Announcement

Collapse
No announcement yet.

[PS2] Need help with PS2DIS

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • [PS2] Need help with PS2DIS

    Hello,

    (If you wish to skip straight to my PS2DIS situation, go ahead.)

    There are two series of games called Dynasty Warriors and Samurai Warriors that are made by Koei. These games are hack-and-slash games, and one or two years after releasing a game, Koei releases an expansion called Xtreme Legends, so the game would be called Dynasty Warriors 5 Xtreme Legends, for example. (This topic is about the PS2 games only.)

    If you play those expansion games by themselves, you'll only get the new features (like characters or modes) that were added on the new game, and if you want to play the original game with the new features, you'll have to use a feature called "Import" or "Load Original". If you do, the game will prompt you to open the disc tray, then put in the disc of the original (or non-expansion) game, then finally ask you to put back the disc of the expansion game. Then you'll be able to play the original game with the expansion features.

    The thing is, all that the "Import" or "Load Original" modes do is recognize the game ID (SLUS, etc.) of the original game, then allow you to play what was already on the expansion disc. So, in reality, the expansion games contain both the content from the original AND expansion games, but they'll only allow you to play it all if you do a disc recognition procedure first.

    Why all this info? If you're playing out of a PS2 that is in fine working conditions, then you're ok, just swap the discs and you can play it all. But for people that are playing with PCSX2, OpenPS2Loader or even a PS2 that is not in 100% working condition, then you're out of luck. PCSX2 doesn't have a open/close disc tray feature, and doesn't support in-game disc-swapping. OpenPS2Loader will freeze at "Please open the disc tray". And if you're one of the people with malfunctioning PS2 consoles like me (mine won't recognize DVD9 games and won't recognize the game's ID), then you won't be able to play the full game + expansion, even if you own both games.

    Many threads have been made over the years about disc swapping Dynasty and Samurai Warriors games on those conditions, but most of the answers say it can't be done. I thought I wouldn't be able to play those games like I once had played on my PS2, until I found out a thread about a Japanese hacker who had done it. He made an Action Replay code of the Japanese version of Dynasty Warriors 5 that allowed you to play the game without having to do the disc-swap procedure. And an user at PSX-Scene, lee4, converted the code to the US version, so I was able to use PS2DIS to find out what it does to the game's ELF (I guess that's what it is called), but I am extremely confused. You see, I started to use PS2DIS and even learned some MIPS just to do this.


    PS2DIS situation: In Dynasty Warriors 5 Xtreme Legends, if you play without this specific code, you'll play the game like it was just an expansion, and the code will make it so that you'll be able to access the content of both the expansion and the original game (for those who haven't read the paragraphs above, all the content is included in the expansion game disc, it just blocks it until you do a disc swapping procedure). The code provided by lee4 of PSX-Scene is 201ABED4 24020001 (yes just one line), so it modifies the address 001abed4 of the ELF file, and changes its data. Before the code, it looks like this on PS2DIS:

    001abed4 8f82868c lw v0, $868c (gp)

    and after you change to what the code says, it looks like this:

    001abed4 24020001 li v0, $00000001 (__00000001)

    (The address 00000001 is empty, if you guys need this info.)

    When you patch the game with the code on PS2 Patch Engine, it simply works like magic. The game simply doesn't block any content and you can play both the expansion and the original game with all features.

    What I want to do: I want to make similar codes for other Koei games, like Samurai Warriors and Samurai Warriors 2 and their respective expansions. A lot of people want to play these games, and will be sure to post my results.

    What I don't know: I have no idea whatsoever of what the code above changed. Does it have to do with the offset $868c? Does that offset represent an address? If so, how do I find that address? Any, and I mean ANY type of clue you guys can give me will be much appreciated, since I don't know what to look for and I don't know what I'm dealing with. If I can find out what the code changed, maybe I could replicate this to other Koei games since they all work the same way.

    Thanks in advance,

    Pedro.

    Obligatory legal part: Yes all of this assumes that the person that enters the code owns the original games.

  • #2
    lee4 is also a member here, maybe he can help with it.

    Comment


    • #3
      Originally posted by 47iscool View Post
      lee4 is also a member here, maybe he can help with it.
      the original hacker would know

      I just port the code
      lee4 Does Not Accept Codes Requests !
      When lee4 asks a question it does not mean lee4 will look at your game
      *How to create and use SegaCD codes >click here<*
      >)

      Comment


      • #4
        Are there any good debuggers for the PS2? you would need to start a trace right before the prompt for the disc swap and during it to see what check in mips are performed. That code above looks like it originally took the value from the offset plus whatever was at the gp register to get the value and the new code simply loads the value of 0001 to register v0 so it should tell you that perhaps the value of 0000 is not the correct game and 0001 is the correct game to load the features.
        Spoiler Alert! Click to view...

        THE BAD GUY!!!!!!

        Comment


        • #5
          Originally posted by Helder View Post
          Are there any good debuggers for the PS2? you would need to start a trace right before the prompt for the disc swap and during it to see what check in mips are performed. That code above looks like it originally took the value from the offset plus whatever was at the gp register to get the value and the new code simply loads the value of 0001 to register v0 so it should tell you that perhaps the value of 0000 is not the correct game and 0001 is the correct game to load the features.
          Cheat Engine works perfect with it (pcsx2), it's how I make all my codes. Once you get a break look at the ESI value, it's what's writing to the address. Then take the ESI value and add a 2 to it then reload the save state or reboot the game for it to take effect. (Of course you have to freeze the address before reloading/restarting)
          Last edited by 47iscool; 04-29-2014, 01:50:54 PM.

          Comment


          • #6
            Give me some memory dumps of the games you want and i'll make them for you.

            Comment


            • #7
              Originally posted by Cronotrigga View Post
              Give me some memory dumps of the games you want and i'll make them for you.
              I am looking to make a cheat for the game Everquest Online Adventures: Frontiers that can skip the DNAS authentication that is sent to Sony's server. They still validate the discs but I'd like to be able to just eliminate that check as I don't anticipate the server being up for much longer. We are looking to emulate a server for the game, you can find info about the project here:

              http://wiki.eqoarevival.com/index.php/Main_Page

              here is the slus file for the game

              https://drive.google.com/open?id=0B_...3dMejVKRlNBUFU

              Comment


              • #8
                Originally posted by JonyeGway View Post
                I am looking to make a cheat for the game Everquest Online Adventures: Frontiers that can skip the DNAS authentication that is sent to Sony's server. They still validate the discs but I'd like to be able to just eliminate that check as I don't anticipate the server being up for much longer. We are looking to emulate a server for the game, you can find info about the project here:

                http://wiki.eqoarevival.com/index.php/Main_Page

                here is the slus file for the game

                https://drive.google.com/open?id=0B_...3dMejVKRlNBUFU
                Codes for games that are still online are not allowed on these forums. I can however point you in the right direction. 00101b30 start function cutting.

                Comment


                • #9
                  Originally posted by Cronotrigga View Post
                  Codes for games that are still online are not allowed on these forums. I can however point you in the right direction. 00101b30 start function cutting.
                  The game servers were taken down in March 2012, the disc authentication that took place before the game server is the only part they didn't end service for (yet). I just want to be able to get through the DNAS so I can continue to work on our test server after the DNAS service has ended.
                  Last edited by JonyeGway; 11-16-2015, 12:09:03 PM.

                  Comment


                  • #10
                    So the following works to bypass the dnas for this game:

                    patch=1,EE,001823f0,word,24050005
                    patch=1,EE,001823f4,word,ac850000
                    patch=1,EE,001823f8,word,3c054000
                    patch=1,EE,001823fc,word,24a50004
                    patch=1,EE,00182400,word,ac850004
                    patch=1,EE,00182404,word,24050003
                    patch=1,EE,00182408,word,ac850008
                    patch=1,EE,0018240c,word,03e00008
                    patch=1,EE,00182410,word,3c020000

                    the only problem is that this code needs to be disabled right after passing the dnas check and patching server, this game loads different memory over the 0018xxxx region right after passing the account login. on pcsx2 it is easy enough to pause the game, disable cheats, and resume the emulator. However, on a real ps2 there is no way to disable codes in game like this. Would it be possible to create a joker code to enable and disable this cheat as needed on a real ps2?

                    Comment


                    • #11
                      Originally posted by JonyeGway View Post
                      So the following works to bypass the dnas for this game:

                      patch=1,EE,001823f0,word,24050005
                      patch=1,EE,001823f4,word,ac850000
                      patch=1,EE,001823f8,word,3c054000
                      patch=1,EE,001823fc,word,24a50004
                      patch=1,EE,00182400,word,ac850004
                      patch=1,EE,00182404,word,24050003
                      patch=1,EE,00182408,word,ac850008
                      patch=1,EE,0018240c,word,03e00008
                      patch=1,EE,00182410,word,3c020000

                      the only problem is that this code needs to be disabled right after passing the dnas check and patching server, this game loads different memory over the 0018xxxx region right after passing the account login. on pcsx2 it is easy enough to pause the game, disable cheats, and resume the emulator. However, on a real ps2 there is no way to disable codes in game like this. Would it be possible to create a joker code to enable and disable this cheat as needed on a real ps2?
                      First off, use PCSX2dis instead of the regular PCSX2. It allows the input of RAW codes instead of using that awful patching system.
                      Link: http://forums.pcsx2.net/Thread-PCSX2...I-P-13-02-2015

                      You can joker it by having the entire code disabled. If you do that it will overwrite the code when more memory is loaded without error.

                      Comment


                      • #12
                        The problem is that these memory addresses are nop til you boot the game and they get overwritten right on booting and again after account login. This game has 5 .enc files on the memory card it must load as executables. I've tried burning the cheats to the iso as well and it doesn't work.

                        Comment


                        • #13
                          Originally posted by JonyeGway View Post
                          The problem is that these memory addresses are nop til you boot the game and they get overwritten right on booting and again after account login. This game has 5 .enc files on the memory card it must load as executables. I've tried burning the cheats to the iso as well and it doesn't work.
                          It won't matter if you joker it. All you need to do is hit the joker button(s) to enable the codes you want. They will be over written whenever something writes to that memory location again. Doing this will bypass any freezing that may occur if the codes were set to constant write.

                          Comment


                          • #14
                            Well that is good news. How would I go about writing the above code into a joker? Ive got the codes converted to RAW but Im not sure what to do with the Gameshark tools in PCSX2dis.

                            Comment


                            • #15
                              Originally posted by JonyeGway View Post
                              Well that is good news. How would I go about writing the above code into a joker? Ive got the codes converted to RAW but Im not sure what to do with the Gameshark tools in PCSX2dis.
                              You will need the joker address(x) and the joker buttons(a). I have the first line of your code below in the joker format. Each line of your code will need a joker line.

                              Dxxxxxxx 0000aaaa - Joker line
                              201823f0 24050005 - Your code

                              Comment

                              Working...
                              X