Jump to content

Pokémon Black & White Entralink Forest tool 0.1 --> dream pokemon wondercard-like! (Arceus event included)


suloku
 Share

Recommended Posts

  • Replies 57
  • Created
  • Last Reply

Top Posters In This Topic

Haven't looked into it, but I wanted to. I don't recall if the forest data was exactly the same for BW2, but anyway first I should find a way to identify if the save file is from B/W or Black 2/White 2, since both savefiles are the same size.

If the forest structure is the same for bw2, it would be very easy to make it work with their saves.

EDIT: just looked at the save structures and I think that reading the bw1 checksum table and seeing if it has the correct checksum, then testing for the bw2 table and assume that if it is correct the save is from that game is safe enough. I guess checking ALL sections would be better though, since identifying a BW1 save as a BW2 save should be almost impossible.

Hey guys, just wanna let you know if not already mentioned, that you could successfully inject some Pokemon on the Entree forest of BW2 using the PokeCgear tool. Though the DW Arceus Event data corrupts some of the forest's section when imported and is not advisable to use... Even so, the tool allows an entire legit area in the forest to be populated in the BW2 data file. I guess the memory location of the forest does not differ much from the structure of the original BW games albeit some modifications are made. Afterall, those two games are made of the same Gen V engine.

I also think that it would be super cool if animation manipulation could be added on the PokeCgear to make the Pokemon on the forest have a more "Live" feel to it in the overworld. (Well, by allowing the user to modify the extra bytes mentioned on this thread... though its not that necessary...)

Anyways here are some of the screenshots that I have tested from the game... I only used Area 1 and the Last Area...

[ATTACH=CONFIG]12806[/ATTACH] [ATTACH=CONFIG]12807[/ATTACH]

Link to comment
Share on other sites

Hey guys' date=' just wanna let you know if not already mentioned, that you could successfully inject some Pokemon on the Entree forest of BW2 using the PokeCgear tool. Though the DW Arceus Event data corrupts some of the forest's section when imported and is not advisable to use... Even so, the tool allows an entire legit area in the forest to be populated in the BW2 data file. I guess the memory location of the forest does not differ much from the structure of the original BW games albeit some modifications are made. Afterall, those two games are made of the same Gen V engine.[/quote']

The efd provided by suloku works on B2W2 as well. It's just his tool which is currently only compatible with BW.

The structure of the data is the same in both. The only different is the adress where it can be found. 0x22C00 for BW, 0x22A00 for B2W2.

At the moment injection is only possible manually via a Hex Editor.

I also think that it would be super cool if animation manipulation could be added on the PokeCgear to make the Pokemon on the forest have a more "Live" feel to it in the overworld. (Well' date=' by allowing the user to modify the extra bytes mentioned on this thread... though its not that necessary...)[/quote']

That won't happen because development on PokeCGear was discontinued about 3 years ago.

Link to comment
Share on other sites

  • 2 months later...

Some progress update of the tool I'm working on:

Entralink forest editor: http://puu.sh/ny8PS/a2f2b04b17.png

Medal editor: http://puu.sh/ny99l/6f90c8a817.jpg

The app works fo both BW1 and BW2. For now the planned features are: entralink editor (with "Legit mode", only allowing pokemon and moves actually released on dream world), Medal editor (still need to find more values), Trainer records editor (still need to find more values), Other records stored in other blocks, Rival name editing (I think this can't be done in any editor), Link memory injection/editing (I'll include my own file and allow some changes, mainly trainer name, if I can find more about the structure, even import hall of fame from BW savefile). Also, if I can, I'd like to find how the key system works and allow to unlock the 3 extra keys (since it is an IR only feature).

I'm researching record and high score values mostly for medal editing consistency.

Basically I aim to be able to modify those things that aren't covered by pockestock/pokegen already, but the primary goal are the lost online features.

ps: it's my first time working with objects, so don't expect it to be fancy, I just expect it to work as intended.

Link to comment
Share on other sites

I wasn't planning to add items, but give how easy the structure is, I might as well add it even though pokéstock also has them. Are those offsets for BW1 or BW2?

ps: I've re-discovered (or so I've been told) how the keys in the key system are stored in the savegame.

EDIT: Key system structure (block 69)

The first 0x27 bytes hold data regarding black tower and treehollow unlocked areas. Still need to be mapped.

0x00-0x07 - Unknown
0x08-0x17 - Seems always 0x00
0x18-0x27 - Unknown
0x28 - Easy key (W) 				- 0x00035691
0x2C - Challenge key (B) 			- 0x00018256
0x30 - Tower Key (B)/ Treehollow key (W)	- 0x00059389
0x34 - Iron Key (B) 				- 0x00048292
0x38 - Iceberg Key (W)  			- 0x00009892
0x3C - Easy mode unlocked			- 0x00093389
0x40 - Challenge mode unlocked 			- 0x00022843
0x44 - Black City / White forest unlocked 	- 0x00034771
0x48 - Iron chamber unlocked 			- 0x000AB031
0x4C - Iceberg chamber unlocked 		- 0x000B3818
0x50 - Difficulty config (easy 0x00031239 | normal 0x00015657 | challenge 0x00049589)
0x54 - Black city/White city config (black city 0x00034525| white city 0x00011963)
0x58 - Chamber config (rock 0x00094525 | iron 0x00081963 | iceberg 0x00038569)
0x5C - Unique ID used to xor the keys (also present in memory link block)
0x60 - Counter
0x62 - ccrit checksum

To store a key/unlock in savegame, the u32 value needed is Unique ID xored with the key seed.
For some reason they used the same slot for the Tower/Treehollow key, but the chamber key and difficulty key each have their own slots, allowing a single save to hold 5 keys, and probably that allows impossible transfers, like a black 2 game transfering the easy key or the iceberg key. As I only have 1 cartridge and this uses the IR feature, I can't test (but there's really no need).

Edited by suloku
Link to comment
Share on other sites

Thanks, I'll try looking into it. Since it was easy, I've coded the key system editor, it is already on github. Should I make a thread? Some of the editors aren't still fully functional, but the block dumper/injector, checksum verify/update and key system editor are complete (unless I add more things).

Btw it now accepts sav/dsv files, but only outputs as raw sav.

Link to comment
Share on other sites

  • 3 weeks later...
  • 2 months later...

No, dev on the tool is stalled for now. You can use ppkecgear or pikasav, they both allow entralink forest editing.

My ultimate goal for entralink editing is to have a "legal" mode were you can only insert pokemon you could actually get on dream world or pgl events like arceus (I'd need some info on the later though, not sure if those are always added to the special section of the forest or what...but once captured they all have the same characteristics though).

Link to comment
Share on other sites

Mine will be able to, but saving changes to forest is still not implemented. I wonder why those don't allow area 8 unlocking, was that area legitimately unlockable when dream world was running?

I never got chance to use the dream world feature when it was working. I only have limited knowledge about its features. Therefore I only use editor to insert pokemon in the entree forest.

Link to comment
Share on other sites

So, here is a small guide, I hope it is understandable. If something is unclear don't hesitate to ask. I'll try to improve the guide.

Be sure to keep a backup of your file! I'm not responsible for any damage!

How to edit the Entralink Forest

Structure

General Structure

0x000 - 0x84B   encrypted data
0x84C - 0x84F   initial encryption seed
0x850 - 0x851   update counter
0x852 - 0x853   checksum from 0x000 - 0x84F (CRC16-CCITT)
0x854 - 0x8FF   unused (filled with 0x00 or 0xFF)

Decrypted Data Structure (0x000 - 0x84B)

3 x 20 Pokemon in each area from 1 - 8.
3 x 10 Pokemon in 9th area.
20 Pokemon in the deepest area.

0x000   deepest area
0x050   9th area center
0x078   9th area left
0x0A0   9th area right
0x0C8   1st area center
0x118   1st area left
0x168   1st area right
0x1B8   2nd area center
0x208   2nd area left
0x258   2nd area right
0x2A8   3rd area center
0x2F8   3rd area left
0x348   3rd area right
0x398   4th area center
0x3E8   4th area left
0x438   4th area right
0x488   5th area center
0x4D8   5th area left
0x528   5th area right
0x578   6th area center
0x5C8   6th area left
0x618   6th area right
0x668   7th area center
0x6B8   7th area left
0x708   7th area right
0x758   8th area center
0x7A8   8th area left
0x7F8   8th area right
0x848   unlock area 9 (0x01 to unlock)
0x849   unlock areas 3 - 8 (0x01 - 0x06) (area 1 & 2 and the deepest area are unlocked by default -> 0x00)
0x84A   0x00
0x84B   0x00

Pokemon Structure (4 bytes)

Bits
00-10   species
11-20   special move
21-22   gender (0 -> male, 1 -> female, 2 -> genderless)
23-27   form (see below)
28-31   animation (see below)

Forms

Unown
0 A
...
25 Z
26 !
27 ?

Deoxys
0 Normal
1 Attack
2 Defense
3 Speed

Burmy/Wormadam
0 Plant
1 Sand
2 Trash

Shellos/Gastrodon
0 West
1 East

Rotom
0 Normal
1 Heat
2 Wash
3 Frost
4 Fan
5 Mow

Giratina
0 Altered
1 Origin

Shaymin
0 Land
1 Sky

Basculin
0 Red
1 Blue

Deerling/Sawsbuck
0 Winter
1 Spring
2 Summer
3 Autumn

Meloetta
0 Aria
1 Pirouette

Animations

0	randomly turning around
2	randomly walking
4	randomly walking
6	walking up/down
8	walking left/right
10	walking left/right and randomly looking up/down
12	turning around clockwise
14	turning around counterclockwise
All odd numbers are invalid for animations and will make the Pokemon invisible.

Dumping the data

The data is stored at the following offsets in the save files.

BW 0x22C00 - 0x234FF

B2W2 0x22A00 - 0x232FF

The whole block has a size of 2304 (0x900) Bytes, but only offset 0 - 0x853 are used. The rest is filled with 0x00 or 0xFF.

If you used suloku's tool, you got the whole block. Though keep in mind that the tool currently only works with BW!

If you extract it manually with an hex editor you need to decrypt the data before it can be edited.

Decryption/Encryption

The initial seed is taken from the data at 0x84C - 0x84F.

New seeds are calculated via the LCRNG algorithm.

The upper 16 bits of the new seeds are XORed against the data (0x000 - 0x84B) (as words) to encrypt/decrypt.

seed = (0x41C64E6D * seed + 0x6073);
data = data ^ (seed >> 16);

Editing Pokemon

See Bulbapedia for lists of Pokemon from each of the DW Areas Dream World Areas (available Pokemon).

Pokemon that were never available in the DW can technically be in the Entralink Forest too. Though not every Pokemon has an overworld sprite in the 5th generation games. Those will get a generic sprite of some guy.

Each Pokemon consists of 4 Bytes which are structured in Bits.

The Bytes are stored Big Endian so you have to reverse them before you can edit them (AA BB CC DD becomes DD CC BB AA).

Convert these Bytes into Bits and you will get the following structure.

[color="#800080"]0000[/color][color="#008000"]0000 0[/color][color="#FFA500"]00[/color][color="#0000FF"]00000 00000[/color][color="#FF0000"]000 00000000[/color]

Bits (counted from right to left)
[color="#FF0000"]00-10[/color]   species
[color="#0000FF"]11-20[/color]   special move
[color="#FFA500"]21-22[/color]   gender (0 -> male, 1 -> female, 2 -> genderless)
[color="#008000"]23-27[/color]   form
[color="#800080"]28-31[/color]   animation

To edit a Pokemon you take the index number of it's species or special move and convert them to Bits.

Take the lower 11 Bits from the species index and the lower 10 Bits from the move index and put them at the corresponding place.

Do the same for gender, form and animation.

For the indexes refer to Bulbapedia Pokemon by index number Moves by index number

Forms and animations are listed in the structure above.

Example:

I want to create a randomly walking male Ralts with Destiny Bonds.

Species index is 280 (0x0118) which is 00000001 00011000 in Bits.

Move index is 194 (0x00C2) which is 00000000 11000010 in Bits.

Gender is male so I keep those Bits 00

Animation should be randomly walking which is 2 and in Bits 0010

I can put them into the right structure now and get this: 00100000 11000010001 00011000

I convert the Bits to Bytes and get 0x01 0x06 0x11 0x18 and reversed (remember Big Endian!) 0x18 0x11 0x06 0x01.

This can be inserted into one of the forest areas. For example at offset 0x1C4 to insert it into a slot in the center of the second forest area.

Unlocking Forest Areas

Area 1 and 2 are unlocked by default, if you want to unlock the remaining 6 areas you have to edit offset 0x849. Just set it to the number of areas that you want to unlock.

If you want to unlock them all, set 0x849 to 0x06. Don't try any higher number, it will break your game!

There's a special 9th area which can be unlocked by setting offset 0x848 to 0x01.

Inserting the forest data into the save file

Once you have edited what you want you can insert the data back to your save file.

First you need to re-encrypt the decrypted data section (see above). Then you have to fix the checksum of the encrypted data by calculating a CRC16-CCITT from offset 0x000 - 0x84F.

If that is done insert the data back to your save file at the following offset.

BW 0x22C00 - 0x234FF

B2W2 0x22A00 - 0x232FF

Finally fix the checksums of your save file and you are done!

Link to comment
Share on other sites

I don't understand how to decrypt the forest data. It is difficult for me. Can you please tell me how to do this. The of hex data at 0x84C - 0x84F is 'b0 65 7e fe' . Please give some more examples for the Decryption of encrypted data.

Well, doing the decryption manually probably isn't a good idea. You could do that but it probably takes a long time.

I attached a tool I made a while ago. You can use it to decrypt/encrypt your file. Simply drag and drop your file onto the exe. Checksum will also be fixed, so the file is ready for injection.

Currently it doesn't detect if your file is decrypted or encrypted. But if you look at the hex data and see many zeros (pr at least 0x84A and 0x84B if your forest is full) it is decrypted. Otherwise it's encrypted.

Use it in the mean time until suloku adds encryption to his editor.

Link to comment
Share on other sites

How many 5th gen pokemon sprites are available in entree forest?

Good question, they made a few for BW2, don't really know if they made more than just the ones available at dream world. What happens when putting a species that doesn't have a sprite?

I don't understand how to decrypt the forest data. It is difficult for me. Can you please tell me how to do this. The of hex data at 0x84C - 0x84F is 'b0 65 7e fe' . Please give some more examples for the Decryption of encrypted data.

I'm re-starting work on my tool, for now just gonna try finishing the entralink forest editor as I have little free time, if you really want to manually edit, I can upload a binary of the current build (allows to dump/inject and decrypt/encrypt any block from the savefile). The source has been on github since... february? but there was no binary.

Other features I wanted to add might slowly come through the year (my free time is gonna be drastically reduced starting july until february).

Link to comment
Share on other sites

Good question, they made a few for BW2, don't really know if they made more than just the ones available at dream world. What happens when putting a species that doesn't have a sprite?

As BlackShark mentioned in his post #44. When I was trying to insert some 5th gen pokemons 'a generic sprite of some guy' appear but the function of that pokemon doesn't have any changes. I also checked every pokemons from 1 to 4 gen and each one of them have their own sprites.

Link to comment
Share on other sites

As BlackShark mentioned in his post #44. When I was trying to insert some 5th gen pokemons 'a generic sprite of some guy' appear but the function of that pokemon doesn't have any changes. I also checked every pokemons from 1 to 4 gen and each one of them have their own sprites.

Here's an image of all the overworld sprites in 5th generation http://www.spriters-resource.com/ds/pokemonblackwhite2/sheet/48050/

Here's a list of Unova Pokemon that have overworld sprites. Only 53 are available.

Watchog

Herdier

Liepard

Pansage

Pansear

Panpour

Pidove

Zebstrika

Boldore

Woobat

Drilbur

Audino

Gurdurr

Tympole

Throh

Sawk

Leavanny

Scolipede

Cottonee

Petilil

Basculin (Red/Blue)

Krookodile

Maractus

Crustle

Scraggy

Sigilyph

Tirtouga

Garbodor

Minccino

Gothorita

Duosion

Ducklett

Vanillite

Emolga

Karrablast

Alomomola

Galvantula

Klang

Elgyem

Litwick

Axew

Cubchoo

Shelmet

Stunfisk

Mienfoo

Druddigon

Golett

Pawniard

Bouffalant

Braviary

Mandibuzz

Heatmor

Durant

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...