Cosmic Cheat ELF + ASM...

[Lazy Bastard]

I've used IDA set to MIPS r5900l (PS2 MIPS core) to disassemble an ELF I uncrunched using PS2Unpacker (the original ELF was in a compressed form)...here's a 7Zip file (grab 7-Zip from http://www.7-zip.org/) of the original (with readme and .cff included for completeness) as well as the unpacked ELF and a few different forms of full assembly dumps of the unpacked ELF.

In case you don't know, Cosmic Cheat is a discontinued attempt at making a homebrew cheat system for the PS2. While it was never intended to be a hacking system, had a buggy menu system and a strange configuration, only worked via Naplink, and has no active authors (as a matter of fact, I don't even know who worked on it in the first place), it stands as an interesting model.

Unfortunately, the author(s) didn't release the source, hence my disassembly

Perhaps I'll modify it a little to allow loading from cdrom0, mc0, mc1, and mass (USB flash drive)...

[Lazy Bastard]

Apparently, at least one of the authors was Sjeep, who went on to release HDLoader (a properly pressed, fully bootable disc)...apparently, since he made money on HDLoader, he abandoned the idea of doing anything for free anymore, and openly stated he was only interested in doing paying projects from then on. At least this is what xiaNaix said in an "interview" here: http://www.backupscene.com/portal.php?topic_id=582

He went on to say, "There's no question that HDLoader revolutionized the PS2 scene. But most of the work had already been done. Sjeep simply took the ideas and code of other people (uncredited, I might add) and put it together for a commercial venture. That's why the ps2dev guys don't like him either. "

I wonder who he had his discs created through, though...

[Edit] - Damn, apparently Sjeep is the guy who made PGEN and libhdd, and the main (if not only) coder behind the DMS modchips, as well as the ToxicOS/BIOS and Team Toxic itself...he's partnered with Divineo. Interesting stuff to read.

[Lazy Bastard]

On a somewhat related note, I've noticed that in quite a few ELFs (including SLUS stuff from actual games), the System.cnf is referenced, specifically under dir cdrom0. This explains why in many cases, even with an entirely intact root dir, some things just can't run from a flash drive.

[LiquidManZero]

That's quite interesting. Could be even good enough to show how the hell you make the memory resident part...

[Lazy Bastard]

Indeed. I could pull a similar move with an ARMax, possibly.

[LiquidManZero]

True, but that has the source code, right?

[Lazy Bastard]

Action Replay Max? I highly doubt the source for that has been leaked. If it has, I haven't heard about it.

If you're referring to Cosmic Cheat, then reread the above. The author(s) never released any source. My ASM source comes from a full disassembly.

[LiquidManZero]

Ahh, I wasn't quite clear on that. If you can disassemble something like Cosmic Cheat, and reassemble it, then it might work on ARMax.

[Lazy Bastard]

Yeah; it's worked on a few things so far. Now to learn a lot more MIPS r5900l ASM, heh.

[LiquidManZero]

Eh, somewhat related... Do you know of an assembler that can produce psx executables?

[Lazy Bastard]

Heh, I just came across something like that today...I believe I was somewhere on Hitmen's site, or a link from there at least. A link to Hitmen can be found in the GSHI Links section.

[Lazy Bastard]

I have a PS2 assembler as well, if you like.

[LiquidManZero]

Ahh. I should've remembered about that one. Heh, I'm not sure how much use I could make of a ps2 assembler, lacking any means of running ps2 code...

[Lazy Bastard]

Heh, I see. Something needs to be done about you not having a PS2...

[Lazy Bastard]

Using my uncrunched CCheat.elf, I disassembled with PS2Dis, invoked the analyzer, labeled syscalls, and exported to a text file.

The reason I hadn't done this earlier is that I didn't really understand all the functions of PS2Dis, as the instructions were translated kind of roughly from Japanese, and no one seems to have written an in-depth guide for the util (a few have tried, but didn't really say much but the obvious). For example, when I first tried to export anything, I got, "Specify region then retry. Region is addresses between cursor and marked address. Press SPACE to set mark." For the life of me, I couldn't understand WTF he (hanimar) was talking about. I finally realized that what he meant was, "Specify the area of theoretical memory you'd like to export. Press SPACE at your starting point, and scroll down to your end point (there's no cursor, really)." Though, since I really didn't spend much time playing with PS2Dis, it may be that I was just being mentally lazy, heh.