EdiZon Mapping

[Th3Alic3]

Hey ZaksBeast,

We have been able to map a lot of the Dynamax Adventure aspects in EdiZon SE so far:

• HEAP 0x50B122B0 (UInt32) = Remembered Legendary 1
• HEAP 0x50B122E8 (UInt32) = Remembered Legendary2
• HEAP 0x50B12320 (UInt32) = Remembered Legendary 3
• HEAP 0x4514A4B0 (UInt64) = Rental Team/Pathway SEED

The result of this mapping now allows us to set the Legendary Boss as well as a specific Pathway (aka the easiest Pathway) in EdiZon SE. This allows us to repeat the process indefinitely without having to close the game. We able to now do this entirely via the Console (no need for save editors for this part.)

The next step is to map the specific variables which determine stats (EC, PID, IVs, & Nature) of each of the 4 encounters.

You stated that the game works something like this:

1. The csprng returns a number: 0xAA
2. 0xAA is used to seed a xoroshiro
3. The xoroshiro returns 4 random numbers: 0xBB, 0xCC, 0xDD, 0xEE
4. Each of those 4 numbers is used to seed a new xoroshiro
5. Each xoroshiro is used to help create a Pokemon for the dmax adventure

The answer ultimately danced around the question (that I did not make clear enough):

What are the heaps / variable types that Capture Sight reads to display the stats (EC, PID, IVs, & Nature) for:

1. Round 1 Encounter?
2. Round 2 Encounter?
3. Round 3 Encounter?
4. Legendary Encounter?

(I would absolutely love if Capture Sight displayed this information in the main app. It doesn't need to be in the overlay.)

Capture Sight is clearly able to access the variables at any point during the Dynamax Adventure. So, if the app can access this information mid-Adventure, then the variables are accessible during the ENTIRE Dynamax Adventure.

If the variables are accessible during the ENTIRE Dynamax Adventure, then they can be MAPPED in EdiZon SE. If they can be mapped in EdiZon SE, then they can be frozen. This would allow CFW users to hunt for desired stats with aid of Capture Sight. Once the desired result is found, then the HEAP can be frozen which would lock in the stats. It would turn the Dynamax Adventure into a stationary encounter for the purposes of Shiny Hunting... while producing a "legit" Pokémon.

[zaksabeast]

Ah, good question.

In a previous discussion, I made a comment describing three different sets of PRNG mechanics that go into a dmax adventure:

• A csprng for the backpacker inventories (and probably other things)
• A save-seeded xoroshiro that seeds mersenne twisters to choose Pokemon templates (species, moves, etc.)
• A csprng seeded xoroshiro that seeds other xoroshiros to fill in the templates with details (PID, EC, IVs, etc.)

CaptureSight only handles the mechanic to choose Pokemon templates, which is the reason why it doesn't show PID, EC, IVs, etc. When I asked around, more people were interested in knowing the species and didn't really care about stats, so I didn't dedicate time to that feature. If more people are interested in stats, that might be a good goal for the future. 🙂

Capture Sight is clearly able to access the variables at any point during the Dynamax Adventure. So, if the app can access this information mid-Adventure, then the variables are accessible during the ENTIRE Dynamax Adventure.

This is only partially correct: CaptureSight can access the seed stored in the save that determines species, but not the seed that determines PID, EC, IVs, etc. Because the seed stored in the save is only overwritten when a player defeats a dmax adventure, it lives throughout the entire adventure. CaptureSight can also not get the seed for the backpacker inventories.

The csprng returns a value that is very temporary. As far as I'm aware, the only time it's stored on the heap is as part of the xoroshiro state when the xoroshiro is initialized. After the first random number is obtained (which happens pretty much instantly after it's initialized), it's no longer on the heap. You would have milliseconds at the very most to get the seed.

If your goal is to recreate the same PID, EC, IVs, etc., there are three ways off the top of my head to do it:

• Set a breakpoint where the code seeds the xoroshiro and modify the seed manually while execution is paused
• Write a game patch that always uses a specific seed for the xoroshiro
• Set the xoroshiro state that's on the heap (although this could have some timing issues if you want the boss and rental Pokemon to also have the same stats as previous runs)

[Th3Alic3]

#> When I asked around, more people were interested in knowing the species and didn't really care about stats, so I didn't dedicate time to that feature. If more people are interested in stats, that might be a good goal for the future. 🙂

First, the way you have worded this multiple times makes it sound like the group you spoke with was presented a choice.

Second, GitHub is NOT a social platform for non-coders. This is not a website where regular peeps will create a login and even if they can nothing about the site promotes social interaction. This does not leave a whole lot of room for the average user (myself) to express necessity.

CaptureSight only handles the mechanic to choose Pokemon templates

Yes, I understand the values are populated via a formula derived from a SEED. This is why I have been asking your aid finding that SEED. I am NOT a programmer. I have only minor experience with programming which is why I know Capture Sight works similarly to EdiZon as I saw multiple class functions labled essentially as READ HEAP.

• Set the xoroshiro state that's on the heap (although this could have some timing issues if you want the boss and rental Pokemon to also have the same stats as previous runs)

Yes, this is the plan!

You've stated that (akin to the regular Raid SEED viewers) that Capture Sight uses this "xoroshiro state" SEED variable to populate the fields below for Dynamax Adventures:

Yes or no, does Capture Sight read the HEAP for this "xoroshiro state" variable you are referring?

• If so, are you able to provide me with the memory address for the HEAP and it's variable type?
• If not, is there any chance you are able to find the the memory address for the HEAP and it's variable type with the tools at your disposal to help?

I am stuck and am unable to find the the memory address for the HEAP and it's variable type for the "xoroshiro state" variable. However, if someone is able to provide me that... it's the start that I need.

[zaksabeast]

First, the way you have worded this multiple times makes it sound like the group you spoke with was presented a choice.

Yep, I took a small poll on the Max Raids Discord when the latest DLC was released. That community has some of CaptureSight's primary users, and is a good place to contact myself and people knowledgeable about raids. The RNG discord is also a good resource with knowledgeable people.

I am NOT a programmer. I have only minor experience with programming which is why I know Capture Sight works similarly to EdiZon as I saw multiple class functions labled essentially as READ HEAP.

No worries. 🙂 I'll leave some of the more technical details out - hopefully that'll help avoid any miscommunication.

You've stated that (akin to the regular Raid SEED viewers) that Capture Sight uses this "xoroshiro state" SEED variable to populate the fields below for Dynamax Adventures

It sounds like there may be some misunderstanding. CaptureSight's overlay populates that screen by reading the Pokemon from the heap, not by reading a seed or state from the heap.

CaptureSight's applet can calculate things like PID and IVs for regular dens, but not for dynamax adventure.

CaptureSight can not currently display the EC, PID, IVs, etc. for dynamax adventure Pokemon before the encounter by reading a seed or state. It can display raid Pokemon after starting a battle with them since it reads the Pokemon, not the seed or state.

At the moment, I'm not concerned how the variable is turned into the individual stats currently, I just need the variable that allows Capture Sight to display these stats for Dynamax Adventures:

CaptureSight reads the current raid Pokemon from 0x886c1ec8. This isn't directly tied to Dynamax Adventures and works for any raid. If you want to modify the values before the battle, this is not what you're looking for.

Yes or no, does Capture Sight read the HEAP for this "xoroshiro state" variable you are referring?

No. CaptureSight doesn't display the EC, PID, IVs, etc. before the dmax adventure because it doesn't have those values before the adventure begins. It can display them after the raid begins because it reads the Pokemon, not the seed or state.

If so, are you able to provide me with the memory address for the HEAP and it's variable type?

Regrettably, I don't have the offset to the state.

The state moves around in memory when the game turns on/off, so there's not a single offset for this. You'll need to read a few pointers to figure out where it's located. Sadly, I also don't have the offsets to the pointers.

Basically there is an offset that needs to be read, and the value is the offset to the state. However, there are several pointers that need to be read, so there's really an offset to an offset to an offset, and so forth until the state.

If not, is there any chance you are able to find the the memory address for the HEAP and it's variable type with the tools at your disposal to help?

Unfortunately the tool I would use to help find those pointers (twili) doesn't appear to work on the latest switch firmware, so I won't be able to help for the moment.

If anybody reading this has a way to set breakpoints and read registers on the switch, I can provide offsets for the game's binary that can help accomplish this.

[Th3Alic3]

Thank-you for the clarity. This has helped a lot!!

If that tool is fixed later, I will always appreciate this!! (I'm in the process of creating a script for a YouTube video in order to share how far you can go with CFW and still retain a legit result. Since the stats are linked to a SEED, same as regular Raids, I will have to leave that out for now. Still this is great help.)

[zaksabeast]

I'm glad I could help 🙂