Hacking GBA

Contents Legal History Hacking using VBA-H Button Values Gameshark Advance and Action Replay v3 Description - Gameshark Advance Gameshark Advance code types Description - Action Replay v3 Action Replay code types Encrypting/Decrypting Gameshark/Action Replay codes Creating GSA/ARV3 master codes Hacking Standard Master Codes Hacking Nonstandard Master Codes Baulder's Gate Phantasy Star Collection Codebreaker Advance and Gameshark SP Description - Codebreaker Advance Description - Gameshark SP Codebreaker/Gameshark SP code types Encrypting/Decrypting Codebreaker/Gameshark SP codes Creating GSSP/CBA master codes ARM7 Assembly Hacking using VBA-SDL-H Converting codes

Legal All files (HTML, CSS, images) included in EnHacklopedia are licensed under the Creative Commons Attribution-ShareAlike 3.0 License. All authors contributing to EnHacklopedia should be made aware of the license before contributing. If the author does not agree to the licensing, his or her contributions will not be accepted into the project. History 04-19-2007 Added new screens. (dlong) 04-12-2007 Merged Cheat Devices. (dlong) 04-11-2007 Updated ARv3 code types; Added information on cheat devices; Added guide on converting codes. (dlong) 04-10-2007 Added information on VBA, VBA-SDL, and ARM7. (dlong) 04-09-2007 Updated footer, again. (dlong) 04-08-2007 Updated footer. (dlong) 04-07-2007 Added information on encryption and master codes. (dlong) 04-05-2007 Initial Release. (dlong)

Hacking using VBA-H

VBA-H (Visual Boy Advance - Hacker's Edition) is a modified version of Visual Boy Advance 1.7.2 developed by kenobi and Labmaster. As it was modified from VBA 1.7.2, it has the exact same compatibility which means that although it is compatible with the vast majority of GBA games, it will not work with all of them. The most notable games that are not compatible with this version are the Classic NES Series games.

The changes in VBA-H are all in the cheat menu. In addition to the options provided in the normal edition, VBA-SDL allows several restrictions, both by address range and difference from previous value. A flag compare option is provided as well as a way to force the displaying of results no matter how many were found.

VBA-H provides the same disassembler that VBA provides. All registers are listed as well as the mode and flags. An R16 is listed; however this is simply CPSR mislabeled. A "Goto R15" option is provided which will move the disassembly to the latest instruction, and the window allows both ARM and THUMB to be viewed. This option is only a disassembler and not a debugger. For debugging, VBA-SDL-H must be used.

Button Values

On the GBA, the word at 0x04000130 always contains the buttons that are being pressed. The GBA stores the button values XORed with 0x3FF. The button values are as follows:

Gameshark Advance and Action Replay v3

Description - Gameshark Advance

The Gameshark Advance was the original cheat device for the Gameboy Advance. While more functional than the cheat devices for the Gameboy, it is still far less functional than its equivalent for the N64. The GSA's code types include 8-, 16-, and 32-bit writes, a slide code, a 16-bit If Equal To conditional, and a 16-bit ROM patch. The GSA also does not provide a code searching feature, something that had been provided in all incarnations for the Gameboy. Finally, the codes are encrypted, a first for any handheld cheat device. In Europe, the Gameshark is referred to as the Action Replay. The two products shared a name starting with revision 3, an entirely different product referred to as ARv3.

Gameshark Advance Code Types

Description - Action Replay v3

After Interact went bankrupt and sold the Gameshark name rights, Datel decided to directly sell their product in North America. Because of this, the Action Replay name became used in both North America and Europe. This name synchrony began with the third revision of the AR, for the GBA. The ARv3 adds a massive number of code types, 114 in total. Additionally, the ARv3 uses a different encryption, although this has been cracked as well.

Action Replay Code Types

Encrypting/Decrypting Gameshark/Action Replay codes

Gameshark and Action Replay codes are encrypted and decrypted with AR Crypt. To encrypt codes, put the appropriate, formatted code in the left box. The choose RAW in the left radio box. On the right radio box, choose ARV1/2 for Gameshark or ARV3/4 for Action Replay. Decrypting codes works in a similar fashion. ARV1/2 or ARV3/4 on the left and RAW on the right. ARCrypt also provides an option to format codes. This only does one code at a time however. Input the address followed by the value and select the appropriate ARCrypt code type, then press the create button. Underneath the address and value, the correctly formatted code will be displayed, and will be display encrypted in the right textarea. For some code types, such as slide codes, additional options will be displayed in the middle of the window. Customize these as necessary.

Creating GS/AR master codes

Hacking Standard Master Codes

To create a master code for the Gameshark or Action Replay, a ROM of the game will be required, as well as AR Crypt. In AR Crypt, go to Special, then "Find Master Code and ID Code"; Load the ROM, and the master codes will be listed. Test each master code individually with a normal code. If the code works, then the master code being used is a legitimate master code. If AR Crypt does not come up with any results or non of the possible master codes works, a non-standard master code must be hacked.

Hacking Nonstandard Master Codes

The information in this section is based on a post originally by Parasyte.

Both AR Crypt and VBA-SDL-H are required for hacking non-standard master codes, as well as a Hex Editor. Examples are provided for Baulder's Gate and Phantasy Star Collection.

Baulder's Gate

Load Baulder's Gate up into VBA-SDL and enter the gameplay part of the game. Then load up a hex editor, open the rom, and search for 0x0047C0460847C046. This is the beginning of the long branch routine. For Baulder's Gate, it's at 0x006A9888 which is GBA address 0x086A9888. It disassembles to:

etc. These bx instructions are what we want to try to hook. What we are looking for is a bx instruction which is executed many times per second. Start with the bx r0. Tell VBA-SDL to break whenever that instruction is executed (bt 086A9888) and have the game resume (c). The game doesn't break, so this isn't what we want. Go back to the debugger (F11) and move on to bx r1. Set a breakpoint on that and resume gameplay. The game breaks. This is good. Copy down the value of R1 (since we are testing bx r1) and resume gameplay. It will break again. Copy down the new value of R1. Continue this process until it appears that all the possible values r1 have been copied. For this game, the values are 0x03003ef8, 0x0869FC05, 0x0869E145, 0x02000634, 0x02000514, 0x0869E3D5, and 0x0869E0D9. Now delete the breakpoint and move to another area (say, the tavern), and repeat the process. Here, the values obtained are 0x0869E3D5, 0x0869D5A1, 0x0869D165, 0x0869C881, 0x03003EF8, 0x0869FC05, 0x0869D81D, and 0x0869CF61. Now, find the common addresses. They are 0x03003EF8, 0x0869FC05, and 0x0869E3D5. Now it's time to make the mastercode.

One by one, search for each of the values in the ROM. Starting with 0x03003EF8, we must first rearrange this into the order it will appear in the ROM. Divide it into seperate bytes (0x03, 0x00, 0x3E, and 0xF8), then reverse the order, giving us 0xF83E0003. Search for this in the ROM. It is not present. Move to the next value, 0x0869FC05. Searching for 0x05FC6908 turns up four locations. This is not good. Any one of the four could be correct or, even worse, they could each be correct in a seperate part of the game. Go to the final value, 0x0869E3D5. Searching for 0xD5E36908 turns up only one location! Success. The location is 0x007EF48C. Turn the 00 into C4, and add 000084x1 as the value, where x is the register value used (r1 here). The final code is C47EF48C 00008411. If the code is being made for the Gameshark, the address should have the initial two zeros replaced with 48, and the value should be 000001x1, with x still being the register. For Gameshark, the final decrypted could is F87EF48C 00000111.

Phantasy Star Collection

It is impossible to hack a universal master code for Phantasy Star Collection, because it contains four executables. The intro does not need a master code, but each of the other three executables (the three games) require a seperate master code. For Phantasy Star II and Phantasy Star III, creating a master code is simple enough. However, for Phantasy Star, there is a problem. The Phantasy Star exectuable is located at 0x08738000, and it is impossible to create a standard BL-type master code from any address above 0x0840001C. This is further complicated by the fact that the long branch routine does not exist in the Phantasy Star executable, so creating a master code the same way as for Baulder's Gate will not work. In this case, we shall take a different approach - find the interrupt handler. These are executed several times per second, so they are perfect.

Load up Phantasy Star Collection in VBA-SDL-H. The GBA interrupt vector is always located at 0x03007FFC. Use the mw command to display the word there; it should be a pointer. For me, it is 0x020207d0. This is an ARM address, because it is an even number. Had it been THUMB, it would have been 0x020207d1. Disassemble the arm (da) starting at 0x020207d0. Here is what I have:

This code loads pointer 0x02000070 into r1. Then, it adds r2 to it.Finally, it loads a pointer from that address into r0 and branches to that address. This is a prime example of a jump table (large amount of pointers stored in RAM). Dump the jump table from 0x02000070 with the mw command:
02000070 087384A1 0873A9FD 0873AA01 0873A9FD
02000080 0873A9FD 0873AA21 0876CA91 0873A9FD
02000090 0873A9FD 0873A9FD 0873A9FD 0873A9FD
020000A0 0873A9FD 0873A9FD 00000000 00000000

All of these pointers are odd numbers, which means they are all pointers to THUMB instructions. There are five in total: 0x087384A1, 0x0873A9FD, 0x0873AA01, 0x0873AA21, and 0x0876CA91. Disassemble each of these addresses. Be sure to convert each address into an even number by subtracting 1. Here is what we have:

The second and fourth routines simply contain bx lr, meaning they do nothing at all. There's no reason to trust either of them. The first one is the joypad routine - very promising. Take the pointer to this routine (0x087384A1), byteswap it (0xA1847308) and search the ROM for it with a hex editor. There's only one result, and it is definitely inside the Phantasy Star executable. This pointer is located at 0x007383FC. Attach the C4 codetype (F8 for Gameshark) and the 000084x3 value (000001x3 for Gameshark). Back in the ARM assembly, the first bx instruction was bx r0. So, the x is replaced with 0. The final code is C47383FC 00008403 for AR and F87383FC 00000103 for GS.

Codebreaker Advance and Gameshark SP

Description - Codebreaker Advance

Pelican released the Codebreaker Advance shortly after the GSA came out. Like the GSA, it is a step up from its Gameboy counterpart, but lacks a trainer. Notable code types that the CBA has added includ the slide code, 8- and 16-bit writes, conditionals, and a bitwise AND. However, the CBA does not implement a 32-bit RAM write or a ROM patch, both of which the GSA has. Codebreaker codes are encrypted by default, but unencrypted codes can be allowed, by not having a 9-code as the first line of a master code.

Gameshark SP

The Gameshark name was purchased by MadCatz, who also purchased the rights to the Codebreaker Advance software. In reality, all the Gameshark SP is, is a renamed Codebreaker Advance.

Codebreaker/Gameshark SP code types

Encrypting/Decrypting Codebreaker/Gameshark SP codes

Codebreaker (and by extension, Gameshark SP) codes are encrypted and decrypted with CBA Crypt. To use this, first put the first line of the CB master code (the one that starts with a 9) in the left box. If the first line of the master code does not start with a 9, then encryption and decryption are not necessary. Underneath the 9 code, put the codes you want to encrypt or decrypt and press the appropriate button. On the right side, the encrypted or decrypted codes will appear. The first line will be the same on both sides. Ignore this line. The rest of the box is when you need.

Creating GSSP/CBA master codes

To create a master code for the Codebreaker or Gameshark SP, a ROM of the game will be required, as well as GBA Tool. Open GBA Tool up and click the browse button. Find the load, and load it. Then press search. A list of potential master codes will be displayed. Test each master code on the game with any code. If the code works, you have a valid master code.

ARM7 Assembly

The GBA uses an ARM7TMDI chip. The ARM architecture provides two modes, ARM and THUMB, and well as 31 32-bit registers. Only 16 of these registers are visible at a time, with R13, R14, and R15 being for the Stack Pointer, the Link Register, and the Program Counter respectively. The ARM instruction set uses 32-bit operations, whereas the THUMB set uses 16-bit. THUMB is designed to produce smaller code with the same speed as ARM and much of the functionability. One major limiation of THUMB is that many instructions cannot access registers above R07. In ARM, 4 bits are set aside for a conditional. The operation is executed only if the current flags meet that condition. More information on ARM and THUMB can be found in the official ARM and THUMB manuals, as well as GBATek, all provided on the documents page.

Hacking using VBA-SDL-H

VBA-SDL-H is a modified version of VBA-SDL V1.7.2 by kenobi and Labmaster. Compatibility wise, it has the same limitations as VBA-H. VBA-SDL-H has been modified to include extra options such as Don't break on, Conditional Breaks, Break on Read, Break on Change, and Last Branch. In addition to this, it provides the same options provided by the official version of VBA-SDL.

Inside the console window, VBA-SDL-H lists all the registers, as well as CPSR, the mode, and the status flags. Additionally, the next instruction to be executed is displayed. If the last option was enabled, the same information is also provided for when the last branch occured. This feature has some bugs, however, and does not always work properly. h brings up a list of all available commands with a description. The c command resumes the functioning of the game. bt and ba break on the THUMB and ARM addresses provided respectively, when they are executed. bd [number] deletes the corresponding bt or ba instruction. This function has a small bug in that the last remaining breakpoint must be deleted manually. bpw [address] [bytes] breaks when [address] or any addresses up to [bytes] bytes afterwards are written to. The cow changes bpw to act as a break on change, which will not break if the value being written to the specified address is the same as the address's current value. bpr functions the same way as bpw, but it breaks when an address is read from instead of written to. The bpwc and bprc instruction delete all breaks on write and read, and the bl option lists all of these breakpoints. The db is used to disassemble the specified address from triggering a breakpoint. The instruction will still execute as normal, but VBA-SDL-H will ignore it with regard to breakpoints. cba and cbt instructions are also allowed. These instructions set conditional ARM and THUMB breakpoints.

The d, da, and dt instuctions disassemble the memory located at specified address. d disassembles in the game's current mode, while dt and da force THUMB and ARM disassembly. The next twenty operations are shown in either case. If no address is provided, disassembly begins at the current location of the game.

The mb, mh, and mw instructions show the memory at the location provided in terms of bytes, halfwords, and words. 0x100 bytes are shown in all cases and the ASCII representation of these bytes is provided on the right side. The eb, eh, and ew instructions can be used to modify these memory values; additionally, er is provided to modify the value of a register.

Miscellaneous instructions include io, which displays the status of the I/O registers, dload and dsave which load and save raw data files, load and save, which loads or saves an Fx style save, n which executes the next instruction, and radix, which sets the print radix to the specified base. Additionally, verbose changes the verbose level, where shows the call chain, locals shows the local variables of a given address, and lf logs all output to a file. Finally, the print instruction attempts to print the value of an expression.

Converting codes

ARCrypt converts codes betweent the three formats. Put the code to be converted in the left box, choose the appropriate devices, and hit convert. AR and GS codes must be encrypted during this process.