501 add r5, #0x1
debugger>

And here is the routine (courtesy of an SDL dt)
080394dc 1c28 add r0, r5, #0x0
080394de f7ff bl $08039498
080394e2 f000 bl $08039536
080394e6 d001 beq $080394ec
080394e8 2001 mov r0, #0x1
080394ea e000 b $080394ee
080394ec 2000 mov r0, #0x0
080394ee 5560 strb r0, [r4, r5]
080394f0 3501 add r5, #0x1
080394f2 2d17 cmp r5, #0x17
080394f4 d1f2 bne $080394dc


This routine cycles through for each Navi (there is 22 of them, hence the cmp r5, #0x17). The two subroutines at the top check if you have got the Navi. The rest of the code just sets the corresponding byte to 1 or 0. To understand what is going on, we have to step through the routine.


Place a BT at 080394dc and let the game break. You now have two choices - manually enter n until you reach 080394f2, or, if you have my H version of SDL, enter in

lf 080394f2 traceout.txt /a



This automatically dumps the output into a file in the same directory as the ROM.

traceout.txt
[1]
R00=00000000 R04=0201e800 R08=00000000 R12=00004210
R01=00000002 R05=00000000 R09=03005c7f R13=030076e0
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039019

R03=ffffffff R07=0200f2c0 R11=00000000 R15=080394de
CPSR=6000003f (.ZC...T Mode: 1f)
080394dc 1c28 add r0, r5, #0x0
[2]
R00=00000000 R04=0201e800 R08=00000000 R12=00004210
R01=00000002 R05=00000000 R09=03005c7f R13=030076e0
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039019
R03=ffffffff R07=0200f2c0 R11=00000000 R15=080394e0
CPSR=6000003f (.Z....T Mode: 1f)
080394de f7ff bl $08039498
[3]
R00=00000000 R04=0201e800 R08=00000000 R12=00004210
R01=00000002 R05=00000000 R09=03005c7f R13=030076e0
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=080384e2
R03=ffffffff R07=0200f2c0 R11=00000000 R15=080394e2
CPSR=6000003f (.Z....T Mode: 1f)
080394e0 ffdb blh $0fb6
[4]
R00=00000000 R04=0201e800 R08=00000000 R12=00004210
R01=00000002 R05=00000000 R09=03005c7f R13=030076e0
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=080394e3
R03=ffffffff R07=0200f2c0 R11=00000000 R15=0803949a
CPSR=6000003f (.Z....T Mode: 1f)
08039498 4b01 ldr r3, [$080394a0] (=$080394a4)
[5]
R00=00000000 R04=0201e800 R08=00000000 R12=00004210
R01=00000002 R05=00000000 R09=03005c7f R13=030076e0
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=080394e3
R03=080394a4 R07=0200f2c0 R11=00000000 R15=0803949c
CPSR=6000003f (.Z....T Mode: 1f)
0803949a 5c18 ldrb r0, [r3, r0]
[6]
R00=00000000 R04=0201e800 R08=00000000 R12=00004210
R01=00000002 R05=00000000 R09=03005c7f R13=030076e0
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=080394e3
R03=080394a4 R07=0200f2c0 R11=00000000 R15=0803949e
CPSR=6000003f (.Z....T Mode: 1f)
0803949c 46f7 mov pc, lr
[7]
R00=00000000 R04=0201e800 R08=00000000 R12=00004210
R01=00000002 R05=00000000 R09=03005c7f R13=030076e0
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=080394e3
R03=080394a4 R07=0200f2c0 R11=00000000 R15=080394e4
CPSR=6000003f (.Z....T Mode: 1f)
080394e2 f000 bl $08039536
[8]
R00=00000000 R04=0201e800 R08=00000000 R12=00004210
R01=00000002 R05=00000000 R09=03005c7f R13=030076e0
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=080394e6
R03=080394a4 R07=0200f2c0 R11=00000000 R15=080394e6
CPSR=6000003f (.Z....T Mode: 1f)
080394e4 f828 blh $0050
[9]
R00=00000000 R04=0201e800 R08=00000000 R12=00004210
R01=00000002 R05=00000000 R09=03005c7f R13=030076e0
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=080394e7
R03=080394a4 R07=0200f2c0 R11=00000000 R15=08039538
CPSR=6000003f (.Z....T Mode: 1f)
08039536 b510 push {r4,lr}
[10]
R00=00000000 R04=0201e800 R08=00000000 R12=00004210
R01=00000002 R05=00000000 R09=03005c7f R13=030076d8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=080394e7
R03=080394a4 R07=0200f2c0 R11=00000000 R15=0803953a
CPSR=6000003f (.Z....T Mode: 1f)
08039538 1c04 add r4, r0, #0x0
[11]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=00000002 R05=00000000 R09=03005c7f R13=030076d8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=080394e7
R03=080394a4 R07=0200f2c0 R11=00000000 R15=0803953c
CPSR=6000003f (.Z....T Mode: 1f)
0803953a f7cc bl $08005f78
[12]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=00000002 R05=00000000 R09=03005c7f R13=030076d8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=0800553e
R03=080394a4 R07=0200f2c0 R11=00000000 R15=0803953e
CPSR=6000003f (.Z....T Mode: 1f)
0803953c fd1d blh $0a3a
[13]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=00000002 R05=00000000 R09=03005c7f R13=030076d8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=080394a4 R07=0200f2c0 R11=00000000 R15=08005f7a
CPSR=6000003f (.Z....T Mode: 1f)
08005f78 b5fe push {r1-r7,lr}
[14]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=00000002 R05=00000000 R09=03005c7f R13=030076b8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=080394a4 R07=0200f2c0 R11=00000000 R15=08005f7c
CPSR=6000003f (.Z....T Mode: 1f)
08005f7a 4d06 ldr r5, [$08005f94] (=$02004800)
[15]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=00000002 R05=02004800 R09=03005c7f R13=030076b8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=080394a4 R07=0200f2c0 R11=00000000 R15=08005f7e
CPSR=6000003f (.Z....T Mode: 1f)
08005f7c 4657 mov r7, r10
[16]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=00000002 R05=02004800 R09=03005c7f R13=030076b8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=080394a4 R07=0200f2c0 R11=00000000 R15=08005f80
CPSR=6000003f (.Z....T Mode: 1f)
08005f7e 219c mov r1, #0x9c
[17]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=0000009c R05=02004800 R09=03005c7f R13=030076b8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=080394a4 R07=0200f2c0 R11=00000000 R15=08005f82
CPSR=6000003f (......T Mode: 1f)
08005f80 587f ldr r7, [r7, r1]
[18]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=0000009c R05=02004800 R09=03005c7f R13=030076b8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=080394a4 R07=0200a270 R11=00000000 R15=08005f84
CPSR=6000003f (......T Mode: 1f)
08005f82 5c29 ldrb r1, [r5, r0]
[19]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=000000bd R05=02004800 R09=03005c7f R13=030076b8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=080394a4 R07=0200a270 R11=00000000 R15=08005f86
CPSR=6000003f (......T Mode: 1f)
08005f84 22e7 mov r2, #0xe7
[20]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=000000bd R05=02004800 R09=03005c7f R13=030076b8
R02=000000e7 R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=080394a4 R07=0200a270 R11=00000000 R15=08005f88
CPSR=6000003f (......T Mode: 1f)
08005f86 4051 eor r1, r2
[21]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=0000005a R05=02004800 R09=03005c7f R13=030076b8
R02=000000e7 R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=080394a4 R07=0200a270 R11=00000000 R15=08005f8a
CPSR=6000003f (......T Mode: 1f)
08005f88 5c3a ldrb r2, [r7, r0]
[22]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=0000005a R05=02004800 R09=03005c7f R13=030076b8
R02=0000005a R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=080394a4 R07=0200a270 R11=00000000 R15=08005f8c
CPSR=6000003f (......T Mode: 1f)
08005f8a 4291 cmp r1, r2
[23]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=0000005a R05=02004800 R09=03005c7f R13=030076b8
R02=0000005a R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=080394a4 R07=0200a270 R11=00000000 R15=08005f8e
CPSR=6000003f (.ZC...T Mode: 1f)
08005f8c d000 beq $08005f90
[24]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=0000005a R05=02004800 R09=03005c7f R13=030076b8
R02=0000005a R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=080394a4 R07=0200a270 R11=00000000 R15=08005f92
CPSR=6000003f (.ZC...T Mode: 1f)
08005f90 bdfe pop {r1-r7,pc}
[25]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=00000002 R05=00000000 R09=03005c7f R13=030076d8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=080394a4 R07=0200f2c0 R11=00000000 R15=08039540
CPSR=6000003f (.ZC...T Mode: 1f)
0803953e d108 bne $08039552
[26]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=00000002 R05=00000000 R09=03005c7f R13=030076d8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=080394a4 R07=0200f2c0 R11=00000000 R15=08039542
CPSR=6000003f (.ZC...T Mode: 1f)
08039540 4b05 ldr r3, [$08039558] (=$00000ed0)
[27]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=00000002 R05=00000000 R09=03005c7f R13=030076d8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=00000ed0 R07=0200f2c0 R11=00000000 R15=08039544
CPSR=6000003f (.ZC...T Mode: 1f)
08039542 18c0 add r0, r0, r3
[28]
R00=00000ed0 R04=00000000 R08=00000000 R12=00004210
R01=00000002 R05=00000000 R09=03005c7f R13=030076d8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=00000ed0 R07=0200f2c0 R11=00000000 R15=08039546
CPSR=6000003f (......T Mode: 1f)
08039544 1c01 add r1, r0, #0x0
[29]
R00=00000ed0 R04=00000000 R08=00000000 R12=00004210
R01=00000ed0 R05=00000000 R09=03005c7f R13=030076d8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=00000ed0 R07=0200f2c0 R11=00000000 R15=08039548
CPSR=6000003f (......T Mode: 1f)
08039546 0a00 lsr r0, r0, #0x08
[30]
R00=0000000e R04=00000000 R08=00000000 R12=00004210
R01=00000ed0 R05=00000000 R09=03005c7f R13=030076d8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=00000ed0 R07=0200f2c0 R11=00000000 R15=0803954a
CPSR=6000003f (..C...T Mode: 1f)
08039548 0609 lsl r1, r1, #0x18
[31]
R00=0000000e R04=00000000 R08=00000000 R12=00004210
R01=d0000000 R05=00000000 R09=03005c7f R13=030076d8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=00000ed0 R07=0200f2c0 R11=00000000 R15=0803954c
CPSR=6000003f (N.....T Mode: 1f)
0803954a 0e09 lsr r1, r1, #0x18
[32]
R00=0000000e R04=00000000 R08=00000000 R12=00004210
R01=000000d0 R05=00000000 R09=03005c7f R13=030076d8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=0803953f
R03=00000ed0 R07=0200f2c0 R11=00000000 R15=0803954e
CPSR=6000003f (......T Mode: 1f)
0803954c f7ef bl $080287ae
[33]
R00=0000000e R04=00000000 R08=00000000 R12=00004210
R01=000000d0 R05=00000000 R09=03005c7f R13=030076d8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08028550
R03=00000ed0 R07=0200f2c0 R11=00000000 R15=08039550
CPSR=6000003f (......T Mode: 1f)
0803954e f92f blh $025e
[34]
R00=0000000e R04=00000000 R08=00000000 R12=00004210
R01=000000d0 R05=00000000 R09=03005c7f R13=030076d8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=00000ed0 R07=0200f2c0 R11=00000000 R15=080287b0
CPSR=6000003f (......T Mode: 1f)
080287ae 0200 lsl r0, r0, #0x08
[35]
R00=00000e00 R04=00000000 R08=00000000 R12=00004210
R01=000000d0 R05=00000000 R09=03005c7f R13=030076d8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=00000ed0 R07=0200f2c0 R11=00000000 R15=080287b2
CPSR=6000003f (......T Mode: 1f)
080287b0 4308 orr r0, r1
[36]
R00=00000ed0 R04=00000000 R08=00000000 R12=00004210
R01=000000d0 R05=00000000 R09=03005c7f R13=030076d8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=00000ed0 R07=0200f2c0 R11=00000000 R15=080287b4
CPSR=6000003f (......T Mode: 1f)
080287b2 b500 push {lr}
[37]
R00=00000ed0 R04=00000000 R08=00000000 R12=00004210
R01=000000d0 R05=00000000 R09=03005c7f R13=030076d4
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=00000ed0 R07=0200f2c0 R11=00000000 R15=080287b6
CPSR=6000003f (......T Mode: 1f)
080287b4 4653 mov r3, r10
[38]
R00=00000ed0 R04=00000000 R08=00000000 R12=00004210
R01=000000d0 R05=00000000 R09=03005c7f R13=030076d4
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=0200f2c0 R07=0200f2c0 R11=00000000 R15=080287b8
CPSR=6000003f (......T Mode: 1f)
080287b6 6c9b ldr r3, [r3, #0x48]
[39]
R00=00000ed0 R04=00000000 R08=00000000 R12=00004210
R01=000000d0 R05=00000000 R09=03005c7f R13=030076d4
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=02004bec R07=0200f2c0 R11=00000000 R15=080287ba
CPSR=6000003f (......T Mode: 1f)
080287b8 08c1 lsr r1, r0, #0x03
[40]
R00=00000ed0 R04=00000000 R08=00000000 R12=00004210
R01=000001da R05=00000000 R09=03005c7f R13=030076d4
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=02004bec R07=0200f2c0 R11=00000000 R15=080287bc
CPSR=6000003f (......T Mode: 1f)
080287ba 185b add r3, r3, r1
[41]
R00=00000ed0 R04=00000000 R08=00000000 R12=00004210
R01=000001da R05=00000000 R09=03005c7f R13=030076d4
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=02004dc6 R07=0200f2c0 R11=00000000 R15=080287be
CPSR=6000003f (......T Mode: 1f)
080287bc 0740 lsl r0, r0, #0x1d
[42]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=000001da R05=00000000 R09=03005c7f R13=030076d4
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=02004dc6 R07=0200f2c0 R11=00000000 R15=080287c0
CPSR=6000003f (.Z....T Mode: 1f)
080287be 0f40 lsr r0, r0, #0x1d
[43]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=000001da R05=00000000 R09=03005c7f R13=030076d4
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=02004dc6 R07=0200f2c0 R11=00000000 R15=080287c2
CPSR=6000003f (.Z....T Mode: 1f)
080287c0 2180 mov r1, #0x80
[44]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=00000080 R05=00000000 R09=03005c7f R13=030076d4
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=02004dc6 R07=0200f2c0 R11=00000000 R15=080287c4
CPSR=6000003f (......T Mode: 1f)
080287c2 40c1 lsr r1, r0
[45]
R00=00000000 R04=00000000 R08=00000000 R12=00004210
R01=00000080 R05=00000000 R09=03005c7f R13=030076d4
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=02004dc6 R07=0200f2c0 R11=00000000 R15=080287c6
CPSR=6000003f (......T Mode: 1f)
080287c4 7818 ldrb r0, [r3, #0x0]
[46]
R00=000000e0 R04=00000000 R08=00000000 R12=00004210
R01=00000080 R05=00000000 R09=03005c7f R13=030076d4
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=02004dc6 R07=0200f2c0 R11=00000000 R15=080287c8
CPSR=6000003f (......T Mode: 1f)
080287c6 4208 tst r0, r1
[47]
R00=000000e0 R04=00000000 R08=00000000 R12=00004210
R01=00000080 R05=00000000 R09=03005c7f R13=030076d4
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=02004dc6 R07=0200f2c0 R11=00000000 R15=080287ca
CPSR=6000003f (......T Mode: 1f)
080287c8 bd00 pop {pc}
[48]
R00=000000e0 R04=00000000 R08=00000000 R12=00004210
R01=00000080 R05=00000000 R09=03005c7f R13=030076d8
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=02004dc6 R07=0200f2c0 R11=00000000 R15=08039552
CPSR=6000003f (......T Mode: 1f)
08039550 bd10 pop {r4,pc}
[49]
R00=000000e0 R04=0201e800 R08=00000000 R12=00004210
R01=00000080 R05=00000000 R09=03005c7f R13=030076e0
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=02004dc6 R07=0200f2c0 R11=00000000 R15=080394e8
CPSR=6000003f (......T Mode: 1f)
080394e6 d001 beq $080394ec
[50]
R00=000000e0 R04=0201e800 R08=00000000 R12=00004210
R01=00000080 R05=00000000 R09=03005c7f R13=030076e0
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=02004dc6 R07=0200f2c0 R11=00000000 R15=080394ea
CPSR=6000003f (......T Mode: 1f)
080394e8 2001 mov r0, #0x1
[51]
R00=00000001 R04=0201e800 R08=00000000 R12=00004210
R01=00000080 R05=00000000 R09=03005c7f R13=030076e0
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=02004dc6 R07=0200f2c0 R11=00000000 R15=080394ec
CPSR=6000003f (......T Mode: 1f)
080394ea e000 b $080394ee
[52]
R00=00000001 R04=0201e800 R08=00000000 R12=00004210
R01=00000080 R05=00000000 R09=03005c7f R13=030076e0
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=02004dc6 R07=0200f2c0 R11=00000000 R15=080394f0
CPSR=6000003f (......T Mode: 1f)
080394ee 5560 strb r0, [r4, r5]

R00=00000001 R04=0201e800 R08=00000000 R12=00004210
R01=00000080 R05=00000000 R09=03005c7f R13=030076e0
R02=00000002 R06=0000fc00 R10=0200f2c0 R14=08039551
R03=02004dc6 R07=0200f2c0 R11=00000000 R15=080394f2
CPSR=6000003f (......T Mode: 1f)
080394f0 3501 add r5, #0x1


I\'m not going to explain this in too much detail, because it is not really the point of the tutorial
08005f78 b5fe push {r1-r7,lr}
08005f7a 4d06 ldr r5, [$08005f94] (=$02004800)
08005f7c 4657 mov r7, r10
08005f7e 219c mov r1, #0x9c
08005f80 587f ldr r7, [r7, r1] (=$0200a270)
08005f82 5c29 ldrb r1, [r5, r0]
08005f84 22e7 mov r2, #0xe7
08005f86 4051 eor r1, r2
08005f88 5c3a ldrb r2, [r7, r0]
08005f8a 4291 cmp r1, r2
08005f8c d000 beq $08005f90
08005f8e 2001 mov r0, #0x1
08005f90 bdfe pop {r1-r7,pc}

This is a very interesting routine, that Capcom have used in their Megaman/Rockman games since Battle Network 4. It is a form of tamper protection (and a strange one at that). In addition to the Navi flags, there are two other arrays in RAM - one at 02004800, and one at 0200a270. Each byte represents one Navi. The above routine loads the byte for the Navi in the 02004800 array, XORs that value by 0xE7, then compares it with the byte from the 0200A270 array. If they are equal, we are all sweet - if not, then the game assumes you have cheated and weird things happen

At the time I was hacking this game, I had a sneaking suspicion that the data in one of those arrays was important - if we modified it ourselves, it would cause all sorts of problems. If this was not the case, such an elaborate protection did not really make sense. Because of this, I wrote a rather elaborate ASM routine that hooked into one of the sound routines that ran in IWRAM, to fill the 0200a270 table based on the data at 02004800, so that everything was preserved.

As it turns out, the data didn\'t seem to be needed, so there is a much simpler solution. Simply use two slide codes, one for 02004800, one at 0200a270, and fill them with values such that when you XOR them together, the result is 0xE7.

So what we get is
42004800 0000
0000000B 0002
4200A270 E7E7
0000000B 0002


Now, all that is left to do is find out where the actual Navi flags are stored. This is not too hard
080287b2 b500 push {lr}
080287b4 4653 mov r3, r10
080287b6 6c9b ldr r3, [r3, #0x48]
080287b8 08c1 lsr r1, r0, #0x03
080287ba 185b add r3, r3, r1
080287bc 0740 lsl r0, r0, #0x1d
080287be 0f40 lsr r0, r0, #0x1d
080287c0 2180 mov r1, #0x80
080287c2 40c1 lsr r1, r0
080287c4 7818 ldrb r0, [r3, #0x0]
080287c6 4208 tst r0, r1
080287c8 bd00 pop {pc}


Yet another tst instruction. Chances are this is testing the actual navi flags. If we take a look at our tracelog, we see that r3 is equal to 02004dc6.

So, that about wraps it up. With a little bit of experimentation, we find that the two halfwords at this address holds the flags for all navis

82004DC6 FFFF
82004DC8 FFFF



And that is it. Our final code is
42004800 0000
0000000B 0002
4200A270 E7E7
0000000B 0002
82004DC6 FFFF
82004DC8 FFFF
All trademarks are copyright their respective owners, all other content is copyright Codemasters Project
Date / Time
 
Select Theme


Google AdSense
Online
Guests: 1
Team Members: 0
Team Login
Username:

Password:


Remember me

[ Forgot password? ]
Render time: 0.0761 second(s); 0.0359 of that for queries. DB queries: 159. Memory Usage: 1mb