Announcement

Collapse
No announcement yet.

[PS2] Need some advice for finding a Debug Menu in Persona 4 (PAL)

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • [PS2] Need some advice for finding a Debug Menu in Persona 4 (PAL)

    Sup guys,

    first off, I already have the code for enabling the debug menu. The thing I'm interested in, is the way to actually find and enable it and learn from it.

    Code for enabling the Debug Menu (if someone wants to lend me a hand):
    Code:
    0079E8CC 000000FF
    A little stuff about the game and the code for the guys who have never played this game. When you hit SQUARE, a little menu pops up with different options. INSIDE this menu are debug options, just not visible. If you use Cheat Engine or PCSX2dis like I do and change the position of the cursor, you can access these options.
    What the code does is, it makes the debug options visible and accessible, to put it in a simple way.

    I thought it might be an easy task, since I already have the solution, but I couldn't be more wrong, haha.

    After some thought, the option that made most sense to me, was to but a break-on-read on a text string you can see in that little pop-up menu. In my case the text string is called "Daidara" and the first availabe option.
    So, when I open the menu, I get two breaks.
    The first at 00274F94:

    Whole function pasted for reference:

    Spoiler Alert! Click to view...
    Code:
    FNC_00274dd0:					# 
    	addiu		sp, sp, $ffa0		# 00274dd0:27bdffa0	
    	sd		ra, $0050(sp)		# 00274dd4:ffbf0050	
    	sq		s4, $0040(sp)		# 00274dd8:7fb40040	
    	sq		s3, $0030(sp)		# 00274ddc:7fb30030	
    	sq		s2, $0020(sp)		# 00274de0:7fb20020	
    	sq		s1, $0010(sp)		# 00274de4:7fb10010	
    	sq		s0, $0000(sp)		# 00274de8:7fb00000	
    	daddu		s4, a1, zero		# 00274dec:00a0a02d	
    	daddu		s3, a0, zero		# 00274df0:0080982d	
    	lw		a1, $0010(a0)		# 00274df4:8c850010	
    	lbu		v0, $0000(a1)		# 00274df8:90a20000	
    	andi		v1, v0, $00f0		# 00274dfc:304300f0	
    	addiu		v0, zero, $00f0		# 00274e00:240200f0	v0=$000000f0
    	beq		v1, v0, $00274e28	# 00274e04:10620008	v __00274e28
    	nop					# 00274e08:00000000	
    	lbu		v1, $0001(a1)		# 00274e0c:90a30001	
    	addiu		v0, zero, $0005		# 00274e10:24020005	v0=$00000005
    	bne		v1, v0, $00274e28	# 00274e14:14620004	v __00274e28
    	nop					# 00274e18:00000000	
    	lw		v0, $0018(a0)		# 00274e1c:8c820018	
    	addiu		v0, v0, $0004		# 00274e20:24420004	
    	sw		v0, $0018(a0)		# 00274e24:ac820018	
    __00274e28:					# 
    	sw		zero, $a798(gp)		# 00274e28:af80a798	[1bd9a798]
    	beq		zero, zero, $00274f80	# 00274e2c:10000054	v __00274f80
    	nop					# 00274e30:00000000	
    __00274e34:					# 
    	andi		a0, v1, $00f0		# 00274e34:306400f0	
    	addiu		v0, zero, $00f0		# 00274e38:240200f0	v0=$000000f0
    	bne		a0, v0, $00274f5c	# 00274e3c:14820047	v __00274f5c
    	nop					# 00274e40:00000000	
    	daddu		v0, zero, zero		# 00274e44:0000102d	
    	lw		a1, $0018(s3)		# 00274e48:8e650018	
    	addiu		a0, a1, $0001		# 00274e4c:24a40001	
    	sw		a0, $0018(s3)		# 00274e50:ae640018	
    	lw		a0, $0010(s3)		# 00274e54:8e640010	
    	addu		a0, a0, a1		# 00274e58:00852021	
    	lbu		a0, $0000(a0)		# 00274e5c:90840000	
    	sll		v1, v1, 8		# 00274e60:00031a00	
    	or		s2, v1, a0		# 00274e64:00649025	
    	beq		s4, zero, $00274e78	# 00274e68:12800003	v __00274e78
    	nop					# 00274e6c:00000000	
    	bne		s2, s4, $00274ef8	# 00274e70:16540021	v __00274ef8
    	nop					# 00274e74:00000000	
    __00274e78:					# 
    	andi		v0, s2, $00e0		# 00274e78:324200e0	
    	sra		v0, v0, 5		# 00274e7c:00021143	
    	sll		v1, v0, 3		# 00274e80:000218c0	
    	lui		v0, $0064		# 00274e84:3c020064	v0=$00640000
    	addiu		v0, v0, $ee70		# 00274e88:2442ee70	v0=$0063ee70
    	addu		s1, v0, v1		# 00274e8c:00438821	s1=$0063ee70
    	andi		s0, s2, $001f		# 00274e90:3250001f	
    	lw		v0, $0004(s1)		# 00274e94:8e220004	v0=$0063ee74
    	slt		at, v0, s0		# 00274e98:0050082a	
    	beq		at, zero, $00274eb8	# 00274e9c:10200006	v __00274eb8
    	nop					# 00274ea0:00000000	
    	lui		a0, $0075		# 00274ea4:3c040075	a0=$00750000
    	addiu		a0, a0, $b5b0		# 00274ea8:2484b5b0	a0="frTagTable.h"
    	addiu		a1, zero, $00a5		# 00274eac:240500a5	a1=$000000a5
    	jal		$00470990		# 00274eb0:0c11c264	v FNC_00470990
    	nop					# 00274eb4:00000000	
    __00274eb8:					# 
    	andi		v0, s2, $00ff		# 00274eb8:324200ff	
    	bgtz		v0, $00274ed8		# 00274ebc:1c400006	v __00274ed8
    	nop					# 00274ec0:00000000	
    	lui		a0, $0075		# 00274ec4:3c040075	a0=$00750000
    	addiu		a0, a0, $b5a0		# 00274ec8:2484b5a0	a0="frTagTable.h"
    	addiu		a1, zero, $00a6		# 00274ecc:240500a6	a1=$000000a6
    	jal		$00470990		# 00274ed0:0c11c264	v FNC_00470990
    	nop					# 00274ed4:00000000	
    __00274ed8:					# 
    	daddu		a0, s2, zero		# 00274ed8:0240202d	
    	daddu		a1, s3, zero		# 00274edc:0260282d	
    	sll		v1, s0, 2		# 00274ee0:00101880	
    	lw		v0, $0000(s1)		# 00274ee4:8e220000	v0=$0063ee70
    	addu		v0, v0, v1		# 00274ee8:00431021	
    	lw		v0, $0000(v0)		# 00274eec:8c420000	
    	jalr		v0			# 00274ef0:0040f809	
    	nop					# 00274ef4:00000000	
    __00274ef8:					# 
    	andi		v1, s2, $0f00		# 00274ef8:32430f00	
    	sra		v1, v1, 8		# 00274efc:00031a03	
    	addiu		v1, v1, $ffff		# 00274f00:2463ffff	
    	sll		a0, v1, 1		# 00274f04:00032040	
    	lw		v1, $0018(s3)		# 00274f08:8e630018	
    	addu		v1, v1, a0		# 00274f0c:00641821	
    	sw		v1, $0018(s3)		# 00274f10:ae630018	
    	beq		v0, zero, $00274f28	# 00274f14:10400004	v __00274f28
    	nop					# 00274f18:00000000	
    	addiu		v0, zero, $0001		# 00274f1c:24020001	v0=$00000001
    	beq		zero, zero, $00274f4c	# 00274f20:1000000a	v __00274f4c
    	nop					# 00274f24:00000000	
    __00274f28:					# 
    	ori		v0, zero, $f124		# 00274f28:3402f124	v0=$0000f124
    	beq		s2, v0, $00274f3c	# 00274f2c:12420003	v __00274f3c
    	nop					# 00274f30:00000000	
    	beq		zero, zero, $00274f48	# 00274f34:10000004	v __00274f48
    	nop					# 00274f38:00000000	
    __00274f3c:					# 
    	addiu		v0, zero, $0001		# 00274f3c:24020001	v0=$00000001
    	beq		zero, zero, $00274f4c	# 00274f40:10000002	v __00274f4c
    	nop					# 00274f44:00000000	
    __00274f48:					# 
    	daddu		v0, zero, zero		# 00274f48:0000102d	
    __00274f4c:					# 
    	beq		v0, zero, $00274f80	# 00274f4c:1040000c	v __00274f80
    	nop					# 00274f50:00000000	
    	beq		zero, zero, $00274fa0	# 00274f54:10000012	v __00274fa0
    	nop					# 00274f58:00000000	
    __00274f5c:					# 
    	addiu		v0, zero, $000a		# 00274f5c:2402000a	v0=$0000000a
    	beq		v1, v0, $00274f80	# 00274f60:10620007	v __00274f80
    	nop					# 00274f64:00000000	
    	slti		v0, v1, $0080		# 00274f68:28620080	
    	bne		v0, zero, $00274f80	# 00274f6c:14400004	v __00274f80
    	nop					# 00274f70:00000000	
    	lw		v0, $0018(s3)		# 00274f74:8e620018	
    	addiu		v0, v0, $0001		# 00274f78:24420001	
    	sw		v0, $0018(s3)		# 00274f7c:ae620018	
    __00274f80:					# 
    	lw		v1, $0018(s3)		# 00274f80:8e630018	
    	addiu		v0, v1, $0001		# 00274f84:24620001	
    	sw		v0, $0018(s3)		# 00274f88:ae620018	
    	lw		v0, $0010(s3)		# 00274f8c:8e620010	
    	addu		v0, v0, v1		# 00274f90:00431021	
    	[COLOR="#FF0000"][B]lbu		v1, $0000(v0)		# 00274f94:90430000[/B][/COLOR]	
    	bne		v1, zero, $00274e34	# 00274f98:1460ffa6	^ __00274e34
    	nop					# 00274f9c:00000000	
    __00274fa0:					# 
    	daddu		v0, zero, zero		# 00274fa0:0000102d	
    	ld		ra, $0050(sp)		# 00274fa4:dfbf0050	
    	lq		s4, $0040(sp)		# 00274fa8:7bb40040	
    	lq		s3, $0030(sp)		# 00274fac:7bb30030	
    	lq		s2, $0020(sp)		# 00274fb0:7bb20020	
    	lq		s1, $0010(sp)		# 00274fb4:7bb10010	
    	lq		s0, $0000(sp)		# 00274fb8:7bb00000	
    	addiu		sp, sp, $0060		# 00274fbc:27bd0060	
    	jr		ra			# 00274fc0:03e00008	
    	nop					# 00274fc4:00000000


    The second at 00274C10:

    Also whole function for reference:

    Spoiler Alert! Click to view...
    Code:
    FNC_002747a0:					# 
    	addiu		sp, sp, $ffa0		# 002747a0:27bdffa0	
    	sd		ra, $0040(sp)		# 002747a4:ffbf0040	
    	sq		s3, $0030(sp)		# 002747a8:7fb30030	
    	sq		s2, $0020(sp)		# 002747ac:7fb20020	
    	sq		s1, $0010(sp)		# 002747b0:7fb10010	
    	sq		s0, $0000(sp)		# 002747b4:7fb00000	
    	daddu		s3, a0, zero		# 002747b8:0080982d	
    	lw		a0, $0010(a0)		# 002747bc:8c840010	
    	lbu		v0, $0000(a0)		# 002747c0:90820000	
    	andi		v1, v0, $00f0		# 002747c4:304300f0	
    	addiu		v0, zero, $00f0		# 002747c8:240200f0	v0=$000000f0
    	beq		v1, v0, $002747f0	# 002747cc:10620008	v __002747f0
    	nop					# 002747d0:00000000	
    	lbu		v1, $0001(a0)		# 002747d4:90830001	
    	addiu		v0, zero, $0005		# 002747d8:24020005	v0=$00000005
    	bne		v1, v0, $002747f0	# 002747dc:14620004	v __002747f0
    	nop					# 002747e0:00000000	
    	lw		v0, $0018(s3)		# 002747e4:8e620018	
    	addiu		v0, v0, $0004		# 002747e8:24420004	
    	sw		v0, $0018(s3)		# 002747ec:ae620018	
    __002747f0:					# 
    	jal		$00274d30		# 002747f0:0c09d34c	v FNC_00274d30
    	nop					# 002747f4:00000000	
    	lh		v0, $a7b0(gp)		# 002747f8:8782a7b0	v0=$1bd9a7b0
    	ori		v0, v0, $0001		# 002747fc:34420001	
    	dsll32		v1, v0, 16		# 00274800:00021c3c	
    	dsra32		v1, v1, 16		# 00274804:00031c3f	
    	addiu		v0, zero, $fffd		# 00274808:2402fffd	v0=$fffffffd
    	and		v0, v1, v0		# 0027480c:00621024	
    	sh		v0, $a7b0(gp)		# 00274810:a782a7b0	[1bd9a7b0]
    	beq		zero, zero, $00274bfc	# 00274814:100000f9	v __00274bfc
    	nop					# 00274818:00000000	
    __0027481c:					# 
    	andi		v1, s0, $00f0		# 0027481c:320300f0	
    	addiu		v0, zero, $00f0		# 00274820:240200f0	v0=$000000f0
    	bne		v1, v0, $00274924	# 00274824:1462003f	v __00274924
    	nop					# 00274828:00000000	
    	lw		v1, $0018(s3)		# 0027482c:8e630018	
    	addiu		v0, v1, $0001		# 00274830:24620001	
    	sw		v0, $0018(s3)		# 00274834:ae620018	
    	lw		v0, $0010(s3)		# 00274838:8e620010	
    	addu		v0, v0, v1		# 0027483c:00431021	
    	lbu		v1, $0000(v0)		# 00274840:90430000	
    	sll		v0, s0, 8		# 00274844:00101200	
    	or		s2, v0, v1		# 00274848:00439025	
    	andi		v0, s2, $00e0		# 0027484c:324200e0	
    	sra		v0, v0, 5		# 00274850:00021143	
    	sll		v1, v0, 3		# 00274854:000218c0	
    	lui		v0, $0064		# 00274858:3c020064	v0=$00640000
    	addiu		v0, v0, $ee70		# 0027485c:2442ee70	v0=$0063ee70
    	addu		s1, v0, v1		# 00274860:00438821	
    	andi		s0, s2, $001f		# 00274864:3250001f	
    	lw		v0, $0004(s1)		# 00274868:8e220004	
    	slt		at, v0, s0		# 0027486c:0050082a	
    	beq		at, zero, $0027488c	# 00274870:10200006	v __0027488c
    	nop					# 00274874:00000000	
    	lui		a0, $0075		# 00274878:3c040075	a0=$00750000
    	addiu		a0, a0, $b5b0		# 0027487c:2484b5b0	a0="frTagTable.h"
    	addiu		a1, zero, $00a5		# 00274880:240500a5	a1=$000000a5
    	jal		$00470990		# 00274884:0c11c264	v FNC_00470990
    	nop					# 00274888:00000000	
    __0027488c:					# 
    	andi		v0, s2, $00ff		# 0027488c:324200ff	
    	bgtz		v0, $002748ac		# 00274890:1c400006	v __002748ac
    	nop					# 00274894:00000000	
    	lui		a0, $0075		# 00274898:3c040075	a0=$00750000
    	addiu		a0, a0, $b5a0		# 0027489c:2484b5a0	a0="frTagTable.h"
    	addiu		a1, zero, $00a6		# 002748a0:240500a6	a1=$000000a6
    	jal		$00470990		# 002748a4:0c11c264	v FNC_00470990
    	nop					# 002748a8:00000000	
    __002748ac:					# 
    	daddu		a0, s2, zero		# 002748ac:0240202d	
    	daddu		a1, s3, zero		# 002748b0:0260282d	
    	sll		v1, s0, 2		# 002748b4:00101880	
    	lw		v0, $0000(s1)		# 002748b8:8e220000	
    	addu		v0, v0, v1		# 002748bc:00431021	
    	lw		v0, $0000(v0)		# 002748c0:8c420000	
    	jalr		v0			# 002748c4:0040f809	
    	nop					# 002748c8:00000000	
    	andi		v1, s2, $0f00		# 002748cc:32430f00	
    	sra		v1, v1, 8		# 002748d0:00031a03	
    	addiu		v1, v1, $ffff		# 002748d4:2463ffff	
    	sll		a0, v1, 1		# 002748d8:00032040	
    	lw		v1, $0018(s3)		# 002748dc:8e630018	
    	addu		v1, v1, a0		# 002748e0:00641821	
    	sw		v1, $0018(s3)		# 002748e4:ae630018	
    	beq		v0, zero, $002748fc	# 002748e8:10400004	v __002748fc
    	nop					# 002748ec:00000000	
    	addiu		v0, zero, $0001		# 002748f0:24020001	v0=$00000001
    	beq		zero, zero, $00274914	# 002748f4:10000007	v __00274914
    	nop					# 002748f8:00000000	
    __002748fc:					# 
    	lb		v0, $001c(s3)		# 002748fc:8262001c	
    	bne		v0, zero, $00274910	# 00274900:14400003	v __00274910
    	nop					# 00274904:00000000	
    	addiu		v0, zero, $0001		# 00274908:24020001	v0=$00000001
    	sb		v0, $001c(s3)		# 0027490c:a262001c	
    __00274910:					# 
    	daddu		v0, zero, zero		# 00274910:0000102d	
    __00274914:					# 
    	beq		v0, zero, $00274bfc	# 00274914:104000b9	v __00274bfc
    	nop					# 00274918:00000000	
    	beq		zero, zero, $00274c1c	# 0027491c:100000bf	v __00274c1c
    	nop					# 00274920:00000000	
    __00274924:					# 
    	addiu		v0, zero, $000a		# 00274924:2402000a	v0=$0000000a
    	bne		s0, v0, $00274968	# 00274928:1602000f	v __00274968
    	nop					# 0027492c:00000000	
    	lh		v0, $a7b0(gp)		# 00274930:8782a7b0	v0=$1bd9a7b0
    	andi		v0, v0, $0004		# 00274934:30420004	
    	beq		v0, zero, $00274bfc	# 00274938:104000b0	v __00274bfc
    	nop					# 0027493c:00000000	
    	lw		v0, $a7a0(gp)		# 00274940:8f82a7a0	v0=$1bd9a7a0
    	sll		v1, v0, 3		# 00274944:000218c0	
    	lw		v0, $0004(s3)		# 00274948:8e620004	
    	addu		v0, v0, v1		# 0027494c:00431021	
    	sw		v0, $0004(s3)		# 00274950:ae620004	
    	addiu		v0, zero, $0001		# 00274954:24020001	v0=$00000001
    	sb		v0, $001c(s3)		# 00274958:a262001c	
    	sb		v0, $001d(s3)		# 0027495c:a262001d	
    	beq		zero, zero, $00274bfc	# 00274960:100000a6	v __00274bfc
    	nop					# 00274964:00000000	
    __00274968:					# 
    	lw		v0, $0014(s3)		# 00274968:8e620014	
    	beq		v0, zero, $00274984	# 0027496c:10400005	v __00274984
    	nop					# 00274970:00000000	
    	lw		v0, $001c(v0)		# 00274974:8c42001c	
    	bne		v0, zero, $00274984	# 00274978:14400002	v __00274984
    	nop					# 0027497c:00000000	
    	sb		zero, $001c(s3)		# 00274980:a260001c	
    __00274984:					# 
    	lb		v0, $001c(s3)		# 00274984:8262001c	
    	beq		v0, zero, $00274a18	# 00274988:10400023	v __00274a18
    	nop					# 0027498c:00000000	
    	lw		s1, $0014(s3)		# 00274990:8e710014	
    	lb		a2, $000d(s3)		# 00274994:8266000d	
    	lb		a3, $000e(s3)		# 00274998:8267000e	
    	addiu		a0, gp, $a7d8		# 0027499c:2784a7d8	a0=$1bd9a7d8
    	daddu		a1, zero, zero		# 002749a0:0000282d	
    	daddu		t0, zero, zero		# 002749a4:0000402d	
    	jal		$00272bc0		# 002749a8:0c09caf0	^ FNC_00272bc0
    	nop					# 002749ac:00000000	
    	bne		v0, zero, $002749c0	# 002749b0:14400003	v __002749c0
    	nop					# 002749b4:00000000	
    	beq		zero, zero, $002749d8	# 002749b8:10000007	v __002749d8
    	nop					# 002749bc:00000000	
    __002749c0:					# 
    	daddu		a0, s1, zero		# 002749c0:0220202d	
    	daddu		a1, v0, zero		# 002749c4:0040282d	
    	addiu		a2, zero, $0001		# 002749c8:24060001	a2=$00000001
    	jal		$00273d40		# 002749cc:0c09cf50	^ FNC_00273d40
    	nop					# 002749d0:00000000	
    	daddu		s1, v0, zero		# 002749d4:0040882d	
    __002749d8:					# 
    	sw		s1, $0014(s3)		# 002749d8:ae710014	
    	daddu		a0, s1, zero		# 002749dc:0220202d	
    	lbu		a1, $000f(s3)		# 002749e0:9265000f	
    	jal		$00272e20		# 002749e4:0c09cb88	^ FNC_00272e20
    	nop					# 002749e8:00000000	
    	lh		s2, $001e(s3)		# 002749ec:8672001e	
    	lw		s1, $0014(s3)		# 002749f0:8e710014	
    	bne		s1, zero, $00274a10	# 002749f4:16200006	v __00274a10
    	nop					# 002749f8:00000000	
    	lui		a0, $0064		# 002749fc:3c040064	a0=$00640000
    	addiu		a0, a0, $ef58		# 00274a00:2484ef58	a0="frFont.c"
    	addiu		a1, zero, $06a7		# 00274a04:240506a7	a1=$000006a7
    	jal		$00470990		# 00274a08:0c11c264	v FNC_00470990
    	nop					# 00274a0c:00000000	
    __00274a10:					# 
    	sh		s2, $0000(s1)		# 00274a10:a6320000	
    	sb		zero, $001c(s3)		# 00274a14:a260001c	
    __00274a18:					# 
    	lb		v0, $001d(s3)		# 00274a18:8262001d	
    	beq		v0, zero, $00274a40	# 00274a1c:10400008	v __00274a40
    	nop					# 00274a20:00000000	
    	lw		v1, $0000(s3)		# 00274a24:8e630000	
    	lw		v0, $0014(s3)		# 00274a28:8e620014	
    	sw		v1, $0004(v0)		# 00274a2c:ac430004	
    	lw		v1, $0004(s3)		# 00274a30:8e630004	
    	lw		v0, $0014(s3)		# 00274a34:8e620014	
    	sw		v1, $0008(v0)		# 00274a38:ac430008	
    	sb		zero, $001d(s3)		# 00274a3c:a260001d	
    __00274a40:					# 
    	slti		at, s0, $0080		# 00274a40:2a010080	
    	beq		at, zero, $00274aa4	# 00274a44:10200017	v __00274aa4
    	nop					# 00274a48:00000000	
    	addiu		v0, zero, $0020		# 00274a4c:24020020	v0=$00000020
    	bne		s0, v0, $00274a74	# 00274a50:16020008	v __00274a74
    	nop					# 00274a54:00000000	
    	addiu		v0, zero, $ff83		# 00274a58:2402ff83	v0=$ffffff83
    	sb		v0, $005c(sp)		# 00274a5c:a3a2005c	
    	addiu		v0, zero, $fff6		# 00274a60:2402fff6	v0=$fffffff6
    	sb		v0, $005d(sp)		# 00274a64:a3a2005d	
    	sb		zero, $005e(sp)		# 00274a68:a3a0005e	
    	beq		zero, zero, $00274a7c	# 00274a6c:10000003	v __00274a7c
    	nop					# 00274a70:00000000	
    __00274a74:					# 
    	sb		s0, $005c(sp)		# 00274a74:a3b0005c	
    	sb		zero, $005d(sp)		# 00274a78:a3a0005d	
    __00274a7c:					# 
    	lb		a1, $000c(s3)		# 00274a7c:8265000c	
    	lb		a2, $000d(s3)		# 00274a80:8266000d	
    	lb		a3, $000e(s3)		# 00274a84:8267000e	
    	addiu		a0, sp, $005c		# 00274a88:27a4005c	
    	lw		t0, $0014(s3)		# 00274a8c:8e680014	
    	jal		$00272bc0		# 00274a90:0c09caf0	^ FNC_00272bc0
    	nop					# 00274a94:00000000	
    	sw		v0, $0014(s3)		# 00274a98:ae620014	
    	beq		zero, zero, $00274b48	# 00274a9c:1000002a	v __00274b48
    	nop					# 00274aa0:00000000	
    __00274aa4:					# 
    	lw		v1, $0018(s3)		# 00274aa4:8e630018	
    	addiu		v0, v1, $0001		# 00274aa8:24620001	
    	sw		v0, $0018(s3)		# 00274aac:ae620018	
    	lw		v0, $0010(s3)		# 00274ab0:8e620010	
    	addu		v0, v0, v1		# 00274ab4:00431021	
    	lbu		v1, $0000(v0)		# 00274ab8:90430000	
    	sll		v0, s0, 8		# 00274abc:00101200	
    	or		v1, v0, v1		# 00274ac0:00431825	
    	ori		at, zero, $c080		# 00274ac4:3401c080	at=$0000c080
    	slt		at, v1, at		# 00274ac8:0061082a	
    	beq		at, zero, $00274b10	# 00274acc:10200010	v __00274b10
    	nop					# 00274ad0:00000000	
    	andi		v0, v1, $ff00		# 00274ad4:3062ff00	
    	sra		v0, v0, 8		# 00274ad8:00021203	
    	sb		v0, $005c(sp)		# 00274adc:a3a2005c	
    	sb		v1, $005d(sp)		# 00274ae0:a3a3005d	
    	sb		zero, $005e(sp)		# 00274ae4:a3a0005e	
    	lb		a1, $000c(s3)		# 00274ae8:8265000c	
    	lb		a2, $000d(s3)		# 00274aec:8266000d	
    	lb		a3, $000e(s3)		# 00274af0:8267000e	
    	addiu		a0, sp, $005c		# 00274af4:27a4005c	
    	lw		t0, $0014(s3)		# 00274af8:8e680014	
    	jal		$00272bc0		# 00274afc:0c09caf0	^ FNC_00272bc0
    	nop					# 00274b00:00000000	
    	sw		v0, $0014(s3)		# 00274b04:ae620014	
    	beq		zero, zero, $00274b48	# 00274b08:1000000f	v __00274b48
    	nop					# 00274b0c:00000000	
    __00274b10:					# 
    	addiu		v1, v1, $c000		# 00274b10:2463c000	
    	andi		v0, v1, $ff00		# 00274b14:3062ff00	
    	sra		v0, v0, 8		# 00274b18:00021203	
    	sb		v0, $005c(sp)		# 00274b1c:a3a2005c	
    	sb		v1, $005d(sp)		# 00274b20:a3a3005d	
    	sb		zero, $005e(sp)		# 00274b24:a3a0005e	
    	lb		a2, $000d(s3)		# 00274b28:8266000d	
    	lb		a3, $000e(s3)		# 00274b2c:8267000e	
    	addiu		a0, sp, $005c		# 00274b30:27a4005c	
    	addiu		a1, zero, $0008		# 00274b34:24050008	a1=$00000008
    	lw		t0, $0014(s3)		# 00274b38:8e680014	
    	jal		$00272bc0		# 00274b3c:0c09caf0	^ FNC_00272bc0
    	nop					# 00274b40:00000000	
    	sw		v0, $0014(s3)		# 00274b44:ae620014	
    __00274b48:					# 
    	lbu		v1, $000c(s3)		# 00274b48:9263000c	
    	addiu		v0, gp, $a7a8		# 00274b4c:2782a7a8	v0=$1bd9a7a8
    	addu		v0, v0, v1		# 00274b50:00431021	
    	lb		v0, $0000(v0)		# 00274b54:80420000	
    	subu		v0, zero, v0		# 00274b58:00021023	
    	sll		v1, v0, 1		# 00274b5c:00021840	
    	sra		v0, v1, 5		# 00274b60:00031143	
    	bgez		v1, $00274b74		# 00274b64:04610003	v __00274b74
    	nop					# 00274b68:00000000	
    	addiu		v0, v1, $001f		# 00274b6c:2462001f	
    	sra		v0, v0, 5		# 00274b70:00021143	
    __00274b74:					# 
    	dsll32		s1, v0, 24		# 00274b74:00028e3c	
    	dsra32		s1, s1, 24		# 00274b78:00118e3f	
    	lw		s0, $0014(s3)		# 00274b7c:8e700014	
    	bne		s0, zero, $00274b9c	# 00274b80:16000006	v __00274b9c
    	nop					# 00274b84:00000000	
    	lui		a0, $0064		# 00274b88:3c040064	a0=$00640000
    	addiu		a0, a0, $ef58		# 00274b8c:2484ef58	a0="frFont.c"
    	addiu		a1, zero, $06c3		# 00274b90:240506c3	a1=$000006c3
    	jal		$00470990		# 00274b94:0c11c264	v FNC_00470990
    	nop					# 00274b98:00000000	
    __00274b9c:					# 
    	sb		s1, $0003(s0)		# 00274b9c:a2110003	
    	daddu		v1, zero, zero		# 00274ba0:0000182d	
    	lw		a0, $001c(s0)		# 00274ba4:8e04001c	
    	beq		zero, zero, $00274bc4	# 00274ba8:10000006	v __00274bc4
    	nop					# 00274bac:00000000	
    __00274bb0:					# 
    	lw		v0, $000c(a0)		# 00274bb0:8c82000c	
    	addu		v1, v1, v0		# 00274bb4:00621821	
    	lb		v0, $0003(s0)		# 00274bb8:82020003	
    	addu		v1, v1, v0		# 00274bbc:00621821	
    	lw		a0, $0028(a0)		# 00274bc0:8c840028	
    __00274bc4:					# 
    	bne		a0, zero, $00274bb0	# 00274bc4:1480fffa	^ __00274bb0
    	nop					# 00274bc8:00000000	
    	sw		v1, $000c(s0)		# 00274bcc:ae03000c	
    	lw		s1, $0008(s3)		# 00274bd0:8e710008	
    	lw		s0, $0014(s3)		# 00274bd4:8e700014	
    	bne		s0, zero, $00274bf4	# 00274bd8:16000006	v __00274bf4
    	nop					# 00274bdc:00000000	
    	lui		a0, $0064		# 00274be0:3c040064	a0=$00640000
    	addiu		a0, a0, $ef58		# 00274be4:2484ef58	a0="frFont.c"
    	addiu		a1, zero, $0735		# 00274be8:24050735	a1=$00000735
    	jal		$00470990		# 00274bec:0c11c264	v FNC_00470990
    	nop					# 00274bf0:00000000	
    __00274bf4:					# 
    	srl		v0, s1, 4		# 00274bf4:00111102	
    	sw		v0, $0014(s0)		# 00274bf8:ae020014	
    __00274bfc:					# 
    	lw		v1, $0018(s3)		# 00274bfc:8e630018	
    	addiu		v0, v1, $0001		# 00274c00:24620001	
    	sw		v0, $0018(s3)		# 00274c04:ae620018	
    	lw		v0, $0010(s3)		# 00274c08:8e620010	
    	addu		v0, v0, v1		# 00274c0c:00431021	
    	[COLOR="#FF0000"][B]lbu		s0, $0000(v0)		# 00274c10:90500000[/B][/COLOR]	
    	bne		s0, zero, $0027481c	# 00274c14:1600ff01	^ __0027481c
    	nop					# 00274c18:00000000	
    __00274c1c:					# 
    	lh		v1, $a7b0(gp)		# 00274c1c:8783a7b0	v1=$1bd9a7b0
    	addiu		v0, zero, $fffe		# 00274c20:2402fffe	v0=$fffffffe
    	and		v0, v1, v0		# 00274c24:00621024	
    	dsll32		v0, v0, 16		# 00274c28:0002143c	
    	dsra32		v0, v0, 16		# 00274c2c:0002143f	
    	ori		v0, v0, $0002		# 00274c30:34420002	
    	sh		v0, $a7b0(gp)		# 00274c34:a782a7b0	[1bd9a7b0]
    	lw		v0, $0014(s3)		# 00274c38:8e620014	
    	ld		ra, $0040(sp)		# 00274c3c:dfbf0040	
    	lq		s3, $0030(sp)		# 00274c40:7bb30030	
    	lq		s2, $0020(sp)		# 00274c44:7bb20020	
    	lq		s1, $0010(sp)		# 00274c48:7bb10010	
    	lq		s0, $0000(sp)		# 00274c4c:7bb00000	
    	addiu		sp, sp, $0060		# 00274c50:27bd0060	
    	jr		ra			# 00274c54:03e00008	
    	nop					# 00274c58:00000000


    And here is the problem I have. What do I even have to look for? Branches, JALs? Was picking a break-on-read on a text string the wrong idea in the first place? If you guys could help me out, that would be awesome. A push in the right direction is all I'm asking for Also, if you guys have questions, feel free to ask and I'll to my best to provide the info you need

  • #2
    Well, you're not doing it wrong, and that may have been the way the debug mode was discovered in the first place, but breaking on a string being read will probably only lead you to the functions that write the menu to the screen, which may be fairly generic and widely utilized. You may have to trace back through several calling functions to find something specific to the debug menu.

    Comment


    • #3
      I don't personally own this game or I would look into it. I would start with looking at the string list in the ps2dis. Try and pinpoint any strings that seem to associate with the term debug. A string that uses place holders for the SPrintf function that is associated with debugging could really help out. This will at least give you where the menu is being printed in memory. Let's say you did find a function in the memory that is printing the menu. It would then be smart to function cut and test around this function and any referring functions. I would pay close attention to any loaded data and conditional statements.

      In my experience codes like this are usually really easy or extremely hard to find. In easy cases, menus can be turned on with simply changing a boolean value or changing a conditional statement. In the hard cases I have had to write functions that would call the debugging functions. Hopefully this can give you a direction, good luck!
      Last edited by Cronotrigga; 04-28-2015, 04:39:53 PM.

      Comment


      • #4
        Thanks for the help guys, but I should have mentioned that my knowledge of MIPS assembly (and any other programming language) is pretty limited and I'm just able to make simple codes... Since I still run around in circles, I guess it would be the best to do much more reading before giving it a shot again.

        Originally posted by Cronotrigga View Post
        [...] Try and pinpoint any strings that seem to associate with the term debug. A string that uses place holders for the SPrintf function that is associated with debugging could really help out. [...]
        That is the part I don't understand, especially the underlined part. I did some research about sprintf, but I don't get much of it. From what I understand is, that sprintf uses pre-definded variables or values and generates a readable string somewhere in memory. Please correct me, if I'm wrong.

        Now the underlined part. What do you mean by place holders? Also, how would a very generic sprintf code look like in MIPS assembly?

        Comment


        • #5
          Code:
          Ok so you looked into it, you got an idea and your on the right track. SPrintF is a function that prints a string, placeholders are used in the string to hold a place for a variable value. The placeholder will be replaced with a value inserted into the string. 
          
          Example : "I have $%d  in my pocket"
          If I were to give sprintf this string and a number the number would be inserted into the string taking the place of "%d"
          
          Let's say we give sprintf the string above and the integer value of 3 the string would look like this. 
           "I have $3  in my pocket"
          
          Now that you get the idea it would be smart to tell you that Sprintf can handle many types of variables, each using there own placeholder. Multiple variables and place holders can be used on one call to Sprintf.
          
          A debug menu as you know, would consist of some kind of text and it would be displaying some kind of debug information for a developer. Your best bet in this situation is to try and find any strings that look like debug output. As i was explaining before about sprintf is that the function is extremely common and found in just about every language. You can find sprintf or a function similar to sprintf in every PlayStation2 game. 
          
          Now to tell you how to hack the code isn't really possible, since each game is different. It is important to learn some techniques to help find what you are looking for.
          Registers
          a0-a3 - used as an argument
          v0-v1 - used as a return value
          t0-t9 - temporary information
          s0-s7 - saved data, information that needs to be preserved between function calls

          Definitions:

          -String
          A line of text
          example
          Hello World

          -Pointer
          A pointer is an address that points to an address.
          Example : 200A0000 000B0000

          -Operations that are considered target types
          These operations allow the parser to call functions or segments of code. targets point to the next line of code to execute.
          Example
          jal, j, and Jalr

          -Boolean Values
          A boolean is a flag, it can ether be 1 or 0 Success or fail.
          You may also see some operations set a boolean value in a registers.
          Example
          Slti

          -Conditional Statements
          -An operation that compares a register
          Example
          beq, bne, beql, etc.

          -Float Values
          A floating point number. Has a much higher precision of accuracy then an integer value.
          Example(The example is actually is equal to 1 when converted)
          200A0000 3F800000

          can also be in operations
          lui s0, $3F80

          -Function
          A segment of code with a purpose. returns something. Most functions can be spotted and identified by this unique operation
          addiu sp, sp, $fffd0 <---this value can change

          -Subroutine
          A segment of code with a purpose. does not return anything.
          subroutines will usually just be a bunch of operations and will return to the caller.

          Testing
          For someone starting out, this is really what you want to focus on. So you might be wondering ok I found a few of the examples he was showing but what do I do? Let's start.

          -Pointers
          Since a pointer is pointing to a separate address, It isn't uncommon to find several pointers in groups. You may also find that a pointer may point to an area in memory that seems to almost have a pattern. If you find that a pointer is pointing to an area that seems to have a pattern, try and find the pattern and change the address that it is pointing to, to something new.

          -Targets
          You will find targets in the function area of the memory dump. To make it simple you can set a nop(00000000) in these addresses and see if you find any change in the game. It might be smart to note that you will freeze alot placing nops where targets should be. You must remember that these usually are function calls and sometimes information that is needed is returned. If you nop that address the returned data will now not be returned and could cause the game to freeze. A FNC Cut is a much better way and we will go over this shortly.

          -Boolean Values
          This is pretty simple if its a 1 try a 0, if its a 0 change it to a 1.
          If you are dealing with operations that handle flags, try a nop(00000000)


          -Conditional Statements
          Conditional statements are an operation and will be found in the function section of the memory dump.
          To try and find codes using conditions, I suggest trying to change the branch to it's opposite.

          Example
          beq a0, v0, $0100
          would become
          bne a0, v0, $0100

          You can also try forcing a branch
          Example
          beq a0, v0, $0100
          would become
          beq zero, zero, $0100

          -Float Values
          These are simple change them to a different float value. 7FFFFFFF = max value 00000000 - min
          Example
          41a00000

          -Function
          Most common way to get an effect is to fnc cut. this is accomplished by setting a jr ra command followed by a nop at the top of a function.

          Example(function may look like this)
          addiu sp, sp, $ffd0
          sw ra, $0000(sp)

          Will become
          jr ra
          nop

          -Subroutine
          Subroutines can usually be function cut like above. In some occasions you may need to force a branch to the jr ra

          beq zero, zero, $0001 <--branch points to the jr ra
          nop
          jr ra
          nop


          I could go on and on but I think that's a pretty good start hopefully it will point you to some common techniques for finding codes. As you get better you will pick up on how mips instruction set actually works, but for now just focus on making your code.
          Last edited by Cronotrigga; 04-29-2015, 10:19:01 PM.

          Comment


          • #6
            Wow, that was some help I was totally NOT expecting, haha. I really appreciate that. Now I understand what sprintf does and the rough explanations will totally be useful, too. It will still take time until I know how everything works though. But hey, these explanations and the literature I found here and on the net will help me on my way to achieve my goal

            Comment


            • #7
              Just to be sure, sprintf doesn't actually print the string to anything you might consider a display. It acts like a printf, which goes to the display unless redirected, replacing format codes and so forth, and then stores the string to a specified location in memory for later use.

              For your current purposes the distinction might not be too important, but just so there are no misunderstandings down the line.

              Comment

              Working...
              X