#Yo Kai Watch 1 (Switch) - Intro Replacement Mod
1 messages ยท Page 2 of 1
yeah no citra will dump shit in a flash
citra is very gpu tied
speed relies on cpu
fair
emulation 
but yet when ryujinx tries to dump a 4gb ykw 1 switch romfs
it takes 10 minutes
xD
well tbf switch games are well. different
as someone who tried to mod the intro for the switch version with karameru, i can confirm
doesn't even dump ykw1 at all on steam deck
poor english mod devs couldnt even open like half the files ๐ญ
LMFAO
the emudeck... i wouldve wanted one if my switch werent modded
dolphin on switch goes crazy
nintendo switch online who?
wtaf
like it runs the game fine
all that ps4 like power and it cant even dump a romfs ๐
just won't dump files for it's life
oh yeah its a steam deck it will
i always wanted to feel one for myself
it feels good
love the weight it has
and grip
i posted a yt video of pokemon playing on it
300+ views now iirc
working on a yo-kai watch video next 
ykw4++ on steam deck
330 views... wow
alr i wont work on this project until tmrw because of all the work i have to do ecks dee
i hat e schol
xD
What
idk if you can dump those from a regular switch
Oh... no...
but nstool might need them, though it says prod keys is mostly required
i mean again
like
the txt error said no prod keys
said NOTHING about dev keys
i can just do a fresh key dump of prod keys
sable was helping me w a lot of this today
Keys from dev.keys will always be loaded as dev keys. Dev keys may also be loaded from prod.keys, allowing both key sets to be in the same file. Because both key sets use the same key sources, only a small number of root keys are needed to derive each set.
Key names that have _dev after the main key name but before the key index will be loaded as dev keys.
e.g. (Not actual keys)
Mhm
Doesn't a NAND dump do that? And doesn't the guide make you do that?
Or do you want it in one of those firmware zip files
Because then idk
Probably extracted directly from console storage or smth
yeah
i wanna keep my ryujinx firmware up to date
i think goldleaf had an option? or im schizo
Iirc hekate allows you to do so
Mr 3DS learns about the switch
nand backups you can do w hekate, but firmware dumps im not so sure
oh wait nvm
@lyric hollow you use tegraexplorer
oh wait firmware dumps, sorry i read that wrong
lol
Taking a break from projects this week: I will resume this in my free time however.
I got projects n shit to work on
@lyric hollow @vast lynx ive been thinking
since im on the english dev mod team
and once i decompile the code today
imagine the shit i could potentially give the project
maybe custom timing :O
true
for now tho im gonna halt any other projects i have bc i rly wanna focus on this one
No Why Watch and MMP will be paused
no why watch?
@lyric hollow @vast lynx in the process of reverse engineering the main file
since i now have prod and dev keys i can use the decompiler
progress is halted for now, having some issues
what type?
i have to wait for the next school day + free period i have w sable bc i genuintely do not know what to do next
project is resuming xd
Yo Kai Watch 1 (Switch) - Intro Replacement Mod + Custom Timing
@unreal summit so, how's the custom timing stuff going?
as of now this project will be on hold again
im sick
plus i have a smash tourney to practice for
@vast lynx @lyric hollow im gonna decompile it tmrw most likely
as of now though, im gonna see if ghidra has any options, as i found a tool that lets ghidra view switch extensions
so maybe if it reads the exefs im in luck
getting somewhere
hmmmm
get watch rank...
hmmm
interesting...
ooooo
so i did some digging
yknow the quests that you need to like
upgrade your watch rank
yeah
if i know what to do exactly
you found a way to edit it
i could potentially make the quest to upgrade to rank d
to rank S
like in one try
daaaamn
hm
this controls the graphics im p sure
this i dont know either
oh no yeah i def know that
i know the filename for the opening is yw1_op
i havent even decompiled the code yet, so i dont really know exactly what is there
im only able to view it
nstool on lubuntu will probably do the trick once its finished
@lyric hollow
bad news
nstool cant extract nso files
SO im gonna decompile the code with ghidra if i can
on windows
and hopefully change it there
Rip
yeah ๐ญ๐ญ๐ญ๐ญ
but im determined im not going to give this up
enjoy brah
you deserve it
in other words i found the bike thingy
i could make ykw1 harder by disabling the bike for the entirety of the game LMAO
Oooo
Just thought of a perfect idea
now that i think about it
how do people make those kaizo rom hacks
for the 3ds at least
Yk how woganog has a yo-kaizo rom hack? Well he did it only by using mostly albatross and other tools
YOU could now update said mod and make it even harder
Perhaps yo-kaizo watch 2 +
XD
ah i see
@vast lynx could also have you update the mod directly :3 (not to mention with longer terror time, no bike and much more that could be the perfect Kaizo hack)
i think these are npc cycles???
itll just be another game of searching then i guess
i doubt in the code theres "intro start" lmao
ill try and search for codenames
Ehhh
Btw, could you send me the stuff you've used to get this far? Lol
@eager hinge i got ghidra to decompile
thinking about this has gotten me to realize you could help with something probably
yah ill upload it in tools
not rn tho bc train wifi is ass\
when i get to my aunts new house i will
ironic how we are both on vacations
im going to maryland to see my aunts new house, and youre living the life in paradise or whatever
XD
hide that from ign ples
Heh ๐
Ain't IGN a news outlet?
the joke is that ign gave pokemon omega ruby a 7/10 because of "too much water"
LOL
I did not get that at all
XD
Lack of context of the Pokรฉmon game tbh...
Anyway I wanna dm you something rq
grahhhh
That isn't good
theres a ton of code
maybe i should look up a key value?
movie, audio,
like here too
and now code aint decompiling
im pressing d ๐ญ
i might as well wait when im home
@lyric hollow idk why it aint decompiling anymore, so ill just use my home pc
daaamn
yeah no the d key isnt doing shit anymore
probably bc im on my school laptop
but it worked b4 and this thing is fast
or maybe its taking ages idk
still i wonder what this could be
ah ok so maybe its the FUNCTIONS
itll only decompile functions
i see
@lyric hollow romfs reference???
That is indeed a romfs reference
Which actually means
We can swap stuff
Omg
@lyric hollow
We can swap files that get loaded without knowing ASM

thing is tho
how would this benefit us?
If it calls to a menu file, we can make it call a different one etc
FUN_71003559b0(param_1,lVar3,"data/menu/loading.xa",0,0,"Stationary",0); lVar8 = param_1[0x5c4]; plStack_88 = param_1 + 0x117;
a menu file being the loading screen?
but couldnt we just edit the romfs to make a different loading screen?
and im also tryna find the value that makes the intro 54 minutes remember
Wait what's in loading.xa? Is it that loading text that appears in the corner?
54 minutes 
Try searching for intro or opening
im opening kurrimu2 gimme a sec
why tf does my audioplayer plugin put a play bar below the zip file
LMFAO
IM DOWNLADIJNG IT
GOOD JOB
THAT WILL NOT WORK
im signlehadeldy turning my college laptop into a doing machien
Oh ok
We still need to write a code patch, but we simply copy the existing code and edit the directory
i need fkn
No not yet
But it's close to happening
wha
Ooooo
I thought you had Kuriimu2 lol
yeah no kuriimu2 is like
remember im in maryland
on my school computer
not my main pc
Works for me what exactly is being edited?!?!
im tryna open the loading.xa file to test if my theory was correct
since kukki cant open switch textures
Hmmm
does anyone have a link to net.core
Lol
( i extracted the xi from the xa file)
Ah ok
Finally found it
https://dotnet.microsoft.com/en-us/download/dotnet/3.1
XD
It's out of support apparently so it stopped appearing 

Oh lol
...
that makes sense
goofy ass kurrimu2 using an out of service program
Was probably in service during development of the tool
Kuriimu2 update when ๐ญ ๐ญ ๐ญ

It doesn't open the link half the time
IT LITERALLY ISNT GIVING ME ANY LINK
Restart PC
GRAHHHHHHH
Kuriimu2 be like
ur using Ghidra to decompile correct?
if so then i'll download that and try and search up stuff.
Also @unreal summit can you put the settings you used to decompile it here
I want to know
yeah thatd be awesome
ill send the exefs files
All ik is you used ARMv8 because I told you to
if you think about it a lot of games (at least in my experience) use .mov or .mp4 ๐ค
Hmm
i used a custom build of ghidra
Oh cool
that opens switch nso files natively
I just found this
https://github.com/Stary2001/ghidra-3ds
Omw to use
thats not what i used
These are technically the game files...
however if that works for 3ds
Ik
You use switch lol
I'm just noting that down for myslef
And I'll try it
@lyric hollow it would be helpful if you looked too bc im technically on vacation as well
ill give you the custom build
๐
basically what you wann do
I would look if I owned the damn game and a modded switch ๐ญ ๐ญ ๐ญ
@lyric hollow download this
its an old build of ghidra but thatll be important
alrighty 
then download this
dont do anything with it, just keep it in your downloads
also you need java installed on your computer
already do
ok cool
1 i play mc java. two i've done virus development in the past with it
then install the switch loader
alright
click on the zip or rar of switchloader
restart ghidra
open the main file
and it should look like this
ignore the destination file name laready exists
well youll open it
itll say anaylze
use switch ipc analyzer
and itll take a bit
fair and expected
the functions in the symbol tree will be able to be opened in the decompiler
and then the hunt will begin
precisely
and you have more experience than i do with this
so chances are you have a better shot
btw
they're a lot of different video file formats. best to search up every single one
hm
this doesnt result in anything
It does? 
Try searching for the song file name
and that is? lol
It's a .ayb file I think? Idk switch formats lmfao
Thadd should know, he made this very mod
i think thats how you'd edit them
well its yw1_op
ofc 
That's not how you edit
The C is inaccurate
It's just pasting the decomp code into a file
maybe different for switch
And you can't use it for a patch

๐ญ

seriously though
kinda wondering how switch development kits will run with this kinda stuff
ordering one
nintendo probs gonna complain at me
now it wont fkn decompile anything
๐
its just stuck on fun_710052f530
true
And also the correct term is "disassembling" 
it aint decompiling tho
OR i couldve decompiled the whole main file
OHHHHH THATS WHY IT LOOKED SO READABLE
You're looking at the C++
Or it's C idk
wait
do you think perhaps the fps limiter will be able to be removed for ykw4++ using this ?!?!
UHHHHHHHHHHHHH
"Decoder"???????????????
THE DECODING
WE CAN YOINK (ykw reference) LEVEL5'S CODE TO READ THEIR OWN FILES
so probably at least 60fps ykw4++ coming soon 
JFJJGKEJENFNELDMHMELQMGNWKFNDKSNFDJDJSJSI
when there own code backfires
how so?
also @lyric hollow
this is what youll be using for analysis
alright
idk what the other checked things do so i left them
since im so clueless with code
my microsoft surface is fighting for its life here tryna do this lmao
xDDD my vacation laptop is doing the same xD
deadass dont know what this means

You can find what FUN_710024ae40 is by using the symbol tree
Then it'll make more sense
don't let my own games code show people how to edit said code
USE THE SYMBOL TREE
When you finish your game, disassemble it and see how much of your own code matches up
IT JUST REDIRECTS ME TO THE THING
PRESS THE +
that still dont do nothing
i cant understand any of this
sdfoajsvnkcxzmv,xckzvcx
i'll make it super fucking annoying to read
how about that
nooooooooooooooooooooooooooooooooooooooooooooo

proceeds to encrypt everything and make it all into a new format
deadass me
you know more abt this than me so once the code is up for you lmk how it goes
im resigning for now lol
well
there is a few chances that the "intro" is codenamed to something completely different
let alone the chances of it being in bits and pieces
WHY WOULD THEY DO THAT
plot twist: the value was in the romfs all along and we couldnt open it
๐

me omw to watch yo-kai watch news
bro
i dont have my microsd card to usb on vacation
is there any way to add files to switch via usb
the hekate shit aint working
@lyric hollow any info?
I didn't see much when looking around
I'll have another look today but that'll be a few hours
Me who's still on vacation 
deadass gonna blow up level 5 headquarters

@lyric hollow if yr free could you look at the code again?
gonna take another shot at it soon
not free atm sorry
no worries
SWEARING
@vast lynx @lyric hollow ok so
i converted some of the code
decompiled into C
do any of you know how to read C
How many times must I tell you
The C code is inaccurate and you can't use it for anything
ah right
there goes my strategy
wait so the decompiled code doesnt mean anything?
i thought itd be easier to read when decompiled
FUN_710004b010("yw_sound");
FUN_710004b010("sy_000");
FUN_710004b010("yw_bgm");
note to thad:
if it plays the files from there, you should be able to just replace it with what you want and either keep it to play after or delete it for your own files
FUN_7100241b70
@lyric hollow
PROGRESSSSSSS
YUS
๐
Well yeah no shit, that's the files of the game ๐ฟ how else will it read the files without calling them
PKSDV:LXCJVKL:CXVc
i got rly excited when i saw that you have no idea
just thank @eager hinge personally
yes well of course it refernces them but you have to find where
it took a while and most of the code is still referenced as undefined or just not decocmpiled
grahhhh
idk why tho ๐
@unreal summit what did you use to learn ARM assembly (or at least try to)? I can't find any good guides
thats the funny thing, i didnt
whar
It does? Damn
WTF
UPLOAD FIALED
BULLSHIT
there we go
this is what the switch uses
@vast lynx and ghidra converts the code into c so its able to be read
thats how i got this
only problem is i cant find that damn value yet
or even edit the code yet
Yes but the C code isn't accurate, it can only provide a general outline of what's happening and sometimes it can just be way off the mark
You also can't write a code patch in C so it's barely useful
then how would i even edit the code
Most reverse engineering guides advise you outright close the tab with C code
ARM assembly
Sorry lmao
Not ARM apparently
But yeah ASM nonetheless
hmmmmmm
Hi everyone,
as I had to dig through a lot of information by myself, I thought that I could do a small tutorial on how to modify Unity games for cheating (and not only, e.g. for modding etc.).
You will need the following tools:
- NXDump https://github.com/DarkMatterCore/nxdumptool
- IL2CPP...
hmmmmm
This is a basic guide to create an .ips that patches 'nvnWindowBuilderSetPresentInterval' and/or 'nvnWindowSetPresentInterval' for a game in order to make the game run at 60FPS. Some games need additional patches specific to that game for 60FPS and not only this method.
If you want to follow...
@lyric hollow this could be for ykw 4 or ykw 1
every day... a little more progress is made
so if we use that unity method
for extracting the fkn
main
we can open the elf with ghidra
and possibly edit the code
and make it 60fps?
hm, well this is surely interesting ๐ค
good
yeah PLEASE
WHAAAAAAT
minecarft in real life !!!!
yeah
i know the recipe, does require a certain size of pvc pipe, and gunpowder access though :3
Only for Unity
il2cpp only works with Unity
And it says for unity games
im talking abt the elf file
This isn't entirely true but it's mostly true
nx 2 elf
Did you not know about that?
it just so happens to be with a unity guide
With 3DS modding you convert the code.bin to code.elf usually
erhem thats 3ds
eitherway just
maybe
maybe if we open the elf with ghidra
itll either be the same
or more readable
what if ykw1 uses unity?
it certaintly does look like it
It doesn't.

I'll prove it right now
on that note, im curious
what engine DOES ykw 1 use
is it just a game exclusive one
like with what smash bros does
APK Editor (the latest version is DOGSHIT don't download it)
If the game uses Unity, it'll have Unity files
Android and Switch have the same version
the mobile and switch port ARE the exact same
alright
thanks for debunking that at least
either way i can at least use some of that
i just dont know asm or how to patch with it
@eager hinge knows a little iirc
god this is so annoying i just want ONE value
lowkey why does the switch have to use asm
Do you still not get it ๐ ๐ฟ ๐ ๐ฟ ๐ ๐ฟ ๐ ๐ฟ ๐
EVERY DEVICE EVER WILL DECOMPILE INTO ASM
no im lost now
There's different types of ASM
Yes but most use x64 nowadays
i mean my computer is x86
Is it really ๐
p sure
So you can't run 64 bit apps?
i have a windows 11
Well then it's x64
i have a modern day computer
Or x86_64 but ik nothing about that
so basically like
every device
as in every console
???
but from what ive heard, no one codes w asm in this modern day and age
so why does this happen
hmmm
maybe this isnt so black and white
x86_64 and x64 are the same thing
we've been over this
a code file is just text
it means nothing to the computer
the compiler takes it and converts it to machine code
if you try and decompile machine code you can only decompile it to assembly and convert that to C
its still confusing
we cant edit it directly on ghidra and the c code is apparently "innacurate"
It's the lowest level language aside from raw binary
It's the raw instructions the device receives
Yes because it's a high level language and so you can't get an accurate decomp because it doesn't use proper functions that the PC can read and instead has its own functions
They then get converted to something the PC can read
With lower level languages, less conversion is required, therefore less obfuscation
@vast lynx
this is what my directory looks like
i just wanna convert the main to elf brah
i cant even do that ๐
@lyric hollow heres something sable showed me
This is yet another random side project I was working on recently, and my first attempt to reverse engineer a real world application compiled into binary. In this article, I want to talk about how I reversed engineered an Unity IL2CPP binary compiled to NSO, in a step-by-step fashion. Forewords Kotoba no Puzzle: Mojipittan is [โฆ]
this could be different but this game is also from japan
while that may not have anything to do with it, maybe the guide will be helpful
Yo Kai Watch 1 (Switch) - Intro Replacement Mod (EXEFS Patching)
maybe
mod is progressingvv
??
me and kingu mightve found out it doesnt need the exefs afterall
don't get your hopes up
lol
Hi hello hi 
Nobody actually knows how they work but I know what some of them do and you can swap blocks of code or whole files to change the function
WOGGY NOGGY
OMGIR
when i grt home from work ill send you the xq
Usually I can decipher what they do by looking at where it's stored and the file name as well as the function names occasionally
@vast lynx
heres the xq and the one translated with xtractquery
basically we think the main theme bgm playing here is in here
we want to get rid of that completely
and have it only play at the title screen
So I'm assuming MO1_MAIN_THEME is the song?
@unreal summit holy shit I may be able to extend the time limit from here instead of just getting rid the song
What's the normal length before it automatically goes to the title?
OK OK THIS IS HUGE
yep
so i calculated it
for the SWITCH, the main theme plays at like 30 to 40 seconds in during the intro
bc the intro then goes to an animation w the japanese logo
coinciding w the inro
intro
Ok
i timed it on a stopwatch but ill time it again tmrw
And what's the length of the new intro?
well for the swampy marsh one its supposed to be like 58 seconds
but the whole purpose of this mod is to sorta get rid of that to lead way for custom intros that are longer
like it would be more convenient if we just made it like
9999 seconds until the main theme plays in the intro
ye
and when you skip
it plays like normal
once thats done
this 4 month project
will finally close
and i can look into making exefs patches for another mod
as i now know how to tamper with when you get a watch rank
yo kai encounters
possible lighting
Yo Kai Watch 1 (Switch) - Intro Replacement Mod
I found a number saying 30 as some sort of parameter before TitleStart and changed it to 9999, tell me if it crashed
You have to convert back
With XtractQuery
how do i convert it back
@vast lynx :รคngry:
nah, waiting for woganog to tell me how to convert it back
nvm i did it
@lyric hollow im gonna try what he did
@vast lynx yeah it doesnmt work lmfao
again, i think a better option would to remove it playing the main theme during the intro
and only have it play once you skip it
bc when the intro DOES end, the title screen music plays
@vast lynx
๐
yeah so idk what we gon do
plus i forgot to mention
what do xq's even di?
do?
i found them in the seq folder in the a.fa
bc i hope this is the solution
@vast lynx could you try and do another edit?
also does ykw use x32 or xseq?
....
maybe thats why???
hold on
@vast lynx
i kept formatting it to xq32
maybe your thing actually works
Actually idk which it uses
Just literally do it without specifying, it does it automatically iirc
It can detect
Or at least, I think so
im talking abt replacing it in karameru
Ik
it doesnt detect shit
itll replace any file w anything
thats still more hope tho
to try it
@vast lynx or what if i just got rid of the call function
maybe it wouldnt call the title bgm at all?
and then only play it when you skip itv
that's literally what the main cause is rn
How do you even know that ๐ฟ
to not have the main theme play over the inteo
intro
thats the main issue at hand
this project is abt rhis
*this
And even then, if you are sure the BGM is the issue, just replace the BGM ๐ฟ
There are literally so many fixes to your problem
i cant replace the bgm for the main theme
bc itll always play
during the intro
i want to make sure that doesnt happen
Replace the intro theme (idk if you already have)
and delaying it w a sound editor doesnt work either
thats what i did
this custom intro wont work
unless we delay the main theme
during the intro
this project has been going on for months and a solution might just be here
It's a timer
Modify the timer, not the music
The timer is in the .xq
yeah thats what i wanna know
like
where the fuck is the timer
so i can delay it
You've been trying to mess with the music the whole time when the real answer is right in front of you
but thats the real question
where the fuck is the timer
i cant understand this xq file
in readable text that is
liek
its not OBVIOUSLY gonna say that ik
sorry im just like
i want this to be done so bad
๐ญ๐ญ
May have been the A button one though
the a button skips the intro
Yeah ik
~~ or any button~~
Try clicking it and see if I disabled it by mistake
alr
ill do that in a bit
rn i need a break
too stressed over this
sorry again
๐ญ๐ญ๐ญ
@lyric hollow @vast lynx my original theory couldve been correct, but this guy doesnt know how xq's work
so im still gonna try the xq thing
As I said, a timer.
and youre like
100% sure its in that xq
bc i looked around the exefs for 2 months
ill import that thing you gave me
again, its prob bc its xq32
i cant convert it to xseq tho
lets try this again
@vast lynx do you possibly know the creator of this program?
bc i deadass cant tell if the switch uses xq32 or xseq
aughhhhhhhhhhh it keeps playing
this is so annoying
Ok I got it
Just replace it with an empty file
And if it still does nothing, we are editing the wrong thing
?
wydm?
like could you send over the xq yourself??
or you did smn else
hmmmm
oke
if NOTHING happens
we are editing the wrong thing
you just wanna test that theory
Correct
