Kaphotics

June 20, 2011

Yes, legal.exe is integrated into Pokecheck

June 20, 2011

move the programs to a different folder

June 19, 2011

Thank ReignOfComputer.
todos os pokemons legais na IVGen são considerados ( Common NDS <A-B-C-D>) and Pokemon obtained of eggs are considered 'hatched'??

Almost all of the Gen 4 Pokemon have ABCD, and hatched have no correlation.

June 19, 2011

I'm not sure, probably.

June 18, 2011

There are save file editors for gen 3, namely Pokemon Enciclopedia (spanish, translated on forums) and PokeStock (japanese).

PSavFix (by loadingNOW iirc) corrects the Chksum, here's the code:

####MAKEFILE####
#Change Dir to your GCC-bin dir

DIR   := C:/MinGW/bin/
CC      := $(DIR)gcc


# --- proj
PSavFix : Main.o 
$(CC) -o PSavFix Main.o

PSavFIX.o : Main.c
$(CC) -c -O3 Main Main.c
##END MAKEFILE##
---------------------------------------------------------------
####MAIN.C####
/*CODE C++*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>


int Chksum(int length, int *Data)
{
int Chk,i,tmp;
length = length>>2;
Chk=0;
for(i=0; i<length; i++)
	Chk += Data[i];

tmp = Chk>>16;
tmp +=Chk;

Chk = (tmp&0xFFFF);

return Chk;
}


int main(int argc, char** argv)
{


char *Map,*p,*header;
int *Imap,*Data;
int Found,id,fix,CHK,OK,i;
FILE *fpm, *fp;
short *MapPtr;

short FLMAP[] = { 0xF24,0xF80,0xF80,0xF80,0xEC0,0xF80,0xF80,0xF80,0xF80,0xF80,0xF80,0xF80,0xF80,0x7D0,0x01C,0x100};
short RSMAP[] = { 0x890,0xF80,0xF80,0xF80,0xC40,0xF80,0xF80,0xF80,0xF80,0xF80,0xF80,0xF80,0xF80,0x7D0,0xF80,0xF80};
short MAX[]   = { 0xF80,0xF80,0xF80,0xF80,0xF80,0xF80,0xF80,0xF80,0xF80,0xF80,0xF80,0xF80,0xF80,0xF80,0xF80,0xF80};

OK   = 1;
fix  = 0;

if(argc!=4)
{
	printf("Usage: %s [-fix|-nofix] [-RS|-FL|-MAX] [infile]\n", argv[0]);
	return 0;
}


if(!strcmp(argv[2], "-RS"))
{
	printf("Running in RS Mode\r\n");
	MapPtr = &RSMAP[0];
}
else if(!strcmp(argv[2], "-FL"))
{
	printf("Running in FL Mode\r\n");
	MapPtr = &FLMAP[0];
}
else if(!strcmp(argv[2], "-MAX"))
{
	printf("Running in MAXCompat Mode - note this mode is NOT recommented\r\n");
	MapPtr = &MAX[0];
}
else
{
	printf("Please select a mode (-RS -FL -MAX). Read readme for more Information. \r\n");
	return 0;
}



// allocate main ram and load sav
header = (char *)malloc(0x1000);
Data = (int*)header;

printf("Loading: %s...\r\n", argv[3]);
fp = fopen(argv[3], "rb+");
if (!fp)
   {
	printf("error loading sav \r\n");
       return 0;
   }	


//check if fix is ON
if(!strcmp(argv[1], "-fix"))
{
	printf("Autofix: ON\r\n");
	fix = 1;
}
else
	printf("Autofix: OFF\r\n");



for(i = 0; i<0x20; i++)
{
	fread(header, 1, 0x1000, fp);

	CHK=Chksum(MapPtr[Data[1021]&0xF], Data);
	Found = (Data[1021]>>16)&0xFFFF;
	id = (Data[1021])&0xFF;

	if((CHK==Found && Data[1022]==0x8012025) || (id==0 && CHK==0 && Found==0))
		printf("Size: %03X Segment: %02X Calc: %04X Found: %04X Sig: %08X - OK\r\n",MapPtr[Data[1021]&0xF],id, CHK,Found, Data[1022]);
	else
	{
		printf("Size: %03X Segment: %02X Calc: %04X Found: %04X Sig: %08X \r\n",MapPtr[Data[1021]&0xF],id, CHK,Found, Data[1022]);
		OK = 0;
		if(fix)
		{
			fseek(fp, -0xa,SEEK_CUR);
			header[0xff6]= (0xFF &CHK);
			header[0xff7]= (0xFF &(CHK>>8));
			Data[1022]=0x8012025;		
			p = &header[0xff6];
			fwrite(p,1,6,fp);
			fseek(fp, 0x4,SEEK_CUR);
		}

	}
}

fclose(fp);

if(OK)
	printf("No Problems found \r\n");
else
	printf("Problems found!  (remember Sig=08012025)\r\n");

return 0;
}
##END MAIN.C##

June 18, 2011

Well, it's not like we don't know the ID/SID/OT/Region, the PKM we can have easy if nobody manages to get one

June 17, 2011

My Carracosta has an "unknown encounter" (it's from Nacrene City). This could be a problem with fossils...
Also, I have a question regarding Gen 5 PIDs... I believe last time I checked some of my pokes they were alright, but now they say Invalid... It's all my JP pokemon from JP White.

Post links to them please

June 17, 2011

The ID and SID (and OT and region) of your save file has to match that of the shiny Pokemon for it to be considered yours.

Since the SID does not match your save file, it's not considered your Pokemon and is thus someone else's shiny --> "apparently"

June 17, 2011

It's just a frozen PID, nature is generated differently. We knew it was possible.

June 15, 2011

Out of curiosity I thought I'd check out my pokemon and I'm getting "Default strain (might be from hacked pokérus)" for my pokemon when I know I obtained it legitimately.
My username on the site is slash. I got pokerus randomly on Black from some wild pokemon which I killed and have spread it to all my other pokemon.

I also find it odd that I get told "Pokémon is likely edited or RNG abused." when I RNG abused other pokemon and didn't get that message.

The default strain can still be infectious to other Pokemon. It's only saying that it got infected from Gen 4 Pokerus, or it was hacked on and then spread.

June 15, 2011

Check KazoWAR's random encounter LUA script. There's certain offsets in game that need to be toggled for the encounter, but you'd then need to find out how to trigger that.

I doubt you'd be able to change the music as all of the legends have their own scripts, and wild Pokemon have their own section different from legends.

June 14, 2011

Copying the Native Video onto the Other Videos works:

14s%20Video.png

Comes with it's own blank trainer profile!

14s%20Profile.png

Viewing your own native video has the game load the encrypted one too,
it then generates your Profile when it decrypts.

Static Locations
The value at 0xA8 must match the decrypted value at 0x189C, 
which is (always) 81 E2. This signifies "end data"?
The value at 0xAA must be 00 64.
The value at 0x18A6 must match the value at 0x1900.
The value at 0x18A4 is battle video # (1-native/1/2/3)
The Value at 0x1904 is 01 00 00 00 14 19 00 00 27 35 05 31 (decryption vars?)
The value at 0x00C0 is a checksum
The Value at 0x18A0 is a checksum
The Value at 0x18A6 is a checksum
The Value at 0x1900 is a checksum
The value at 0x1912 is a checksum

Encrypted Region
The first value different between Encrypted/Decrypted is 0xC4
The first value that is the same after 0xC4 is 0x18A0

June 13, 2011

Research RAR'd up, includes battle pkms, more encrypted videos and everything else that follows and more.

This was done without using NulMyre's program as the structure is entirely different, all that I used from it was the decompiled java just to see how it worked in Platinum.

Decrypted Jenn Video

Overwriting Battle Videos

Reading the BPKM data from the RAM (identical to the decrypted data)

A little tutorial on accessing data within a Battle Video:

Upon loading the battle video, the game loads the entire VRD at 0x0226AFAC.

The video is loaded in its encrypted form, occupying 
0x0226AFAC-0x0226C8BF
Guess what, it gets decrypted by the game. Huzzah!

While in DeSmuME, Open Memory Viewer at the Battle Video Screen.
Dump All. Open .bin in HxD

copy the offsets: 0x0226AFAC-0x0226C8BF
Into a new file.
Bam, decrypted VRD, aka DBV (decrypted battle video)
Now to make sense of what the data is inside!

Program Implications: 
There are no checksums on the entire save file in regards to Battle Videos.
If you overwrite one video in the save with another downloaded one, 
it will be viewable instead! Backup and Share them!

Battle Video Structure:
Surface Summaries
Moves
Pokemon 
Trainers
Closing Summaries (???)

Battle Video PKMs are 112 bytes long (not all data is present!!!)
Offsets in Decrypted Battle Video: 
0XCFC: Max Present PKM
0xCFE: Currently Present PKM

PID		0xD00 + 0x70*pkm
Species		0xD06 + 0x70*pkm
Held Item	0xD08 + 0x70*pkm
Trainer ID	0xD0C + 0x70*pkm
Trainer SID	0xD0E + 0x70*pkm
Happiness	0xD14 + 0x70*pkm
Ability		0xD15 + 0x70*pkm
HP-EV		0xD16 + 0x70*pkm
Atk-EV		0xD17 + 0x70*pkm
Def-EV		0xD18 + 0x70*pkm
SpA-EV		0xD19 + 0x70*pkm
SpD-EV		0xD1A + 0x70*pkm
SpE-EV		0xD1B + 0x70*pkm
Move 1		0xD1C + 0x70*pkm
Move 2		0xD1E + 0x70*pkm
Move 3		0xD20 + 0x70*pkm
Move 4		0xD22 + 0x70*pkm
PP 1		0xD24 + 0x70*pkm
PP 2		0xD25 + 0x70*pkm
PP 3		0xD26 + 0x70*pkm
PP 4		0xD27 + 0x70*pkm
IVs		0xD2C + 0x70*pkm
Gender Forme	0xD30 + 0x70*pkm
NickName Field	0xD32 + 0x70*pkm
OTName Field	0xD48 + 0x70*pkm
PokeBall	0xD58 + 0x70*pkm
Origin		0xD59 + 0x70*pkm (01 is Japan, 02 is English)
Level		0xD60 + 0x70*pkm
BatlStat(maxHP)	0xD62 + 0x70*pkm
BatlStat(curHP)	0xD64 + 0x70*pkm
BatlStat(AtK)	0xD66 + 0x70*pkm
BatlStat(Def)	0xD68 + 0x70*pkm
BatlStat(SpA)	0xD6A + 0x70*pkm
BatlStat(SpD)	0xD6C + 0x70*pkm
BatlStat(SpE)	0xD6E + 0x70*pkm

For Enemy Pokemon, add 4 to the base offset as the 
max/current PKM present shifts it as well.

Some Offsets within the Battle Video that define visual cues:

0x00-0x0F - Trainer Profile (Owner of Video)
0x10-0x25 -- Trainer Profile Data
0x10-0x13 - Trainer PID
0x14 - Trainer Gender (00 Male 01 Female)
0x15 - Trainer Birth Month
0x16 - Trainer Avatar
0x17 - Trainer Nation
0x18 - Trainer SubLocale
0x1C - Trainer Pokemon Displayed (Half Word)
0x1D-0x25 - ???
0x26-0x6F -- FF Pads
0x70-0x7B -- Unused/Unknown
0x80-0xAX -- Battle Overview Data
0x80-0x8B - Team#1
0x8C-0x97 - Team#2
0xA4 - Battle # (Subway Streak)
0xA6 - Battle Mode(???)
0xA7 - Game Modes (Launcher?)
0xB8-0xBC - Battle Video ID(???)

June 13, 2011

OLD

Alrighty, after spending more time with the RAM and a few battle videos I have found out how it operates. The Pokemon Data in the RAM was only the tip of the iceberg on what was contained within

Upon clicking on a battle video, the entire encrypted battle video (which I have a few uploaded in the first post) is loaded into the RAM at offsets (0x0226BA0????).

It remains there in its entirety for a split second (one or two frames, 1/60th of a second), in which it is decrypted and left there for easy access.

If you dump the memory and copy the offsets for where the encrypted/decrypted battle video was (like in HxD), you can then just separate it out like I did from the save file. The Encrypted battle video is exactly the same, and the Decrypted battle video is the same size as well.

I would upload a decrypted battle video, but I am only able to post currently (I will upload stuff when I can).

Approximate Layout:

Trainer Profile
FFFFFFFF
Battle Video Summary
==
Battle Moves/Etc
PKM
Trainers
Closing

===========

Pokemon Data occupies 112 bytes of data for each PKM. Strangely, it includes the ingame Stats. In the decrypted battle video, they start at 0xD00. They are there for 6 Trainer#1 PKMs, then there is a 4 byte (Max/Current PKMs Present) gap in between, then the Trainer#2(opponent) PKMs are there.

===========

Battle videos can be copied on top of the others. If you copy Frank's video onto another save file's appropriate offset (to overwrite the previous video), it can be viewed in game as there is no overall checksum on the save file to check (heh). I was able to make Frank's battle video occupy all 3 slots on the "Other Videos" menu (and viewing worked of course).

===========

Confirmed the native battle video locations via battle subway.

===========

I'll have more things (offsets/structure of bpkm) when I am able to upload stuff

I don't know how to make programs/make something to decrypt

June 13, 2011

Oh I see what you mean.

I'm not sure what exactly IR-GTS sends in addition to the PKM, but it has to include some kind of trainer data as well (which probably isn't being set). That's all I know

June 12, 2011

IR-GTS is for the GTS Trading Portion, not Rendezvous.

I don't really understand what you are doing, but trying to access Rendezvous while having your DNS as the IR-GTS will not work.

June 11, 2011

Put them in PokeGen with a 4th gen game as the Game Type, then change it to 5th gen. Bam, shifted and good to go.

You can also use Kazo's pokeshift too, but it's up to you which to use for 4th gen files.

June 11, 2011

OLD

Did some looking into in the RAM (I know it's not save related but does give some insight as to what is inside the saved video).

VS. Recorder Screenshots of the Battles and Trainer Profiles (data stored on card)

VIDEO%20%26%20PROFILE.png

Other%20Videos.png

RAM Offsets of Important Information (PKM and Trainer):

Battling Trainers: 0x0226C73C
Trainer PID(???): 0x226C74C
   This data also appears at 0x10 of the VRD
   Opposing Trainer's PID not in VRD.

At 0x0226C84C, the data from 0x18A0 is loaded, and shows the rest of the data.

Team Lineup and OT Trainers of Jenn.vrd in the RAM:

Jenn:            HENRY:
Cofagrigus - Jenn    Reuniclus - HENRY
Excadrill - Jenn    Meinshao - Glacen
Swoobat - Jenn        Banette - Japanese
Scrafty - Jenn        Stoutland - HENRY
Gigalith - MASON    Accelgor - JOHN
Emboar - Jenn        Lucario - Japanese

Pokemon Data in the RAM -- woo!

112 Bytes in Between Each PKM
Brown - Pokemon PID
Green - Species
Dark Red - Happiness (?? Henry's Stoutland is mad)
Orange - Trainer PID (or ID/SID)
Yellow - Move ID
Pink - Move PP
Purple - Gender of Pokemon
Red - Pokemon Name
Blue - Trainer Name
Black - Unknown / Unused
Gray - Max HP & Battle Stats -- Right Before this is Level (32) and something else as a halfword. 

Missing: Pokeball, Met Location, Hatch Location, Version Origin, Language Origin, IVs, Ribbons, EVs, Sheen.

Pretty sure everything is in there somehow. IVs are probably right before gender.

June 11, 2011

PC Pokemon don't have data for Stats. That's all party (236) data, in which Box pokemon (136) have generated upon withdrawing.

So, there's no way to do this asides from making codes to edit your party (and thus their stats).

June 11, 2011

All this does is make the daycare man have an egg.

All generation of eggs this gen happens when you receive it, not when it is made available for pickup.

June 10, 2011

Information Consolidation of all of my posts:

VS Recorder data in the 5th gen is stored a little bit differently compared to the known Platinum convention (research done by NulMyre).
512 KB Save File offsets:
- 0x0004A000 - Native Battle Video
- 0x0004C000 - First Battle Video
- 0x0004E000 - Second Battle Video
- 0x00050000 - Third Battle Video
[*]Example Videos, extracted from the save file with HxD (Offset Range Copy), Decrypted are from RAM dumps.
- Each video is 8KB spaced, but occupies 6420 Bytes (down from 7520 in last gen).
- Jenn - Video 1 || (Decrypted Jenn Video)
- James - Video 2 || (Decrypted James Video)
- Frank - Video 3 || (Decrypted Frank Video)
- Native Video 1 || (Decrypted Native Video 1)
- Native Video 2 || (Decrypted Native Video 2)
- Native Video 3 || (Decrypted Native Video 3)
- I cropped the remaining FFs from the end of the videos, as they aren't used. Down from 8192 bytes.
[*]Research RAR

Battle Video Card Structure

0x00-0x0F - Trainer Profile (Owner of Video)
0x10-0x25 -- Trainer Profile Data
   0x10-0x13 - Trainer PID
   0x14 - Trainer Gender (00 Male 01 Female)
   0x15 - Trainer Birth Month
   0x16 - Trainer Avatar
   0x17 - Trainer Nation
   0x18 - Trainer SubLocale
   0x1C - Trainer Pokemon Displayed (Half Word)
   0x1D-0x25 - ???
0x26-0x6F -- FF Pads
0x70-0x7B -- Unused/Unknown
0x80-0xAX -- Battle Overview Data
   0x80-0x8B - Team#1
   0x8C-0x97 - Team#2
   0xA4 - Battle # (Subway Streak)
   0xA6 - Battle Mode(???)
   0xA7 - Game Modes (Launcher?)
   0xB8-0xBC - Battle Video ID(???)

Battle Process Structure

Currently Un-researched.

PKM Data Structure (.bpkm)

Battle Video PKMs are 112 bytes long (not all data is present!!!)
Offsets in Decrypted Battle Video: 
0XCFC: Max Present PKM
0xCFE: Currently Present PKM

PID		0xD00 + 0x70*pkm
Species		0xD06 + 0x70*pkm
Held Item	0xD08 + 0x70*pkm
Trainer ID	0xD0C + 0x70*pkm
Trainer SID	0xD0E + 0x70*pkm
Happiness	0xD14 + 0x70*pkm
Ability		0xD15 + 0x70*pkm
HP-EV		0xD16 + 0x70*pkm
Atk-EV		0xD17 + 0x70*pkm
Def-EV		0xD18 + 0x70*pkm
SpA-EV		0xD19 + 0x70*pkm
SpD-EV		0xD1A + 0x70*pkm
SpE-EV		0xD1B + 0x70*pkm
Move 1		0xD1C + 0x70*pkm
Move 2		0xD1E + 0x70*pkm
Move 3		0xD20 + 0x70*pkm
Move 4		0xD22 + 0x70*pkm
PP 1		0xD24 + 0x70*pkm
PP 2		0xD25 + 0x70*pkm
PP 3		0xD26 + 0x70*pkm
PP 4		0xD27 + 0x70*pkm
IVs		0xD2C + 0x70*pkm
Gender Forme	0xD30 + 0x70*pkm
NickName Field	0xD32 + 0x70*pkm
OTName Field	0xD48 + 0x70*pkm
PokeBall	0xD58 + 0x70*pkm
Origin		0xD59 + 0x70*pkm (01 is Japan, 02 is English)
Level		0xD60 + 0x70*pkm
BatlStat(maxHP)	0xD62 + 0x70*pkm
BatlStat(curHP)	0xD64 + 0x70*pkm
BatlStat(AtK)	0xD66 + 0x70*pkm
BatlStat(Def)	0xD68 + 0x70*pkm
BatlStat(SpA)	0xD6A + 0x70*pkm
BatlStat(SpD)	0xD6C + 0x70*pkm
BatlStat(SpE)	0xD6E + 0x70*pkm

   For Enemy Pokemon, add 4 to the base offset as every trainer has leading Max/Current PKM before the PKM Field.

Trainers Battling

Somewhere after bpkm

Closing

Currently un-researched.

My posts before the last edit date may not be current information.

June 7, 2011

There is no IV-PID relation for 5th Gen Pokemon.

Pokesav sucks.

June 5, 2011

not nature

0x40 is nature

ability is the 16th bit, not the 32nd.

xxxYxxxx

June 5, 2011

Cheshire cat does it for me.

June 2, 2011

Read every page in this thread.

Delete Pokesav.

Sign In

Profiles

Pokédex

Portal

Technical Documentation

Pages

Tutorials

Forums

Events

Downloads

Gallery

Blogs

Posts posted by Kaphotics