White 2 Dream Radar flags?

[AyanamiRei0]

Hi I've been trying to find the flags for White 2 that gets set after I've transferred over the Tornadus from the Dream Radar but so far I've had no luck finding it and also the flags that decide what legendaries I've caught like the Latias that's in the dreamyard so If anyone knows where they may be that would be great.

Thanks also mods If I've put this in the wrong section of the forum I'm sorry.

Edited March 14, 2017 by AyanamiRei0

[AyanamiRei0]

I'm sorry for already bumping this but I literately spent all day yesterday trying to figure that out so if any knows where they may that would be great.

 

Thanks.

[theSLAYER]

I believe no one replied, simply because no one knows.

I'll say the rest way to find out is to compare before and after saves.

Given that BWB2W2 is 2 generations back,and there are other ways to obtain the legendaries,
I'm guessing it's not on high priorities on most peoples' list.


Perhaps if you give an exact breakdown of what you're looking for,
people who know the information may reply.

[BlackShark]

Dream Radar data is at 0x7F000 - 0x7F095.

0x00 - 0x0F some kind of header?

0x10 - 0x11 CRC-16-CCITT over 0x00 - 0x0F

0x12 - 0x13 FF FF

0x14 - 0x33 legendary Pokemon (8 x 4 Bytes)

0x34 - 0x4B normal Pokemon (6 x 4 Bytes)

0x4C - 0x63 Items (6 x 4 Bytes)

0x63 - 0x93 unknown

0x94 - 0x95 CRC-16-CCITT over 0x14 - 0x93

I started doing research a few years ago but then I lost interest. This is all I currently know. Also I guess the data is encrypted somehow.

[AyanamiRei0]

Yeah I thought the hex was the the correct place sucks that it's encrypted

[theSLAYER]

If this is anything similar to what we experiences in ORAS Mirage Island hunting,
you may be able to get around it by replacing the entire block, and just correcting the checksum,
provided it's locked by TID/SID

Also, what are you trying to do, inject Dream Radar Pokemon?

I've got a 3DS with CFW, Dream Radar, and white 2 cartridge.

If you need an actual Oni to be sent to your game to unlock the Mirror, I can probably help.

[AyanamiRei0]

How does the Mirage Island hunting work in ORAS I've never done it before and for the Mirror I've already got in White 2.

[theSLAYER]

Formula derived here:

You can read the entire thread to see the progress before the formula was found.

[BlackShark]

Oh well the encryption key is actually at 0x0C but once you received your Pokemon it gets zero'd.

EDIT: See here https://projectpokemon.org/forums/forums/topic/40323-white-2-dream-radar-flags/?do=findComment&comment=211659

 

Edited March 19, 2017 by BlackShark

[AyanamiRei0]

Yeah no matter what sort of editing I do to the area with a hex editor it will either send the Pokemon from Dream Radar then when in game tells me that it's corrupt and it will format the data and the other case it won't send it through Dream Radar just gives me a error.

Edited March 16, 2017 by AyanamiRei0

[theSLAYER]

14 minutes ago, AyanamiRei0 said:

Yeah no matter what sort of editing I do to the area with a hex editor it will either send the Pokemon from Dream Radar then when in game tells me that it's corrupt and it will format the data and the other case it won't send it through Dream Radar just gives me a error.

after you do editing,
open the save in PKHeX, shift stuff around, then save the save.
(so that PKHeX corrects the checksums for you)

[AyanamiRei0]

Hmm I'll try that I didn't think of doing that.

[AyanamiRei0]

Yeah that didn't work for what I first tried I'm a bit confused about the mirage island thing as well.

[theSLAYER]

What is it you're trying to accomplish, exactly?

What's the end game here?

If I understand what you really want, maybe I can help.

[AyanamiRei0]

I just want to be able to send the Genies from Dream Radar to my save file since if already got them I can't resend them I just wanted to know of a way around the fact I can't send them back without injecting a pre sent over one from this site

[theSLAYER]

hmm, if you had a save from before you sent the genies over,
you could simply take that block and replace it entirely.

Perhaps it's a different place as shown by BlackShark,
because what he showed was the gift slot,
but it sounds like all you need is a flag to be unchecked.

So my suggestion is to compare before and after saves.

[AyanamiRei0]

6 hours ago, theSLAYER said:

hmm, if you had a save from before you sent the genies over,
you could simply take that block and replace it entirely.

Perhaps it's a different place as shown by BlackShark,
because what he showed was the gift slot,
but it sounds like all you need is a flag to be unchecked.

So my suggestion is to compare before and after saves.

I did all that and well Dream Radar didn't see anything wrong with the save file but after going into the game and then it told me that it was corrupted and it just resets the file to the state it was before the hex edit there must be something else I'm missing since I don't see why Dream Radar didn't see anything wrong with it while White 2 itself saw something wrong with it.

Edited March 17, 2017 by AyanamiRei0

[BlackShark]

Check offset 0x25E00. There you can find the encryption key and maybe there are some flags as well. You would need to compare the area after the mentioned offset between saves from before and after using the Dream Radar.

[suloku]

Maybe this feature is already in pockestock?
I wanted to look into this, but no motivation right now. If it's already in pockestock it would certainly help to document.

I have before and after saves for all legendaries in black2, if anyone wants them to check the catch/uncatch flags.
Also, if there are already re-battle AR codes, enabling it and saving after just loading a game should be the quickest way to locate the flag for save editing purposes.
 

[BlackShark]

4 hours ago, suloku said:

Maybe this feature is already in pockestock?
I wanted to look into this, but no motivation right now. If it's already in pockestock it would certainly help to document.

I have before and after saves for all legendaries in black2, if anyone wants them to check the catch/uncatch flags.
Also, if there are already re-battle AR codes, enabling it and saving after just loading a game should be the quickest way to locate the flag for save editing purposes.
 

Yes Pokestock has this feature. It's in PokeTrainerS at the bottom right corner, the AR button.  The structure I have posted above is pretty much complete.

Here are a few re-battle codes that I know.

Zekrom/Reshiram
Hold Select while entering the top floor.
94000130 FFFB0000
B2000024 00000000
10036C0C 00000000
D2000000 00000000

Kyurem
Hold Select while entering the room.
94000130 FFFB0000
B2000024 00000000
10036D18 00000000
D2000000 00000000

Lati@s
Press Select
94000130 FFFB0000
B2000024 00000000
10020A38 00000005
D2000000 00000000

Volcarona
Press Select
94000130 FFFB0000
B2000024 00000000
10036BF8 00000000
D2000000 00000000

 

[suloku]

Here you can a guide about how to use pokestock for dream radar legendaries: https://www.reddit.com/r/pokemonrng/comments/2ezvry/guide_pokestock_entralink_and_dream_radar/

It doesn't mention anything about only being able to retrieve the legendaries once, so maybe pockestock also takes care of the received flag? I guess testing is needed.
BlackShark, does all the block get zeroed after receiving the pokemon/items? Also, the unused byte in the pokémon structure maybe is the ability modifier? I'll have to catch some Dream radar and start some transfers...

[BlackShark]

On 18.3.2017 at 10:18 AM, suloku said:

Here you can a guide about how to use pokestock for dream radar legendaries: https://www.reddit.com/r/pokemonrng/comments/2ezvry/guide_pokestock_entralink_and_dream_radar/

It doesn't mention anything about only being able to retrieve the legendaries once, so maybe pockestock also takes care of the received flag? I guess testing is needed.
BlackShark, does all the block get zeroed after receiving the pokemon/items? Also, the unused byte in the pokémon structure maybe is the ability modifier? I'll have to catch some Dream radar and start some transfers...

After receiving the data only the first byte, the encryption key at 0xC and the unknown value at 0x4 get erased. The Pokemon and item data is kept there. I guess a new encryption key is set by the Dream Radar each time data is transfered and the unknown value is taken from 0x25E00.

EDIT: See here https://projectpokemon.org/forums/forums/topic/40323-white-2-dream-radar-flags/?do=findComment&comment=211659

I don't think there's an ability modifier in the structure as they should always have their hidden abilities. But maybe they planned to implement Pokemon without hidden abilities.

 

[AyanamiRei0]

It's pretty hard trying to use a program with a broken Japanese UI

[BlackShark]

Damn I got confused in my post above. I should have tested on real hardware instead of relying on my 3 year old notes and crappy Pokestock lol.

Actually the header values are zero when the data is transfered from the Dream Radar. The values get set by the game when receiving the data. 0xC is the encryption key, but it i only used by the DR to encrypt the next transfered data. The key to decrypt the data is at 0x90.

Also I finally found the flags that were responsible for the legendaries! They are at 0x25E04 and get set by the game when receiving the data. The DR itself only touches the 152 bytes at 0x7F000.

Save Offset  0x25E00
0x00  unknown (changes when the data is received)
0x04  legendary received flags
0x08  1 after DR data was received the first time, does not increase

Legendary received flags
Bit Pokemon
0   Tornadus
1   Thundurus
2   Landorus
3   Dialga
4   Palkia
5   Giratina
6   Ho-Oh
7   Lugia
======================================================================
 
Save Offset  0x7F000 (the Dream Radar itself only touches this area!)
 
0x00         received/not received flag (1 after the Pokemon were received)
0x01 - 0x03  0x000000
0x04 - 0x07  unknown (derived from offset 0x25E00) (0x00000000 if the Pokemon were not yet received)
0x08 - 0x0B  always 0x43524746 (CRGF)
0x0C - 0x0F  Encryption Key used for the next transfer from DR (0x00000000 if the Pokemon were not yet received)
0x10 - 0x11  CRC-16-CCITT over 0x00 - 0x0F
0x12 - 0x13  0x0000
0x14 - 0x33  legendary Pokemon (see values below) (8 x 4 Bytes)
0x34 - 0x4B  normal Pokemon (6 x 4 Bytes)
0x4C - 0x63  Items (6 x 4 Bytes)
0x63 - 0x8F  probably unused (all zero)
0x90 - 0x93  Decryption Key
0x94 - 0x95  CRC-16-CCITT over 0x14 - 0x93
0x96 - 0x97  0x0000

Legendary Pokemon Values
0x80808080  Tornadus
0x92567284  Thundurus
0x87643567  Landorus
0x96436763  Dialga
0x43867368  Palkia
0x17693572  Giratina
0x44798367  Ho-Oh
0x96636983  Lugia
 
Pokemon Structure
0x00         Gender (0 - Male, 1 - Female, 2 - Genderless)
0x01         unknown/unused
0x02 - 0x03  Species ID
 
Item Structure
0x00 - 0x01  Quantity
0x02 - 0x03  Item ID

EDIT:

Unfortunately it's not enough to just reset the flags at 0x25E04. It seems the unknown value 0x25E00 has something to do with the legendaries as well. That value is randomly created at the beginning of each save file but it changes when receiving the Pokemon/Items.

EDIT2:

I still don't know how the DR detects if a Pokemon has already been received, but I overlooked that legendary Pokemon seem to be handled similar like the Key System data. I don't know if there's also a unique ID or where it is. 0x04 can't be it because it's not constant while the values for the legendarys are.

Edited March 19, 2017 by BlackShark

[AyanamiRei0]

I had the theory that it was linked the save file itself with some bytes that get overwritten after you transfer for the first time with Dream Radar seems like I was correct.