News: 11 March 2016 - Forum Rules
Current Moderators - DarkSol, KingMike, MathOnNapkins, Azkadellia, Danke

Author Topic: NDS hooking help  (Read 2305 times)

matthewn4444

  • Jr. Member
  • **
  • Posts: 26
    • View Profile
NDS hooking help
« on: August 11, 2011, 11:30:19 am »
Hello, I am new to the forums and I am also new to arm asm. I have been reading and playing around with arm asm for a few weeks and I feel I have enough knowledge to hack something.

I have a general question when switching modes. I would like to place my hack in arm9 to run my code that is placed somewhere in memory (which is in arm mode). Then I would like to end it and jump back into thumb mode. I read that using "bx r#" allows you to switch between modes, but I have yet to see this work. I use emulator (no$gba) and the code would jump from the arm9 to my code and back and continue to process the game. When I load the nds game into the flash card, it does not and freezes. I believe that it is jumping to my code but in the wrong mode which causes it to crash.

I looked at cracker's hooking tutorial (http://crackerscrap.com/index.php?p=docs) but it doesnt work for me (tried something similar).
Here is the part where I followed:
Code: [Select]
@37FFB20 <---- thumb
    ldr r0,[r1]
    cmp r0,#0x0
    blt 0x37FFB3C
    mov r2,#0x5
    ldr r4,[r15,#-0x2]
    bx r4
    .long 0x23FE000
    mov r4,#0x8

Notice that r4 is being loaded with a new value right after our hook so we know it is safe to use it for our jump.

@23FE000 <--- arm
    stmdb r13!,{r0-r12,r14} ;@ Save registers to stack
    ;@ Start of your function
    ...
    ;@ End of your function
    ldmia r13!,{r0-r12,r14} ;@ Restore registers from stack
    sub r0,r2 ;@ Patch in overwritten opcodes
    str r0,[r1]
    add r1,#0xFC
    ldr r0,[r1]
    ldr r4,[r15]
    bx r4 ;@ jump to IRQ handler
    .long 0x37FFB31 ;@ return address ORed with 1 to switch back to Thumb mode

At the end I would like to return to thumb mode, so I tried to OR the address but it didnt work.

I am not sure how to do this correctly but if someone can provide an example that would help a lot.
« Last Edit: August 12, 2011, 01:47:11 pm by matthewn4444 »

Ryusui

  • Hero Member
  • *****
  • Posts: 4989
  • It's the greatest day.
    • View Profile
    • Tumblr
Re: NDS hooking help
« Reply #1 on: August 14, 2011, 04:18:59 pm »
What's keeping you from writing your code in ARM mode?
In the event of a firestorm, the salad bar will remain open.

matthewn4444

  • Jr. Member
  • **
  • Posts: 26
    • View Profile
Re: NDS hooking help
« Reply #2 on: August 14, 2011, 05:46:39 pm »
Nothing really. Though after some digging I realized that I cannot load or branch off to any code in the game that is not in the bounds of 0x2000000 - 0x23FFFFF and most of that is arm7 code and most of the memory is overwritten in the game. I have found a location between them and it is working for now but I am not sure how long it will work for because it is not guaranteed that the game will not write there sometime in the course of the game. Though if I found a better place to put the code that would help. I am pretty new to asm hacking for games so my knowledge of certain techniques is poor.

Ryusui

  • Hero Member
  • *****
  • Posts: 4989
  • It's the greatest day.
    • View Profile
    • Tumblr
Re: NDS hooking help
« Reply #3 on: August 14, 2011, 05:48:29 pm »
I kinda ran into that problem with Death Note. ^_^; I expanded the ARM file so that I'd have space after what the game reserves for memory in order to insert my hacks - there's not much space there, mind, but it's enough.
In the event of a firestorm, the salad bar will remain open.

matthewn4444

  • Jr. Member
  • **
  • Posts: 26
    • View Profile
Re: NDS hooking help
« Reply #4 on: August 14, 2011, 05:50:43 pm »
What did you use and how did you expand the arm file? I appended my arm code to arm7.bin but soon after the arm7 started, it copied some stuff and overwritten my code there. Plus at a certain point, my code gets transferred to 0x800000 (like if i padded 200kbs).

Ryusui

  • Hero Member
  • *****
  • Posts: 4989
  • It's the greatest day.
    • View Profile
    • Tumblr
Re: NDS hooking help
« Reply #5 on: August 14, 2011, 07:01:31 pm »
Like I said in the other topic, you can only expand the ARM file up to the maximum size of the 0x2000000 bank (that is, 0x40000 bytes). See how much of the bank the game actually uses for code, memory, and whatnot: you should be able to insert your code after the scratch space.

Death Note uses an initialization routine to make sure all its scratch space is zeroed out. Check for a simple loop that zeroes out a large chunk of memory; you should have a "safe zone" where it stops.
In the event of a firestorm, the salad bar will remain open.