Announcement

**Lazy Bastard** · 06-15-2011, 04:53:51 PM

Thanks for sharing it

**Gtlcpimp** · 06-21-2011, 01:32:55 PM

That's what I'm here for, help people learn (IF they are interested). The engine operates chunks, each Boolean command branches off into it's own chunk. So if you have 500 lines of codes, and you split the codes up into 20 jokers, the engine will only read 20 lines until the joker Boolean check marks true. The main purpose behind this is to preserve CPU power. Keep it from doing more than it needs to be doing, to maximize potential and allow the use of large cheat lists without lagging the game up. It works wonders with cheat lists that I managed to push up to 100 kb

The notes over embed data / routines are "to be implemented" features. The original idea was to not worry about finding a memory address to place a function that doesn't need a game specific hook. For example, you make a routine and just want A hook (not a specific one just want a random hook), you don't have to consume more space just to write the routine onto memory and you won't have to find a hook. The '9' command is the ExecData command, if the Embed Routine feature was implemented there would be a '9' command split, '90' -> exec data '91' -> exec embeded routine (with the routine ID as the argument for the command). The embeded routine contains no address, and all internal jal's, j's get patched to operate entirely in the kernel space it is located, etc. Embed Data is for just storing RAW data without having to find a place of memory to put it. Saves space by cutting the size of the codes in half, and saves frustration over finding memory blocks to place crap.

**dubtones** · 06-21-2011, 06:34:35 PM

Completely ingenious how you built chunks so users could load a massive amount of codes (100 KB) without issue.

**Gtlcpimp** · 06-21-2011, 07:57:26 PM

If you want to check it out I have the 1.3r03b engine implemented into the application I wrote called RemotePS2 (which is part of CheatCentral, an unfinished project that is supposed to be a cheat device station for the PS2). RemotePS2 allows PC to PS2 connectivity. The main idea behind it is to be able to fully remotely manage the cheat codes on your PS2, however the remote features are unfinished and disabled. Currently it allows you to send a code list over the local area network to the PS2, and launch the game and/or back up via swap disc method. It also allows remotely sending .ELF file's and executing them over the network, along with dumping BIOS over the network. The unfinished portion would be the management of the cheat files on the memory card. The OVERALL purpose, is for the v1.3 cheat device to be the PS2 side application for managing cheat codes, and RemotePS2 being the PC (windows supported only application) remote management. It also includes an HTTP cheat server, so if you don't have windows or can't get the PC application to work on your computer you can load up the HTTP server application on the PS2 to operate the management through the web browser of your choosing. The HTTP server only supports sending codes / launching a game disc (no backup loading feature is set on it yet). The HTTP server operates v1.2 engine, the v1.3 device operates the v1.2 engine, and RemotePS2 operates the v1.3r03b engine (shown in the top post of this thread). Worth looking at if you're bored enough, just more of my projects I started but never finished due to lack of time / interest...

**dubtones** · 06-21-2011, 09:48:45 PM

Sounds interesting enough, also how does the BIOS dumping feature exactly work? For example, does it dump straight onto my computer or do I need to extract it from a USB, can it work live, how well does it work on a wide variety of games you have tested it on(like others dumping tools they work on some games but don't work on others and everything in between), and could you use it to get the memory dump of the game?

**Gtlcpimp** · 06-21-2011, 10:42:17 PM

The BIOS dumps straight to your PC over the local area network. The only problem it gives is the speed... The best I have managed to get the PS2 to do so far is upload at about 20 kb/s and download at about 324 kb/s. So you can upload .ELF files almost instantly to the console, but downloading the BIOS dump actually takes a while... However under the CheatCentral main menu, you can dump the BIOS directly to your USB flash drive, and then copy it over to your PC off of the USB stick. It does not dump memory from games, that is a different story on its own.

For dumping game memory, you could try Jimmy's IG-Mass-Dumper tool. It doesn't work with all games, but does for some.
I was testing a method for dumping memory from games, and put the .ELF file on these forums somewhere, called Memory Dropper. It's not an effective method (tries to force an IOP reboot using it's functions rather than the game's functions, and re-launch itself via ExecPS2 system call). I find it worked mainly during MPEG sequences (cut scenes, whatever you call them).

The only sure fire way I can guarantee you can dump a game is to manually write a code for the specific game... CodeMasters-Projects shows a way to make a save-dump code for the older module games, but for the newer games that have updated save functions you would have to take a different route. For example, SOCOM: Combined Assault, you can't follow the CMP save dump method on there, so I wrote a code and .ELF to manually dump at the press of a joker. The code forced the game to activate it's own reboot functions, and forced it to do a custom ExecPS2 system call rather than the original LoadExecPS2 system call. When you press the joker, the engine restores the .ELF file onto memory address 0x00090000, and then patches the game's memory to force the custom reboot to directly launch the .ELF restored onto RAM, which then loads the USB modules and saves 0x00100000 - 0x02000000 to the USB stick.

**dubtones** · 06-21-2011, 11:40:41 PM

That pretty bad ass, I check out CheatCentral few minutes ago and I like it, your a talented developer. And yeah I currently use Jimmy's dumper, and works amazingly on some games but others I can't get to work for my life. I'm always on the look out for a better technique for dumping LOL.

**Gtlcpimp** · 06-22-2011, 11:28:19 AM

Well if you got the time and patients you could load up LDv3 and manually write down 32 MB's

What game are you trying to dump?

**dubtones** · 06-22-2011, 04:59:02 PM

That's also a good idea pimp, but the only thing with LDv3 is that it doesn't work on some games. And nothing really specific I just would like to have a easier way of dumping for the PS2, like for the PSP its a click away from multiple live dumps (my favorite console). Is your SOCOM: Combined Assault dump sub released? Or do you mind share it?

**Gtlcpimp** · 06-23-2011, 12:45:42 AM

No, not yet. It's 95% .ELF and 5% hard coded assembly.

The .ELF boots up, stores it's entire self into kernel (0x80030000), and writes the main engine into kernel (0x80078250), and then hooks it with the master positive Syscall jump and link line (0x800002FC). The engine reads the game's static controller input address (0x0071575c), and waits for it to match the desired input (I set it to the press of R3). Once I hit the button, it restores the .ELF back onto user space from the kernel preserved space, and then writes a few patches to the game memory. It patches the game's LoadExecPS2 Syscall to instead of booting the SLUS file it will perform an ExecPS2 System call with the arguments set to launch the .ELF it just restored (0x000900e0 entry point) with bogus name arguments (to prevent failure). Then it patches the game to force it to execute the game's reset function so when it returns back from the System call the game will reboot itself. The game does it's normal reboot routine, flush IOP and remove all replacement modules off RAM, etc. etc. etc., BUT, it won't launch it's SLUS file, it's been patched up to execute the restored .ELF, which then performs an IOP reset (again just to be safe) and then loads modules from ROM0 along with a USB driver to save memory 0x00100000 - 0x02000000 to a USB file

Flawless victory, method is guaranteed to work on every game. The only downside is, it's a game specific set up (meaning you have to manually write the code to match the game you want to dump). However the METHOD itself is the exact same. You will not be able to return to the game after the dump, you will have to boot the game back up all over again (which is another downside, but hey you get a dump of the game do you not?)

I could release the source, but would have to wait 'til I get back home.

**dubtones** · 06-23-2011, 01:54:35 AM

Oh I see, umm seems like a very thought out and effective method of dumping over all. Would it be a difficult task porting it over to other games though?

**Gtlcpimp** · 06-24-2011, 04:46:00 PM

Wouldn't call it porting, would be more like re-making for another game. Shouldn't be too difficult, as long as the game was set up to reboot itself upon installing update, or returning to main menu, or anything that would make the developer want to reboot the game. It's easy to trace a reboot

Bonus side of it, is it allows you to take any game (that has the ability to reboot itself like explained above) and modify it to exploit your console. So you wouldn't have to purchase a cheat device or mod chip to run home brew. You could rip an image, inject the mods, burn the DVD, boot + swap to load mods and hit your joker to launch the home brew application.

Announcement

CL Cheat Engine v1.3r03b Release

CL Cheat Engine v1.3r03b Release

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment