Help with a hook - PS2

[dnawrkshp]

I will make the assumption it should be by a file hosting site. Here's the link for the dump.bin;

http://www.mediafire.com/?bqzvsv7ob7li6vz

Here's the link for the Dump.pis that has already invoked the analyzer (If you care to invoke it);

http://www.mediafire.com/?3j2zc7sgg1zyfzn

[misfire]

800002FC is inside the syscall handler. So I guess the hook will be executed on every syscall. See https://github.com/ps2dev/ps2sdk/blo...etkernel.c#L26

Also, for a working and relocatable cheat engine, check out PS2rd, in particular https://github.com/mlafeldt/ps2rd/tree/master/ee/engine

[dnawrkshp]

Well, I searched around a bit and found something in gtlc's source code.

lui v0, $8008
lb v1, $8900(v0)
bne v1, zero, 7
nop
addiu v1, zero, 1
sb v1, $8900(v0)

call _main 
/*I replaced 'call _main' with the rapid fire code;
lui t1, $0034
sw zero, $7e8c(t1)
*/

lui v0, $8008
sb zero, $8900(v0)

With that, it loads the game perfectly. However, when I start playing the story mode, it freezes on loading the game save screen. Honestly, I don't understand what the code above is doing. If someone could explain why that works, but then freezes when accessing the memory card, that would be greatly appreciated.

misfire: I've never seen an op called al or b. So I can't understand what the 'process callbacks' is trying to do. But the links are helpful, so many thanks.

[Pyriel]

I'll take a look at the dumps later. I don't see "al" anywhere in his code. If you mean "la", that's just the "load address" macro. It'll expand to a lui and a ori or something. The "b" is just a shorthand macro for "beq zero, zero".

[dnawrkshp]

Well that explains that. Sorry, at night I usually seem to say things incorrectly and have a bunch of typos.

[dnawrkshp]

Pyriel, if you have taken a look at the dump, I would like to ask a question. When I store the hook (jal $80078000) at 0x800002FC, does the kernel rewrite the word stored at 0x800002FC to jalr k0? If it does, then the reason the hook doesn't work would be because I need to loop it. Which wouldn't be as hard to fix. Just a thought.

[dnawrkshp]

Okay, I have gotten it to work partially. I can play and game without any error and the pre-loaded codes work. However, for the game 'Ratchet: Deadlocked', I experience a problem when I attempt to enter the multiplayer menu. It freezes when it checks for game patches ("Checking for a saved game update. Please do not remove Memory Card (PS2)."). I have never had that problem with any other cheat device. I have removed the codes from the engine, but it still freezes. Here's what works,

main.c;

u32 EngineStore = 0x80078000;
u32 EngineRead = (void*)Engine;
for (i = 0; i < sizeof(Engine); i += 4)
{
      scr_printf("A");
      ee_kmode_enter();
      *(u32*)EngineStore = *(u32*)EngineRead;
      ee_kmode_exit();
      EngineStore += 4;
      EngineRead += 4;
}

ee_kmode_enter();
*(u32*)0x800002FC = 0x0C01E000;
ee_kmode_exit();

Engine;

address $00078000

_start:
addiu sp, sp, $FFF0
sq ra, $0000(sp)
jalr k0
nop
call _engine
lq ra, $0000(sp)
jr ra
addiu sp, sp, $0010

_engine:
addiu sp, sp, $FE00
sq at, $0000(sp)
sq v0, $0010(sp)
sq v1, $0020(sp)
sq a0, $0030(sp)
sq a1, $0040(sp)
sq a2, $0050(sp)
sq a3, $0060(sp)
sq t0, $0070(sp)
sq t1, $0080(sp)
sq t2, $0090(sp)
sq t3, $00a0(sp)
sq t4, $00b0(sp)
sq t5, $00c0(sp)
sq t6, $00d0(sp)
sq t7, $00e0(sp)
sq s0, $00f0(sp)
sq s1, $0100(sp)
sq s2, $0110(sp)
sq s3, $0120(sp)
sq s4, $0130(sp)
sq s5, $0140(sp)
sq s6, $0150(sp)
sq s7, $0160(sp)
sq t8, $0170(sp)
sq t9, $0180(sp)
sq k0, $0190(sp)
sq k1, $01a0(sp)
sq fp, $01b0(sp)
sq gp, $01c0(sp)
sq ra, $01d0(sp)

//Some random codes
lui t0, $0017
addiu t1, zero, $7FFF
sw t1, $1B40(t0)

lui t2, $0034
sw zero, $7e8c(t2)

lq at, $0000(sp)
lq v0, $0010(sp)
lq v1, $0020(sp)
lq a0, $0030(sp)
lq a1, $0040(sp)
lq a2, $0050(sp)
lq a3, $0060(sp)
lq t0, $0070(sp)
lq t1, $0080(sp)
lq t2, $0090(sp)
lq t3, $00a0(sp)
lq t4, $00b0(sp)
lq t5, $00c0(sp)
lq t6, $00d0(sp)
lq t7, $00e0(sp)
lq s0, $00f0(sp)
lq s1, $0100(sp)
lq s2, $0110(sp)
lq s3, $0120(sp)
lq s4, $0130(sp)
lq s5, $0140(sp)
lq s6, $0150(sp)
lq s7, $0160(sp)
lq t8, $0170(sp)
lq t9, $0180(sp)
lq k0, $0190(sp)
lq k1, $01a0(sp)
lq fp, $01b0(sp)
lq gp, $01c0(sp)
lq ra, $01d0(sp)
jr ra
addiu sp, sp, $0200

I am asking for help on why it freezes when it checks for the patch. Thank you.

[Pyriel]

Looks almost exactly like what you had before, minus the wonky JAL.

I think you're going to have to take general tips and troubleshoot on your own here. With the codes, it's likely that you're overwriting memory that isn't being used for the same purpose when you venture into the multi-player menu. Without the codes, you're just interrupting the kernel with a brief bit of nothing. Personally, I'm guessing you didn't fully remove all traces of the codes, but it could be any number of things. The multi-player menu, assuming it's an online feature, could be doing some timing checks to block cheating, or it could be using kernel space for something. It's rare, but some games do hit kernel space.

[dnawrkshp]

No the codes isn't the problem. The multiplayer is online, but there is also local play. Not really sure about it trying to block cheats. From what I have learned, they never made a patch update since the game came out in 2005. The only thing to stop commercial cheat devices was DNAS. But I will definitely try relocating the engine.

The reason it looks like it didn't change is because I did a lot of new things to it and finally got it to work (Which turned out to be practically the same). I didn't even look at the old one to see what had changed. What did actually change was the address, previously it was $80078000, now it is $00078000.

From further testing, the game freezes when I try to skip major cutscenes. The ones that are between levels and help advance the story. The game itself never lags though.

[dnawrkshp]

That works! Relocated the engine to $80080000 and it skips cutscenes and loads the multiplayer menu. Thanks a lot Pyriel!

[misfire]

FYI: 0 - 0x7ffff is kernel space and can only be accessed via kseg mapping, e.g. 0x80000000 - 0x8007ffff in kernel mode. 0x80000 and higher can be accessed in user mode without restrictions.