Apache Thunder

Oh...Well I'm not aware of having him not pester you with advice/having the sad eyes. I think that always happens? I just found the event flag for him and disabled it. I finished all the story line stuff so that was my solution to the issue.

Rotem dex? Disabling him is easy. Just toggle event flag 4071 in pkHeX. Be sure to do it after that forced roto loto event in the storyline at the second Pokecenter you go to on the first island. Aside from that turning him off has no further side effects aside from not having access to minimap and the camera thing for taking photos of pokemon.

That's what I figured. Looks like the horizontal values never actually seem to use all 4 bytes though. The game really limits how far I can zoom/pan. The rotation and zoom offsets seems to though. Though last byte for zoom is always 0x3D normally.

Interesting. I used a value of "0xEA40" for 0x146A and got it zoomed to the right foot of the trainer. (trainer facing the camera). Hm....

Hmm the horizontal offset works for me. But perhaps it doesn't work like the vertical one? I moved the camera to the right (moving the character to the left) and values started to appear in offset 0x146A. It seems higher values moves camera to the right. But to move it to the left? Maybe offset 0x1468 is used for this? I've seen data here on occasion and at one point thought it was related. Might actually be. You could try using that offset if wanting to move the camera to the right instead of the left. (default center position has offset 0x146A be all zero so can't use it to go in other direction) Edit: Correction increasing offset 0x146A seems to be moving the camera to the left, not the right.

I found the data that stores camera position/trainer rotation of the Trainer Passport Photo in Ultra Moon. (offsets likely the same for Ultra Sun as well) It's not stored as a image. It's dynamically generated via simple camera position/rotation. All values appear to be little endian. There is probably a offset for storing what frame the idle animation should be at. Have not attempted to find that. (it's too settle a change to even bother modifying unless you zoomed into to a body part that moves around significantly) Zoom and rotation values appear to use 4 bytes. But not horizontal and vertical? Offset 146A = Avatar Camera Horizontal position? 2 Bytes? Offset 146E = Avatar Camera Vertical Position? 2 Bytes? (lower number = lower camera position) Offset 1470 = Avatar Camera Zoom (4 Bytes. Last byte always 0x3D usually if within legal bounds. Lower number = closer zoom in.) Offset 1474 = Avatar Rotation data? (4 bytes?) (Default rotation is all zero) I've managed to alter photo to zoom in on my trainer's left hand. The game normally doesn't allow this. You can also use a higher zoom value to make the trainer appear further away then normal. Higher values in the zoom offset decreases zoom while lower values increase zoom. The last byte is always 3D if using "legal" values generated by the game. So after conversion to big endian the zoom value the game stores is always in the 0x3Dxxxx range. Of coarse it can be manually altered beyond that value. The best way to get a camera position you want is it first use the game to rotate the trainer to the position you want and move the camera to the closes position you are targeting. Not sure how viable it would be to have PkHeX able to edit this data. I guess it could use slider controls for this? Also I found offsets that store what clothing items you have stored. Not really figured out what all the valid values are. But I did confirm that if you use a value that doesn't exist, the game resets the trainer to default clothing. So unlike 6th gen games, folks can't do the weird stuff like make the head invisible or anything. Have not attempted to use male items on female trainer. I believe in that instance the game would just either hang or reset the clothing to default. So PkHeX can probably allow modifying this too. Unlike 6th gen, Sun/Moon seem to have better checking on this so there won't be anything glitchy you can do with this. My original goal is to unequip the bag. But it seems to not be possible. OffSet 145A = Bag Type The offsets for the other items are close by. Haven't written them down though since i was looking for the bag specifically but they are in that area. So some file comparing with different items equipped can easily narrow that down for you. As I recall I could do this in 6th gen. Maybe the better checks 7th gen does means I can't unequip this item. Also some info I found regarding map ids: Normally Inaccessible MapIDs: (areas you can't go to and still be able to use normal bottom screen UI to save game/etc) 246 = Ultra Megalo Tower Elevator room. 243 = Battle Agency Starting Arena (Will activate Festival Plaza UI on bottom screen if saved and reloaded from here) The only part of Festival Plaza that doesn't cause game crashes. 242 = Festival Plaza (inside Castle) Talking to NPCs or attempting to leave will crash the game. Though you are able to use ride pager to fly to a different area. 241 = Festival Plaza (main area) (behaves like above. However most of it appears to be unloaded except for the lady that gives you Festival Tickets and Sophicles who can be interacted with? But game crashes... (normally out of bounds inside the castle model it looks like) The entrance warp to the castle interior is still present (Though game crashes if you enter it). Also camera does not behave like normal Festival Plaza and follows the player as if in normal overworld area. So I found what map id the Festival Plaza stuff is at in Ultra Moon/Sun. They are at different locations in origianl Sun/Moon. Appears that there is around 40 new areas in Ultra Sun/Moon before you reach Festival Plaza. Then after that you get to Ultra Space locations and beyond that is post game Team Rocket map ids. There's a good 140+ new map ids in Ultra Sun/Moon it appears. There is some data that PkHeX doesn't update if you teleport to a different map id. Map name in save screen and the skydome are a couple things not updated. So for example going an ultra space location from a save that started out in a overwold location in Alola means that it would use the skydome from Alola location in Ultra space location and could look glitchy. Saving and reloading resets things and it loads the proper data. Teleporting out of the Thrifty market has some odd effects. I teleported out back to Royal Avennue and it loaded the wrong route data. (seems the area around Tide Song hotel was loaded in instead). I was able to walk around in the unloaded void beyond Tide Song Hotel and way off in the north west corner of the area the NPCs of Thrifty Market could be found. But they were all mixed up and using wrong NPC models. Drifloon NPC was using a scientest NPC model for example. Kinda wierd. Teleporting into the thrifty market (did this to see if I could skip the annoying entrance employees. But even if I teleport to a far corner of the market, they still talk to me and give me a coupon no matter how far the spawn location is from them. ) has some odd results. If i teleport in while it's night outside in the outdoor areas. (I initially teleported in while at royal avenue) the market seemingly has all the lights off and the cull distance for NPCs was unusually short. So NPC pop in was super noticable. Could walk like 10 steps away from a NPC at the back of the store and see them vanish. The area was kinda creepy looking. Had same atmosphere as the haunted on from the ghost trial location. Saving and reloading or leaving hte area and reentering resets it to normal.

I've noticed that there still isn't any ability to modify clothing items like you can with the 6th gen games. Any perticular reason for that? I noticed US/UM doesn't let me use hats with certain hair styles and would have liked to also try and unequipe the bag item. (the only remaining item you can't unequip now since they now let you remove the hat officially). Also what about customizing the player avater people see in Festival Plaza/battle menus? That looks to be dynamically generated so probably not stored as an image. But I wonder if one could modify it to use some camera angles/positions not normally allowed. The photo club feature stores the photo as both a JPG and metadata that dynamically updates what you see on topscreen. (found this out by replacing pokemon models in the game files. They impacted what the photo looked like on topscreen). The JPG is only ever used for the thumbnail icons on the bottom screen. Could be interesting what you can do here if you could modify some values like trainer position. Found it annoying that I can't adjust that. Wonder if you could modify trainer position in a photo... Also one thing you can definitely add to PkHeX is this event constant I found. Constant 84 is definitely the constant US/UM uses to store how many Pikachu's you've made come out of the Pikachu trailer. The guy tells you how many you triggered thus far and this constant stores that. At some point he stops counting and tells you that there seems to be inifinite pikachu's and wonders if there's a ultra wormhole. (doesn't seem to trigger anything though. Set it to max value which made him stop reporting the value and have alternate dialog, but no additional storyline element is triggered or no item obtained. ) EDIT: The guy stops tracking the Pikachu's at 1000 and gives you the alternate dialog. Nothing happens after that though beyond just more Pikachu's coming out. At around 20th trigger, 3 Pikachu's come out at once. Though I've only seen that happen once. Maybe that's just a random trigger where 3 come out instead of 1, but they appear to be infinite. So you never can enter that trailer. Feel sorry for any poor sap who tries to trigger more then 999 Pikachu's ingame..That sounds like a big time sink. Well...I'll save you the trouble and tell you that nothing happens.

Aww yes the missingno mons. Actually awhile back I was playing around with them with a modified build of PkHeX. Anything beyond the 2 or more above the existing range will actually crash PokeBank when you try to access the game's data if these mons are present in the boxes/party. (first mon is the battle egg you shown, the next is a bulbasuar but uses egg icon. The rest appear to be mostly bulbasuar models) This was back with the 6th gen mons. Not sure if they fixed that now. (was able to deposite "Egg" into pokebank too. This was before the 7th gen update though) Note that "Egg" does not crash any of the gen 6 games when you use them in battle. They do however crash when certain moves like Iron Head are used. No idea why that happens. Also I found that in pk3ds in the personal editor the "--" entry above Bulbasoar appears to defines it's stats. It normally has no ability assigned and has base zero stats (and is a normal type). Doesn't learn any moves or TMs. You can use pk3DS to assign it TMs and give it better stats. But it doesn't have a proper species entry so I don't think you can assign a level up move pool to it. This "--" entry (which I dont' know if current builds of pk3DS still allow you to alter or not) may not be specific to "Egg" but maybe a default entry for any mons that appear beyond defined ranges. So editing this may also impact all other missingno mons. As for 7th gen...Not sure why the crash happens. It's not related to the model/animation data. I swapped the model files around and made Smeargle appear as Egg. (I did also replace animation files and what not too so it was a full swap. Only thing not changed is the model used in Pokemon Refresh...not sure where those are stored) works perfectly fine. Probably missing species data or something. (Perhaps entry animation/camera/bounding box size/etc causing the problem. Something new gen 7 introduced perhaps that this mon isn't playing well with.) I have not tried making Egg appear as a wild mon in 7th gen yet. maybe it doesn't crash in that instance. But like in 6th gen where i did make it appear, it will have no ability or moves and will struggle itself to death. I think it's catch rate is null too so you pretty much need to use a masterball to catch it.

This? [ATTACH=CONFIG]13356[/ATTACH] I suppose technically it can...But it's just a bunch of numbers. I hope at some point it gets a graphical editor. No wonder no one's noticed it...Only programmers who know the object ids even have a chance of using that effectively in it's current form.

Since when? I have a build from github that was I had compiled sometime this month and checked. I can't do much with secret bases. There isn't an option to edit the layout/position of objects placed in a secret base. Unless it does have that feature and I'm just not finding it?

Very cool! Surprised secret bases haven't been editable directly in the save yet. But doing it via QR codes would be cool too.

Oh nice. I hadn't updated PkHeX in awhile so that's a feature I was not aware of. Good to see you got it resolved.

You need to have the cart it came from to have any hope of decrypting the save on your console. The cart private header used to validate the cartridge when going online is also what makes the encryption of the save unique to that cart. Without the cart you can't decrypt/transfer the save to another game. If you managed to dump a rom of your game and assuming you did it properly, it will have the private header unique to that cartridge. You'll need a flashcart like Gateway or Sky3DS and a way of injecting the encrypted save back into the rom before putting it on your flashcart. (I think there's a program out there that does this, but I forgot what it was called). PowerSaves adds a small header to the beginning of the save file stored on your computer. (assuming you kept backups which you did it looks like). You'd have to strip that out with a hexeditor before trying to inject it back into the rom. But as I said, this would be a useless endeavor if you don't have a proper dump of the game you lost. It's the private header that you really need. It's possible one could bruteforce the save if the 6.x encryption key gets leaked as well as the fact that the AES Engine for the 3DS was figured out. But I wouldn't count on it. (that and said key is not something you can get from a forum like this. They won't allow it for obvious reasons) I also have a Pokemon X save I'd like to use again, but it was from PowerSaves and I don't have the original cartridge. I know it's a lost cause though. Just move on. I recreated my Pokemon save the best I could. I transferred my pokemon to ORAS before I sold my Pokemon X game, so I didn't really lose anything meaningful. Knowing that you said you had a "ram2sav" backup. You should focus on trying to restore that. I don't know for certain, you can get a new game and start a new save. Then what ever method you used for ram2save can be repeated to restore your ram2save backup. But I have no experience with ram2save because I've been spoiled using emunand and savedatafiler, so I never had experience using the things most users here who don't have the luxery of a 9.2 console would have to use. So I can't help you with that unfortunately. EDIT: After some searching, my memory on this is coming back to me. I recall fiddling around with the browser exploits and the old save injection stuff it came with. I could setup a 9.2 emunand and a CIA of Pokemon X and try and get your game save restored and export the result with SaveDataFiler (the resulting save would then be compatible with svdt as I believe svdt explorts/imports saves in a manner similar to SaveDataFiler and the format of the saves is the same) I would have to assume ram2save method can be used on the eShop version of the game. Hopefully there is no problems attempting to transfer this from cartridge version to the eShop version. But I can at least try. The browser payloads might not work in emunand though now that I recall. If that's the case I'll just do it in sysnand instead. I already have a version of Pokemon X installed there though but don't remember if it was a rom hacked version or not. I recall building a custom rom at some point. EDIT2: Actually right now it's a normal copy with a modified 1.2 patch installed. I can just remove the patch and install the official one to work on restoring your save. Don't think I'll need emunand for this. It probably won't be a 100% complete restore of what your original save was. How far into the game was your save and what version patch was installed at the time that save was made? PM me and I can at least try and help you with this.

Yeah this is an issue I was aware of too. If you are in illegal mode, you also have to change the "form number" next the form dropdown menu. It would be nice if it updated this automatically to reduce mistakes. There hasn't been many instances where I would want this number to differ from what it's supposed to be for a given form.

I'm hoping you'll provide options for changing the rendering shaders/etc for displaying models in Ohana. Ohana Rebirth still doesn't display the model for me. I have an Nvidia GTX 650 with latest drivers/DirectX on Win7 64-bit, and your Ohana Rebirth program still does not show any 3D model. The BCH loads because I can see the textures when I look at the texture section. So for now I have no idea what's going on with the model when I open something.

You plan on adding support for game patch versions? The main difference is I have exefs modified to mount certain GARCs as rom2. This results in the path of a/0/1/3 becoming a0/1/3. (basically first sub folder of a gets moved to root and renamed to a0 and continuing from there) Not all the GARCs are moved. Just the ones PK3DS edits. I have a whole test hack converted to patch and would like to see it be easier for pk3DS to edit game patches setup like this.

There's a youtube video that shows this off. It's from the guy who made the tool I'm about to link you to: The video description contains info on how to use it. Download link to the tool in question (also found in the video's description): BVEditor.exe Note that you need to have the ability to decrypt extData on SD card. This requires using SaveDataFiler. If you are not on an exploitable console, you can not decrypt your battle videos in a form that can be edited.

I've used ExInjector on the 3DS version of the game. It worked on Omega Ruby. But not Pokemon X. Pokemon X won't boot for me. Even when I just rebuild it unmodified. I've tried modifying an RSF to match the exheader for both the full game and a custom patch with and without exinjector and haven't gotten very far. I can merge the patches with the game, but I can't get the damn thing to boot either way. Here's what the patch currently looks like for my custom patch: BasicInfo: Title : "kujira-1" CompanyCode : "01" ProductCode : "CTR-P-EKJA" ContentType : Application # Application / SystemUpdate / Manual / Child / Trial Logo : Nintendo # Nintendo / Licensed / Distributed / iQue / iQueForSystem TitleInfo: UniqueId : 0x055d Category : Patch # Application / SystemApplication / Applet / Firmware / Base / DlpChild / Demo / Contents / SystemContents / SharedContents / AddOnContents / Patch / AutoUpdateContents CategoryFlags : Patch Option: UseOnSD : true # true if App is to be installed to SD EnableCompress : true # Compresses exefs code FreeProductCode : true # Removes limitations on ProductCode EnableCrypt : false # Enables encryption for NCCH and CIA MediaFootPadding : true # If true CCI files are created with padding ExeFs: ReadOnly: - .rodata - RO ReadWrite: - .data - RO Text: - .init - .text - STUP_ENTRY SystemControlInfo: SaveDataSize: 1MB RemasterVersion: 0002 StackSize: 0x00040000 JumpId: 0x0004000e00055d00L Dependency: ac: 0x0004013000002402L am: 0x0004013000001502L boss: 0x0004013000003402L camera: 0x0004013000001602L cecd: 0x0004013000002602L cfg: 0x0004013000001702L codec: 0x0004013000001802L csnd: 0x0004013000002702L dlp: 0x0004013000002802L dsp: 0x0004013000001a02L friends: 0x0004013000003202L gpio: 0x0004013000001b02L gsp: 0x0004013000001c02L hid: 0x0004013000001d02L http: 0x0004013000002902L i2c: 0x0004013000001e02L ir: 0x0004013000003302L mcu: 0x0004013000001f02L mic: 0x0004013000002002L ndm: 0x0004013000002b02L news: 0x0004013000003502L nim: 0x0004013000002c02L nwm: 0x0004013000002d02L pdn: 0x0004013000002102L ps: 0x0004013000003102L ptm: 0x0004013000002202L ro: 0x0004013000003702L socket: 0x0004013000002e02L spi: 0x0004013000002302L ssl: 0x0004013000002f02L AccessControlInfo: ExtSaveDataId: 0x0000055d SystemSaveDataId1: 0x00000000 SystemSaveDataId2: 0000000000 OtherUserSaveDataId1: 0x00000 OtherUserSaveDataId2: 0x00000 OtherUserSaveDataId3: 0x00000 FileSystemAccess: - DirectSdmc IdealProcessor : 0 AffinityMask : 1 Priority : 48 MaxCpu : 0x9E # Default DisableDebug : false EnableForceDebug : false CanWriteSharedPage : false CanUsePrivilegedPriority : false CanUseNonAlphabetAndNumber : false PermitMainFunctionArgument : false CanShareDeviceMemory : false RunnableOnSleep : false SpecialMemoryArrange : false UseOtherVariationSaveData : false CoreVersion : 2 #DescVersion : 2 ReleaseKernelMajor : "02" ReleaseKernelMinor : "35" MemoryType : Application # Application / System / Base HandleTableSize: 200 IORegisterMapping: - 1FF50000-1FF58000 - 1FF70000-1FF78000 MemoryMapping: - 1F000000-1F600000:r SystemCallAccess: ControlMemory: 1 QueryMemory: 2 ExitProcess: 3 GetProcessAffinityMask: 4 SetProcessAffinityMask: 5 SetProcessIdealProcessor: 6 GetProcessIdealProcessor: 7 CreateThread: 8 ExitThread: 9 SleepThread: 10 GetThreadPriority: 11 SetThreadPriority: 12 GetThreadAffinityMask: 13 SetThreadAffinityMask: 14 GetThreadIdealProcessor: 15 SetThreadIdealProcessor: 16 GetCurrentProcessorNumber: 17 Run: 18 CreateMutex: 19 ReleaseMutex: 20 CreateSemaphore: 21 ReleaseSemaphore: 22 CreateEvent: 23 SignalEvent: 24 ClearEvent: 25 CreateTimer: 26 SetTimer: 27 CancelTimer: 28 ClearTimer: 29 CreateMemoryBlock: 30 MapMemoryBlock: 31 UnmapMemoryBlock: 32 CreateAddressArbiter: 33 ArbitrateAddress: 34 CloseHandle: 35 WaitSynchronization1: 36 WaitSynchronizationN: 37 SignalAndWait: 38 DuplicateHandle: 39 GetSystemTick: 40 GetHandleInfo: 41 GetSystemInfo: 42 GetProcessInfo: 43 GetThreadInfo: 44 ConnectToPort: 45 SendSyncRequest1: 46 SendSyncRequest2: 47 SendSyncRequest3: 48 SendSyncRequest4: 49 SendSyncRequest: 50 OpenProcess: 51 OpenThread: 52 GetProcessId: 53 GetProcessIdOfThread: 54 GetThreadId: 55 GetResourceLimit: 56 GetResourceLimitLimitValues: 57 GetResourceLimitCurrentValues: 58 GetThreadContext: 59 Break: 60 OutputDebugString: 61 #InterruptNumbers: ServiceAccessControl: - APT:U - $hioFIO - $hostio0 - $hostio1 - ac:u - boss:U - cam:u - cecd:u - cfg:u - dlp:FKCL - dlp:SRVR - dsp::DSP - frd:u - fs:USER - gsp::Gpu - hid:USER - http:C - mic:u - ndm:u - news:u - nwm::UDS - ptm:u - pxi:dev - soc:U - ssl:C - y2r:u - ldr:ro - ir:USER - nim:aoc - am:app Here's the info dump from ctrtool. I'm not familiar with all the commands. Perhaps you can make one that's better? NCCH: Header: NCCH Signature: A6F3C1EAA6ABE14A64136D660A7A476D9FA19766CC0FC477A5D3CA6A C2D56F93 B234DC8FE150D79FECB0923886E0BEC78B10FC1A521220CA02416E4D BC13FD8F 770A3A99E8DFBD5790C6CD20998E910981FEF88C47BC589AEF73EE84 4D874E12 D8CE5C7D2EE400C8EF5B4B264CB31B8817F91396EB5DCB1D005E1D05 1AB1B0DB 039F862BBA0F278FFC714B9C2244873A6C2C40D6157DECBBCA52BE9C 700FD5CB 19C9C3B5210A6825E84E32E73D0D950068AF0C04546A305AB839F902 7611DDFD 961D06382B1F4DACC7D2E575BDEF6D6FADBDE2887D7634694B329DE1 C211F01D 8114323A4D00222E523A090A98F9F5CC58249F93DF25B3AC64EA5C4A C5181447 Content size: 0x01cf1000 Partition id: 0004000e00055d00 Maker code: 3130 Version: 0002 Program id: 0004000e00055d00 Logo hash: 2A98C49D919E254E15DC213CAB47A800ED63B248DCD43119E8FB82D9 E62AE51C Product code: CTR-U-EKJA Exheader size: 00000400 Exheader hash: 97350BC3FAA9F46248CF0CBF91A10164BDF4F45076A5F1D9E3E2F2C9 C6210D2A Flags: 0400030100000000 > Mediaunit size: 0x200 > Crypto key: None > Form type: Executable content > Content type: Application > Content platform: CTR Plain region offset: 0x00002a00 Plain region size: 0x00000400 Logo offset: 0x00000a00 Logo size: 0x00002000 ExeFS offset: 0x00002e00 ExeFS size: 0x002bda00 ExeFS hash region size: 0x00000200 RomFS offset: 0x002c1000 RomFS size: 0x01a30000 RomFS hash region size: 0x00000200 ExeFS Hash: 164557E02BCA48BA3C99239C0AE401BF01DF207E9B423C3D50174293 3850A37D RomFS Hash: FFFD68496A8B631D810C79C44A48341D68A168D49E76730B15C51851 3CEA1922 Extended header: Signature: 8D9B8D59AF47A2C4997E3DD49058AE2321EE87524DBFF3CF8E21D342 A5190E46 20BEA18EA538EA54C4056EC8699AF95EBE7B2ED316E6A0B00EB78085 79302123 45A55A33F389219CA42BE5970224152BEF011FD4B3FFBDBEF2E1E281 25A79111 5756D950EC5962D29602B72AF42402556D5481179C9C73562D6120A3 4BFE2E06 47E62624F939A46B3B3CD80685135705B86D7DBF318CD12139F1D283 ACD7C87E 677381121BC74B396B693A25F0A162D762CAF89F4D608E246EE4EFC6 13977EB1 AF1B47F992DACEF9F189E3B4D44E84A077DAF49FABCC1269738374F0 5153224F 4983AB17152EC193289CA3CFAE3C57436D471600E74EFBF0A39E4BEC B76042CC NCCH Hdr RSA Modulus: E0B5FEB55DCCE266394059137406EE4D93085C90201BF82D945703C7 C196BB1A 4337CD65964E11108A3C130B52B8BB4D4CFBB2C2163505BD783A31BE 203FDC49 12282EB12BD44551893C052AF914D38BB875D594DCBAD6354FC240ED E755A5F8 A3318BB21FB0172D0635CFBAA4D123A6B30EC8328B72504EEA5E09D9 269615AC 35B3CE411EB7FEA3C794FF720E9E327A42F69B761A20A4FF78C1F06B BB08E72B F0FB360CFD1595D1A37CEEAD8B5F69760F59AF46AFC39838E9A0EA5B 0BE26574 2B36280BD0D39C258351AC48405262E49CB841442ED9EE5EE06E8C86 58CDF5CD 7DF7898E175A290BB9ABA229F50DA52C93A8BB660863ECF046584121 93724203 Name: kujira-1 Flag: 03 [compressed][sd app] Remaster version: 0002 Code text address: 0x00100000 Code text size: 0x0043C03C Code text max pages: 0x0000043D (0x0043D000) Code ro address: 0x0053D000 Code ro size: 0x00069A94 Code ro max pages: 0x0000006A (0x0006A000) Code data address: 0x005A7000 Code data size: 0x000440C0 Code data max pages: 0x00000045 (0x00045000) Code bss size: 0x00076858 Code stack size: 0x00040000 Dependency: 0004013000002402 Dependency: 0004013000001502 Dependency: 0004013000003402 Dependency: 0004013000001602 Dependency: 0004013000002602 Dependency: 0004013000001702 Dependency: 0004013000001802 Dependency: 0004013000002702 Dependency: 0004013000002802 Dependency: 0004013000001a02 Dependency: 0004013000003202 Dependency: 0004013000001b02 Dependency: 0004013000001c02 Dependency: 0004013000001d02 Dependency: 0004013000002902 Dependency: 0004013000001e02 Dependency: 0004013000003302 Dependency: 0004013000001f02 Dependency: 0004013000002002 Dependency: 0004013000002b02 Dependency: 0004013000003502 Dependency: 0004013000002c02 Dependency: 0004013000002d02 Dependency: 0004013000002102 Dependency: 0004013000003102 Dependency: 0004013000002202 Dependency: 0004013000003702 Dependency: 0004013000002e02 Dependency: 0004013000002302 Dependency: 0004013000002f02 Savedata size: 1M Jump id: 0004000e00055d00 Program id: 0004000000055d00 Core version: 0x2 System mode: 0x0 Ideal processor: 0 Affinity mask: 1 Main thread priority: 48 Ext savedata id: 0x0000055d System savedata id 1: 0x00000000 System savedata id 2: 0x00000000 OtherUserSaveDataId1: 0x00000 OtherUserSaveDataId2: 0x00000 OtherUserSaveDataId3: 0x00000 Accessible Savedata Ids: Other Variation Saves: Inaccessible Access info: 80000000000000 > Direct SDMC Other attributes: 00 Mapping static address: 0x1FF50000 (RW) Mapping static address: 0x1FF58000 (RW) Mapping static address: 0x1FF70000 (RW) Mapping static address: 0x1FF78000 (RW) Mapping static address: 0x1F000000 (RO) Mapping static address: 0x1F600000 (RO) Kernel flags: > Allow debug: YES > Force debug: NO > Allow non-alphanum: NO > Shared page writing: NO > Privilege priority: NO > Allow main() args: NO > Shared device mem: NO > Runnable on sleep: NO > Special memory: NO > Memory type: APPLICATION Handle table size: 0x200 Kernel release version: 2.35 Allowed systemcalls: 0x01, 0x02, 0x03, 0x06, 0x08, 0x09, 0x0A, 0x0B 0x0C, 0x0F, 0x11, 0x13, 0x14, 0x15, 0x16, 0x17 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x27, 0x28 0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30 0x31, 0x32, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A 0x3B, 0x3C, 0x3D Allowed interrupts: none ARM9 Desc. version: 0x2 Mount NAND fs: NO Mount NAND RO write fs: NO Mount NAND TWL fs: NO Mount NAND W fs: NO Mount CARD SPI fs: NO Use SDIF3: NO Create seed: NO Use CARD SPI: NO SD Application: NO Use Direct SDMC: YES Service access: APT:U Service access: $hioFIO Service access: $hostio0 Service access: $hostio1 Service access: ac:u Service access: boss:U Service access: cam:u Service access: cecd:u Service access: cfg:u Service access: dlp:FKCL Service access: dlp:SRVR Service access: dsp::DSP Service access: frd:u Service access: fs:USER Service access: gsp::Gpu Service access: hid:USER Service access: http:C Service access: mic:u Service access: ndm:u Service access: news:u Service access: nwm::UDS Service access: ptm:u Service access: pxi:dev Service access: soc:U Service access: ssl:C Service access: y2r:u Service access: ldr:ro Service access: ir:USER Service access: nim:aoc Service access: am:app Reslimit category: 00 ExeFS: Section name: .code Section offset: 0x00000200 Section size: 0x002b9ee8 Section hash: 18C890A398568E1C9CF18BF203EA03FC6AEE3D6F858250654D69A9CB D76D3DAC Section name: icon Section offset: 0x002ba200 Section size: 0x000036c0 Section hash: F36CD262AC9663AD4979796337A4A923A7D3449B1084AF0603A2B791 B9299F4D Here's my current build commands: Echo Building Rom... makerom -f ncch -target g -rsf X_CIAPatch.rsf -desc app:7 -exefslogo -plainrgn PokemonXPatch\plainrgn.bin -romfs PokemonXPatch\romfs.bin -exheader PokemonXPatch\exheader.bin -code PokemonXPatch\code.bin -icon PokemonXPatch\icon.bin -alignwr -o PokemonXPatch.cxi make_cia -o PokemonXPatch.cia --major=3 --minor=7 --micro=0 --content0=PokemonXPatch.cxi --id_0=00000003 I would build the CIA directly with makerom, but it won't let me set the major. Kinda annoying. So I have to build using make_cia. As for the 3DS version of the game, I pretty much have to use exInjector because that's the only way I can properly set the "major" version of the game. Even if I got it to boot with the patches merged, the console will still say it needs to be updated when I go to boot it. Unless there's an RSF file command or makerom command I'm missing. The -major command switch doesn't appear to do anything for 3DS files last I checked.

I guess no one cares about X/Y anymore.

I can't for the life of me get a modified rebuild of this game to boot without the game patches. Unlike ORAS, I believe a bit more then just game text is overwritten by the game patches. I even at one point attmpted to instead build a custom patch. But the furthest I got with that is making one that works in making the home menu think it's up to date (so I don't see the update message when I go to start the game), but no changes were actually applied to the rom. (I am also at attempting to "merge" the game patches into the rom) Had I gotten that to work, I would skip trying to rebuild this game. I have not had issues with Omega Ruby after using ExInjector. But at one point the program actually had the opposite effect with Pokemon X. Using it breaks the rom. Odd. Anyways, anyone here willing to share the RSF file they currently use to build Pokemon X and the makerom commands? I've already tried the RSF file from Asia81's tutorial pack. So no, that's not the one I'm looking for. I'm looking for alternative RSF files. If someone has figured out how to get custom game patches to work, I"m open ears on that one too. I would love to go that route instead as it's faster to build new versions of a custom patch then spend a good 20 minutes every time I need to build the CCI file again.

Interesting. If out of bounds species uses 0th entry data, then Egg is an anomaly. Everything beyond Egg is just a missingno using a Bulbasoar model. Perhaps one day we will be able to create new pokemon species. Then I'd just make Egg a proper pokemon species.

Interesting. Perhaps the models are only present in Omega Ruby? I saw Calem and Serena and Serena has appeared more then once. The first time was the double battle in Meteor Falls. Also I guess the source code added the options? It wasn't too long ago that I recompiled the program. Guess I got to do it again. EDIT: I see the options for it now. Also possible feature suggestion. But perhaps add a "restore backup" button in each menu. The program maintains backups the first time you open a unpacked rom with it. So adding the button would make restoring backups faster as I have to do that manually at the moment. Also not sure if you want to do this or not, but perhaps add Pokemon species 722 to the level up randomizer? (or at least point me in the source on how to add him manually my self). Species 722 is technically a missingno, but that so happens to be "Egg" in my randomizer LP. I would like to give him some randomized level up moves, but I don't see a way of accessing his species in the level up modifier as it's currently setup (adding him to PkHeX was easy, but Pk3DS seems to store species lists differently) He does show up as "000" in the personal editor, so I already fixed his base 0 stats and gave him a dual typing as well as allowing him to learn all TMs since he currently has no level up pool. For the most part "egg" is pretty stable in battle. Some moves like all the "claw" moves however have issues with him. When it says "Egg used Shadow Claw" or some other claw based move, it would seemingly do nothing for almost 20 or more seconds (but music and what not still playing). I thought it froze, but it did eventually execute the animation and work after that. Very odd. I decided not to give Egg any more claw moves. There was one other move that did cause a crash when used by Egg, but I have forgotten what it was. I did mention it in my LP. I might go back and rewatch one of my recorded eps to find out. But it's not really that important right now.

Will better randomize options ever be added to the personal editor? I want to randomize abilities for pokemon species but I don't want to randomize typings. Current version randomizes typings as well and there doesn't appear to be a way to avoid that. I've encountered Serena and who I assume to be Calem (what ever the name was for the male trainer in X/Y was. Since I played as him I did not have him as my rival. ) in my randomzier without getting a crash. They don't appear to have intro animations (it does show the ball being tossed out though), but their models do show up after I defeat them. I even seen Serena's classic face palm animation. So not sure how you got crashes from encountering them. Of coarse the tag battles would be where the crashes would happen. But I've run into Serena/Calem in 1v1 trainer battles in Omega Ruby without issue.

Use ExInjector to reinject the original decrypted exHeader back into the rom after you build it. Note that you must have extracted the file using CTRTool and not 3DSExplorer.

Currently n3DS support isn't available. n3DS uses a different version of web browser (which some call "SKATER"). The orignal spiderhax exploit used for classic 3DS ram injection does not have an available ROP chain for SKATER, the web browser for n3DS. Unless someone makes one or reverse engineers one made by Gateway when they release their n3DS exploit, then this won't happen any time soon. Sorry.