Announcement

Collapse
No announcement yet.

Old CCheat cdrom0 hack thread

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Old CCheat cdrom0 hack thread

    For those who aren't familiar, Cosmic Cheat is a homebrew cheat system (much like Codebreaker, Action Replay, GameShark, and XPloder, except that they're official) that uses raw hex codes. Some of the PS2 codes you have right now are probably raw, and in any case, thanks to the efforts of people like misfire and Pyriel, you can convert anything to raw hex anyway, heh.

    Cosmic Cheat was released in beta form as an ELF, to be run from host (a PC) via crossover cable or USB Male A to Male A PL Type cable and an app such as Naplink, PS2Link, and the like. It's since been implemented in DMS4 modchips with ToxicBIOS/ToxicOS firmware, and enjoyed decent popularity as a triumph for the homebrew community. To use CCheat, you will need to either have a modchip installed in your PS2, use a swap method, or utilize the Independence Exploit if you have an applicable model of PS2.

    This is a minor modification to the original Cosmic Cheat, replacing all references to host with cdrom0, and removing some (thus) extraneous data. Rather than using an app like Naplink to communicate the testdb.cff information, you can now simply burn a renamed cff (T.CFF) on the root dir of a cdrom, with CCHEAT.ELF and a proper SYSTEM.CNF (all of which I've included, for convenience).

    This was done by uncrunching the original ccheat.elf, disassembling to map what required modification, editing the values of those addresses, and crunching the result. In keeping with ISO9660, I capitalized all files and their respective references in the ELF and CNF files.

    To uncrunch, I used sjuncrunch (via the PS2-Packer/Unpacker GUI, for simplicity), to disassemble and map I used PS2Dis, to modify values I used Elf Modifier, and to crunch I used ps2-packer-0.41 (also via the PS2-Packer/Unpacker GUI), as it compresses more efficiently than sjcrunch. For partial testing, I used the PS2 emulator PCSX2.

    Thanks go out to:


    Sjeep, for making Cosmic Cheat in the first place
    Pixel, for PS2-Packer
    C0d3x, for the PS2-Packer/Unpacker GUI
    hanimar, for PS2Dis
    cYs Driver, for Elf Modifier
    Half the friggin’ scene, for PCSX2
    GSHI.org for 0wning hard
    misfire for answering some questions, and digging up a copy of elfmaker
    PS2Dev.org's forums, for hosting the thread that got me interested in Cosmic Cheat
    EurAsia.nu, for hosting a copy of the original Cosmic Cheat (as well as quite a few other good things)


    If you have any questions, feel free to ask.
    I may be lazy, but I can...zzzZZZzzzZZZzzzZZZ...

  • #2
    Hmm...there seems to be a problem with CD game initialization...I'll toy with this tomorrow. At least the issue of reading the appropriate files from cdrom0 is taken care of.
    I may be lazy, but I can...zzzZZZzzzZZZzzzZZZ...

    Comment


    • #3
      After a little toying (geh, I should have gone to sleep, but curiosity kept the cat awake), I'm beginning to wonder if sjeep employed a checksum of some kind in this instance. I'll post what I find tomorrow, after work. I have a fairly easy way of testing this, but it'll take another twenty minutes or so in total, and I need the sleep badly. Wish me luck.
      I may be lazy, but I can...zzzZZZzzzZZZzzzZZZ...

      Comment


      • #4
        Good luck man. I'm interested in seeing how this works. I'm also interested in uncrunching my hacked CB 9.2 ELF to employ Misfire's RSA sig check bypass. Would this Sjuncruch tool possibly be what I need to get started?

        Ahh, nevermind. I see the CB elf isn't crunched.
        Last edited by bfoos; 10-26-2006, 09:34:48 AM.
        Missing LiquidManZero since 1685.

        Comment


        • #5
          Either SJUncrunch or PS2-Unpacker will suffice for that in most situations. The copy I have lying around of the hacked CB 9.2 ELF is already unpacked, though. What's the filesize of your copy?
          I may be lazy, but I can...zzzZZZzzzZZZzzzZZZ...

          Comment


          • #6
            Size: 3.19 MB (3,354,008 bytes)

            Size on disk: 3.19 MB (3,354,624 bytes)


            MD5: ED4E695D2ABCE2F81A3AEA6A106330B6

            SHA1: 107EB9390DB6074F731FDD7DAEAF81D2717A952E

            CRC-32: 18365AD9

            I threw the file hashes in there for thoroughness.
            Missing LiquidManZero since 1685.

            Comment


            • #7
              Heh; ours match exactly. Also, I believe "size on disk" takes into account things like fragmentation, and thus wouldn't help in a public environment. Anyway, we already have another topic for this I'll continue work with the CCheat mod tonight, probably.
              I may be lazy, but I can...zzzZZZzzzZZZzzzZZZ...

              Comment


              • #8
                Cool deal man. I'll have to steal a blank CD from my cousin later to try it out.
                Missing LiquidManZero since 1685.

                Comment


                • #9
                  As of right now, the only thing it's doing properly is loading its CFF from cdrom0, and thus displaying the list of games and codes. This was quite simple, as no additional drivers were needed. Were I to mod it for use with a USB flash drive or external HDD, it would be a little more complex. In any case, I'll figure out what's up with initialization; it just might take me a day or two.
                  I may be lazy, but I can...zzzZZZzzzZZZzzzZZZ...

                  Comment


                  • #10
                    Hmm...I opened the original ccheat.elf in PS2Dis, saved as a bin, reassembled as an ELF with ElfMaker, and it had exactly the same issue (with no modifications). I wonder if ElfMaker's having a problem reassembling, or if ccheat was made in a way that makes this process a little more difficult. I'll figure it out.
                    I may be lazy, but I can...zzzZZZzzzZZZzzzZZZ...

                    Comment


                    • #11
                      This sounds interesting....I think one day this week I'm gonna jump in and see what I can learn about this with you. Might even be useful later on for what I'm working on -_^

                      Comment


                      • #12
                        If I get a moment, tonight's testing will include an unmodified repack, and a modified unpack.
                        I may be lazy, but I can...zzzZZZzzzZZZzzzZZZ...

                        Comment


                        • #13
                          Unmodified repack works fine, so modified unpack test isn't needed. The problem is obviously in either PS2Dis or ElfMaker, or my (mis)use of either of them I'll keep tinkering.
                          I may be lazy, but I can...zzzZZZzzzZZZzzzZZZ...

                          Comment


                          • #14
                            I used cYs Driver's (wonderful) tool Elf Modifier, v1.3, on an original, unpacked ccheat.elf, to modify...

                            0x000001b8 0x2E777777 .www
                            0x000001bc 0x6e327370 n2sp
                            0x000001c0 0x2e7a7765 .zwe
                            0x000001c4 0x2074656e ten
                            0x000001c8 0x4133302e A30.

                            ...and...

                            0x000000b0 0x74736f68 tsoh
                            0x000000b4 0x7365743a set:
                            0x000000b8 0x2e626474 .bdt
                            0x000000bc 0x00666663 ffc (00 = empty, 20 = space)

                            ...to...

                            0x000001b8 0x49485347 IHSG
                            0x000001bc 0x67726F2E gro.
                            0x000001c0 0x72646320 rdc
                            0x000001c4 0x20306D6F 0mo
                            0x000001c8 0x6B636168 kcah

                            ...and...

                            0x000000b0 0x6F726463 ordc
                            0x000000b4 0x5C3A306D \:0m
                            0x000000b8 0x46432E54 FC.T
                            0x000000bc 0x00313B46 1;F (00 = empty, 20 = space)

                            I'll test it out tonight. This will, at the very least, help me to narrow down what exactly is causing the init problem.
                            I may be lazy, but I can...zzzZZZzzzZZZzzzZZZ...

                            Comment


                            • #15
                              i could give this a look over. could you send me/upload the unpacked versions and/or the memory dump from ps2dis?

                              Comment

                              Working...
                              X