gbadev.org forum archive

This is a read-only mirror of the content originally found on forum.gbadev.org (now offline), salvaged from Wayback machine copies. A new forum can be found here.

DS development > Attention Cheaters

#30155 - mymateo - Sun Nov 28, 2004 11:36 pm

If you have Feel the Magic: XY/XX for the DS, you may be aware that you can unlock certain hairstyles by plugging in certain games (refer to your manual or GameFaqs for full list).

I just want you to know you don't need these games, so no piracy is needed, and you CAN avaoid those high-charge game rentals!

I just tried this and it WORKED. Feel the Magic only looks for the proper name and/or compliment check and/or manufacturer for the cart. I took the latest incarnation of my Marle demo and hacked it with a hex reader. Here's what I did...

Looked up info for Sonic Advance 3:
Internal Name SONIC ADVANC
Serial AGB-B3SP-EUR
Complement 68h

At 0xA0, I changed the name to 'SONIC ADVANC'. You MUST keep this to 12 characters! Such is luck, the title was already 12 chars long, so no need to figure out how to pad properly.

At 0xAC, I took the Serial from above, and used the middle part to fill in the "game code". I took some info from the GBArm readme, and it says the game code starts with "A" normally, but I thought 'Naw, let's try this instead' because the 2nd and 3rd chars are the game name shortened, so Sonic 3 could be "3S", or 3 Sonic. Makes sense? And since the info I took was for a european Sonic 3, it makes sense that the last char would be P for Europe (J = Japan and Asia, E stands for North America, P stands for other PAL areas such as Australia, Europe, and Africa). So I put in "B3SP".

Finally, the third change I made was the compliment check to the CRC. I couldn't change the CRC directly, as I don't know what the proper CRC is for my Marle demo and therefore couldn't find out what to change there so I left it. But the compliment check is found at 0xBD, as is 2 bytes long. So I changed it to the same as Sonic 3, flashed the demo to my cart, popped it in a VOILA! Unlocked a hairstyle. I was dumbfounded! I didn't even pad out the ROM, so I thought for sure with the wrong size ROM, wrong header, and probably wrong Game Code it wouldn't work BUT IT DID!

If anyone want to try this, go ahead! I was using a 64M F2A card, I don't know if other cards will work. And if you want, I'll even send you my modified demo to try for yourself, just PM me.

I'm so proud of myself, I'm usually no good at stuff like this...

#30156 - Abscissa - Sun Nov 28, 2004 11:46 pm

Coolness :)

#30328 - caitsith2 - Tue Nov 30, 2004 10:03 am

Want to know why you don't need the full game. The developers are not allowed to use anything but the first 4K of the rom for identification purposes, excluding the Nintendo Logo data area. Also, the only other part the developers may read from a gba cart, if it is being used for identification purposes only, is the save area. The only case that a developer may read past these limits, is when they have 100% positively identified it as one of their own carts, and are using the assets contained within.

Most often, only the standard header area, internal title, 4 byte game ID, complement check, and rom revision number is needed to positively identify a game.

#30329 - Mr. Ploppy - Tue Nov 30, 2004 10:05 am

Excellent work! I'm impressed by your unorthodox technique and ability to actually pull it off. We need more innovators like you, mymateo. It's too bad my old flash card doesn't fit the DS, or I'd be running tests like this too. Simply outstanding!
_________________
I'm just off to Hartleypool to buy some exploding trousers. Cluck, cluck, gibber, gibber, "my old man's a mushroom", et cetera.