Finding Multi Level Pointers With TempAR

Before reading this section it is important that you have experience in finding level 1 pointers. Refer to the requirements section for details.

This would not be possible without the various contributions from eighthdayregret and Smoker1. This is a community effort. See credits.

Difficulty

Hard (tedious actually), must have experience in finding level 1 pointers.

Requirements

Tutorial

In this tutorial I'm going to use the game Ar Nosurge Plus - Ode to an Unborn Star (USA) (NoNpDrm) as an example.

Step 1: Get Code Reference and Dump the Memory

Finding Pointers With TempAR: Step 1 - Get Code Reference and Dump the Memory

My code reference is for the experience which have a value of 14 (0x0000000E) (8-bit).

Step 2: Get the Pointer Code with TempAR

By following the steps above you should now have two memory dumps:

PCSE00707_0x81000000_0x8A000000_0.bin
PCSE00707_0x81000000_0x8A000000_1.bin

And two of my code reference:

0x8170B3B8
0x8170BE78

Now here's the hard part. In order to get the multi-level pointer codes you'll have to go deep. Depending on the game you might have to go 2-3 levels. In the case of Ar Nosurge Plus the pointer code is level 2 so I only have to open each results one time.

This process will really test your patience as not only you have to go deep but you'll have to test each green results that you'll see. It's a tedious work.

Launch TempAR and follow the settings below:

Name	Values
Memory Dump	`PCSE00707_0x81000000_0x8A000000_0.bin`
Address	`8170B3B8`
Memory Dump	`PCSE00707_0x81000000_0x8A000000_1.bin`
Address	`8170BE78`
Mode	Other...
Base Address	`0x81000000`
Maximum Offset	`0x9000`
Value	`0x0000000E`
8-bit	Checked
Only Display the Optimal Pointer Paths	Checked
RAW Code	Unchecked
Include Negatives	Unchecked Check this if positive pointers yield no results
Real Addresses	Checked
CWCheat	Checked

What we're going to do at this point is to expand each results until we see our multi-level pointer code. See TempAR Tips: Expanding the Search Results.

Since Ar Nosurge Plus is level 2 deep I only need to expand each results once.

First address 0x810E215C yields no green results:

Second one 0x811B67F0 is the same:

Third one 0x815E68E0? Nope:

Note: There are non-working green results in this segment.

And the fourth address 0x815E68F0:

We scroll down and...

Now we have the pointer code which is 0x89035F94!

Note: If you get multiple green results always prioritize the first result and if that didn't work continue testing each green results until you get the pointer code.

Note: Now if there's no green result then use the Include Negatives or increase the Maximum Offset (see TempAR Tips: Extending the Base Address & Maximum Offsets). If there's still no green results then you're either using wrong code reference or the wrong value.

Step 3: Converting CWCheat Code to VitaCheat

Now that we have our level 2 pointer code the next step is to convert the CWCheat code to VitaCheat format (see TempAR Tips: Levels).

_C0 Generated Code
_L 0x68035F94 0x0000000E
_L 0x00000002 0x00003128
_L 0x20001680 0x00000000

_V0 Max Experience
$3202 89035F94 00001680
$3200 00000000 00003128
$3300 00000000 000F423F

[[[0x89035F94]+0x1680]+0x3128] = 0x000F423F (32-bit)

$3XZZ:
- $3 is the identifier for the pointer write
- X is the bits (8-bit/16-bit/32-bit)
- ZZ The pointer level. In this case it's level 2 so 02.
$3300: This the default value for the pointer write
89035F94: The pointer code. Follow the green result because that's the real address (see TempAR Tips: Real Address).
- 00001680: The first pointer value
- 00003128: The second pointer value
000F423F: The cheat value. It can be whatever you want.