Hacking PSP?

[Dybbles]

Hey guys. I decided to step out of the boundaries of Nintendo and decided to start hacking the PSP a bit.
Any information on assembly hacking would be really helpful.

I actually just bought my PSP a week ago and am playing through Persona 3 Portable.
I am in the middle of hacking a Walk Through Walls code for Tartarus.



I'm not sure if the PSP code hacking scene was that popular, so I just want a link or two for some PSP asm.
And some general code types and tools I should be using.

Thank you very much.

[Pyriel]

The PSP uses a MIPS R4000 processor which is sort of in the same family and generation as the PS2's processor, just minus the MIPS IV subset and maybe some of the multimedia extensions. If you have any experience with the PS or PS2, it should be perfectly familiar. If documentation on the PSP specifically seems sparse, that's probably why. It was fairly old hat to most who worked on it, and the instructions that differed were mostly of a sort that code hackers are unlikely to use.

[Dybbles]

Thank you very much, Pyriel.
Are there any special programs for the PSP that have a cheat searching function?
I am reading something about CWCheat and I'll try using that, but are there any special emulators that have a cheat searcher? I'm using Cheat Engine and PPSSPP right now and the address I am getting isn't a valid address I can use for a breakpoint.

The address I found in Cheat Engine is this; 89499992, but that isn't an address I can use as a breakpoint. And I was wondering if there is a way to get this address to break in PPSSPP. I already successfully hacked the code in Cheat Engine, so I just want to get this to break in PPSSPP so I can make a code out of it for everyone to use.

Also, thank you for always being so helpful and nice, Pyriel! You're awesome!

[Pyriel]

PPSSPP evidently doesn't have a cheat search, and they don't map the PSP's main memory to the same location consistently. All I can tell you is to take a money code or something, find it in Cheat Engine, and subtract. Hopefully, it stays the same between executions as long as you don't change PPSSPP versions. I only remember two emulators for the PSP. One is PPSSPP, and the other was garbage.

[Demonic722]

Are there any special programs for the PSP that have a cheat searching function?
I am reading something about CWCheat and I'll try using that, but are there any special emulators that have a cheat searcher? I'm using Cheat Engine and PPSSPP right now and the address I am getting isn't a valid address I can use for a breakpoint.

You could use ArtMoney with PPSSPP.

[Dybbles]

You could use ArtMoney with PPSSPP.

I have never used ArtMoney before. How would I create breakpoints and would I be able to find the right address with it?
Thanks for all of the help thus far.

[Demonic722]

You can use PPSSPP for debugging and ArtMoney for RAM searching.

I was able to find the right address, but you may have to modify the .emul file located in C:\Program Files (x86)\ArtMoney\ with the right entry for your version of PPSSPP. Some entries are posted in this thread: http://gamehacking.org/vb/threads/32...ulator-options

[Dybbles]

Thank you so much! I'll give this a shot when I have the time.

[luc-ita]

You could use my method:
In PPSSPP's debug press Stop, copy address of an opcode, open it in Memory, Copy an AoB, search it with CheatEngine.
Example:
NFS Inderground Rivals
AoB -> AE 08 04 3C 48 68 85 8C 01 00 A5 24 08 00 E0 03
PPSSPP address -> 0881EF30
CE address -> 0C31EF30
0C31EF30-0881EF30 == difference between CE and PPSSPP.
Now when I search for a value, like money, I do the search with CE, then CE found - difference == PPSSPP address and use that in PPSSPP's debugger.
Because PPSSPP allocates memory dinamically I wrote AoB and PPSSPP AoB's address to find the difference every time I open PPSSPP to hack or study MIPS code.
I do the same thing with NO$PSX.

Hope I helped you a bit

EDIT:
Or you can do a couple of RAM dumps with PPSSPP and search with CE the address. I've abandoned this method but you may prefer it insted.
Another thing I discovered: PPSSPP to CWCHEAT -> ppsspp address - 08800000 == cwcheat address.

[Helder]

https://github.com/hrydgard/ppsspp/issues/3551

has some info.

[Professor-X]

I've been coding for psp since 2007. You should use nitePR or MKultra, and ps2dis. If you want to learn more about coding just send me a pm. The nitePR or mkultra does the same thing. It allows you to turn on your cheats, search and view ram. The ps2dis allows you to see labels of the building blocks of the game that allows you to make your own code. If you don't hear from me... There is a tab in nitePR that says "dump ram" click on that when you are playing the game then grab it off your memory stick and drag it on to the ps2dis.

[xirtamehtsitahw]

There's another way to extract and edit the contents of PSP isos: the combination of UMDGen and a hex editor (I often use HxD). Be warned, though--poking around in a game's files can often lead to disastrous results (such as the game becoming completely unplayable). So, I'd suggest making a backup of the game before making any changes. That's probably stating the obvious, though...

[Harry62]

I've been coding for psp since 2007. You should use nitePR or MKultra, and ps2dis. If you want to learn more about coding just send me a pm. The nitePR or mkultra does the same thing. It allows you to turn on your cheats, search and view ram. The ps2dis allows you to see labels of the building blocks of the game that allows you to make your own code. If you don't hear from me... There is a tab in nitePR that says "dump ram" click on that when you are playing the game then grab it off your memory stick and drag it on to the ps2dis.

Should also mention that when using ps2dis with a psp dump you will need to offset by 08800000 in order for the code to properly line up.

[Professor-X]

Should also mention that when using ps2dis with a psp dump you will need to offset by 08800000 in order for the code to properly line up.

Thank you. I forgot about that. It's been awhile since I've been on here. Did you and pookingz ever find out about the md5 or the cheat detection system on ftb1 & 2? I was always curious to find out where it was located in the ram and how it works.