SciresM

Download links at the bottom of this post.

Please do not submit wondercards edited with this program to the Event Contributions.

This is a program that allows you to view the details of (and edit) 6th Generation Wondercard (.wc6) files.

If you want to inject a wondercard in to your save, use PKHeX.

Credits:

• Kaphotics, for making PKHeX, without which this program could not exist.
  

Update History:

12-11-14: Added support for ORAS exclusive stuff.

8-10-14: Fixed "Flawless" mistake as well as added OTGender control.

Downloads:

WC6 Editor.zip

WC6 Editor (ORAS Support).zip

Wow, thats an aweseome progress! :-) I'll be very pleased, when you guys next working on a savegame editor for Powersaves 3DS or to make it compatible with PKHeX.

Or another point: Convert Gateway 3DS (.3dz) savefiles to Powersaves 3DS (.bin) savesfiles!

Greets

Traiver

Neither of these is doable and neither will happen in the forseeable future.

O_O Oh my gosh, where did you find that link?! I thought I'd looked everywhere on their site and couldn't find it, so have been (most likely) annoying everyone in sight of this forum for that!!! THANK YOU! (So hope it works using the AR ProActionSave hardware... otherwise I'll cry...)

edit: sob... figures that's how it'd be... Probably no one has a way to make it recognize the PowerSave adapter instead of the Cyber one? (Are they really that different?)

Not possible.

They really are that different.

Download links at the bottom of this post.

You need a Japanese 3DS, a Japanese Pokemon X/Y/OR/AS cartridge, and the CyberGadget save device to use this.

If you have trouble running this program, try running it as an administrator.

This is a modified version of the Cybergadget 3DS Save Editor executable that is both in English (though a japanese version is provided as well) and allows for direct editing of one's pokemon x/y save with PKHeX.

You still need a Japanese 3DS, a Japanese Pokemon X/Y/OR/AS cartridge, and the CyberGadget save device to use this.

Use 3DSSaveEditor_en.exe for English, and 3DSSaveEditor_ja.exe for Japanese.

Instructions:

Credits:

• Glitch, for providing me with translations for all the strings contained in the cybergadget executable.
  
• Kaphotics, for modifying the exe to interrupt and allow for direct editing with PKHeX.
  

Downloads:

3DSSaveEditor_en.zip

3DSSaveEditor_ja.zip

In ORAS you can share secret bases via QR code.

This seems like an obvious thing to try to decrypt.

There are a few qrs posted to the various foreign language websites (Example: http://www.pokemonrubysapphire.com/_ui/img/_en/july/screenshots/july_p26_07_bbp.jpg ), and I'm attaching the binaries the QR codes detail in a zip here:

I know we're almost certainly not going to be able to figure out much until ORAS release and we can generate QR codes ourselves, but if anyone sees anything notable post it here.

Initial things of interest: Lots of 0x11EC at the end, all of them start with "40 23".

qr_oras.zip

Guide to completely decrypting Save1:

Download my brute forcer: http://www.mediafire.com/download/sk2o1qt9t161j6q/Pokemon_XY_Save_File_Brute_Forcer.exe

Complete the steps listed in my earlier post on getting saves open with PKHeX: http://projectpokemon.org/forums/showthread.php?37269-X-Y-Save-File-Research&p=183148

In the first brute forcer box, select + open save1keystream.bin.

Now (make sure you have a backup of your current save file before doing this), Delete your save file from the in-game menu (hit up+x+b at title screen) and start a new game. Save once. ONLY SAVE ONCE. THIS IS IMPORTANT.

Backup your save using powersaves. In the second brute forcer box, select this backup.

Now, apply the "Master Ballsx999" cheat over your new game in powersaves. Remove your cart from the dongle. Re-insert your cart into the dongle. (Doing that is ALSO important.)

Backup your save with the cheat applied using powersaves. In the third brute forcer box, select this backup.

Now, hit the "Brute force saves" box. If all goes well (And it should), you should get a success message and the ability to save Save1Key.bin.

Save Save1Key.bin wherever you want. You can now use it the way you used save1keystream.bin before now, but it completely 100% decrypts all of save1. (50% of your saves will open with no "hash verification failed" messages in PKHeX". Before Datel patched my exploit, this allowed you to inject things into the game. You can no longer use this to inject new things.)

I have succesfully decrypted 100% of my save. I can inject whatever the fuck I want: http://i.imgur.com/Eb8EEEJ.jpg

\o/

Here's my world of problems after attempting everything, step by step, you said to do Scires. Unless I'm missing something? Perhaps a tutorial with pictures/step by step, or a video on youtube or something might help those of us who apparently can't get it right. Namely Newbs like me.

Note 1-

I did it again, following the instructions to a T and it did the same issue whenever I tried to open the edited file with FF's. Is there a specific block I am supposed to FF up to? Or not go past? My method thus far has been to FF a chunk then copy and paste that over all the other blocks so I didn't have to hold down FF the entire time, unless that's what I'm supposed to do? Does it matter that I copy and pasted the FF's since they all turned to y's on the side anyhow? - Also, is there a trick I'm missing when it comes to loading the edited file? The back up that HxD made (looking exactly like the first one) is read by Powersaves (bin file) but not the one I edited. It has the same header, same everything, and without the -FIX'd at the end. Btw, the files yours create are just 'files' so I have to delete the FIXED part and add in .bin myself. Still doesn't read. I know I'm missing something critical here but for the life of me I can't figure out what.

Pics of the Issues/Errors

This below is the error message I got while trying to do the Datel Checksum from your program.

See the end of this message for details on invoking

just-in-time (JIT) debugging instead of this dialog box.

************** Exception Text **************

System.IndexOutOfRangeException: Index was outside the bounds of the array.

at Datel_Checksum_Fixer.Form1.button1_Click(Object sender, EventArgs e)

at System.Windows.Forms.Control.OnClick(EventArgs e)

at System.Windows.Forms.Button.OnClick(EventArgs e)

at System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)

at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)

at System.Windows.Forms.Control.WndProc(Message& m)

at System.Windows.Forms.ButtonBase.WndProc(Message& m)

at System.Windows.Forms.Button.WndProc(Message& m)

at System.Windows.Forms.Control.ControlNativeWindow.OnMessage(Message& m)

at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)

at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)

************** Loaded Assemblies **************

mscorlib

Assembly Version: 4.0.0.0

Win32 Version: 4.0.30319.18449 built by: FX451RTMGDR

CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll

----------------------------------------

Datel Checksum Fixer

Assembly Version: 1.0.0.0

Win32 Version: 1.0.0.0

CodeBase: file:///C:/Users/Riptor.000/Desktop/Datel%20Checksum%20Fixer.exe

----------------------------------------

System.Windows.Forms

Assembly Version: 4.0.0.0

Win32 Version: 4.0.30319.18046 built by: FX45RTMGDR

CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll

----------------------------------------

System.Drawing

Assembly Version: 4.0.0.0

Win32 Version: 4.0.30319.18022 built by: FX45RTMGDR

CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll

----------------------------------------

System

Assembly Version: 4.0.0.0

Win32 Version: 4.0.30319.18045 built by: FX45RTMGDR

CodeBase: file:///C:/Windows/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll

----------------------------------------

************** JIT Debugging **************

To enable just-in-time (JIT) debugging, the .config file for this

application or computer (machine.config) must have the

jitDebugging value set in the system.windows.forms section.

The application must also be compiled with debugging

enabled.

For example:

<configuration>

<system.windows.forms jitDebugging="true" />

</configuration>

When JIT debugging is enabled, any unhandled exception

will be sent to the JIT debugger registered on the computer

rather than be handled by this dialog box.

File length should be 0x10009C. Only set 0x9C-0x10009C to 0xFF.

Also, if you want Powersaves to see a save file, it needs to end in after the last ")" in the name -- remove the " - copy" for powersaves to detect it.

Oh ok. Thanks anyway. Will there ever be pkx injecting without a hacked console?

Unlikely. And there HAS to be one involved somewhere because of the AES-MAC.

So replace every byte past 0x9C with FF 0000009C - 010009C I had to ask to be more specific.

Yes.

Guide to getting your save file open in PKHeX:

Make a backup with Powersaves.

Make a copy of that backup, and replace all of the bytes in the copy past 0x9C with FF: http://i.snag.gy/lem0O.jpg

Next, download my Datel checksum corrector ( http://www.mediafire.com/download/kn2am0u4ae66s21/Datel_Checksum_Fixer.zip ). Open it up and open the edited copy, then hit save. (Remove the " - [fixed]" from the savename so that powersaves will see it.).

Now, open powersaves, and restore the edited FF save file. (You should see two saves with identical names, it's the second one.).

Put your cartridge into your 3ds, and go to the main menu. Then, close the game and put the cartridge back in the powersaves dongle.

In powersaves, apply the "Slot 1 x999 modifier code." After doing that, remove your cart from the powersaves dongle, then stick it back in. Now make a backup of your cartridge's save file.

At this point, you can restore your original save file backup.

The backup you just made after applying the code, removing the cart, and putting it back in has garbage default data in SAVE2, but a completely blank SAVE1 -- this means it is just your xorpad for save1.

At this point, make a copy of the backup you just made and rename it save1keystream.bin for easy remembering ability.

You can now use this to open a save in PKHeX! If you want to open a save, XOR save1keystream.bin with the powersaves backup of whatever save you want to check out (I recommend http://www.nirsoft.net/utils/xorfiles.html ), and then delete the first 0x9C bytes in a hex editor (I use HxD). Save the file with the 0x9C header removed, and you can open it in PKHeX totally fine: http://i.snag.gy/x2jJ8.jpg

Fused Zekrom/Reshiram storage is at 0x1B400:

I found, after much searching, where "Lumiose Style" is stored in the save. It's a single integer value ranging from 0-255. Buying something increases style by 2. Asking alexa to show you around increases style by 5. More values to come when I catalog them.

Discounts are as follows on the megastone in the stone emporium (Thanks, Kaphotics, for the chart):

Stage---Style--Price

0--------0-----1,000,000

1--------10----700,000

2--------25----300,000

3--------50----150,000

4--------90----100,000

5--------140---70,000

6--------190---50,000

7--------255---10,000

Edit: I got around to logging how much style everything in lumiose is worth: https://docs.google.com/spreadsheet/ccc?key=0AgF4wNipOQuCdC1obHRfU3JnUG5JZ0ZCNmRnMW1Xd1E

Just dumped the item numbers for most of the Key items and all of the new TMs:

Town map - 1BA - 442

Holo Caster - 281 - 641

Adventure Rules - 2BF - 703

Roller Skates - 283 - 643

Exp Share - 0D8 - 216

Sprinklotad - 2B1 - 689

Dowsing Machine - 1D7 - 471

Intriguing Stone - 2B9 - 697

Mega Ring - 2B8 - 696

Power Plant Pass - 2B7 - 695

Elevator Key - 2BC - 700

Honor of Kalos - 2BE - 702

TMV Pass - 2BD - 701

Vs Recorder - 1D1 - 465

Pokeradar - 1AF - 431

Bicycle - 1C2 - 450

Super Rod - 1BF - 447

Shiny Charm - 278 - 632

Oval Charm - 277 - 631

Lens Case - 2C1 - 705

Looker Ticket - 2C8 - 712

Prof's Letter - 282 - 642

--

TM100 - 2B6 - 694

TM99 - 2B5 - 693

TM98 - 2B4 - 692

TM97 - 2B3 - 691

TM96 - 2B2 - 690

Edit: Got Lens Case and Looker Ticket

Edit 2: Got Prof's Letter