PS2Dis, PCSX2, Atelier Iris Eternal Mana 2, Journey Beyond

[Luminax]

Greetings folks!

A Little cheesy title to commemorate my return to GSHI, not that anyone remembers me...

Moving along, I have recently re-picked up PS2Dis and some MIPS knowledge, and upon searching encountered Be Natural's site http://www.geocities.co.jp/Playtown-Bingo/8243/ and his wonderful tutorials on PS2Dis. (I'd translate it for you guys but it's too long and complex)

Picking up my favourite Atelier Iris series (partly due to the fact that PCSX2 can run it quite well, and due to the fact that there's quite of ready-made codes available) I descended into the fight!

First and foremost, Master Code!
from Be Natural:
"One easy to find command is [42000038 ei]"



And there we found it, and the corresponding "hooked" JAL
(Note that the first EI might not be the EI we're looking for but it usually is, and these things are usually trial and error )

With that we can setup the Master Code:

F010024C 0000000E
or
F010024C 000001FD
or
F010024C 002B927B

( The last one is Be Natural's own Master Code, how he got this I've still yet to ask).

Now to find something that can be tested to confirm the mastercode works.
I have to confess, having a ton of ready-made code do make you want to just skip it all and use those instead, but no, I want to know how it works inside!

So first option, run the game through PCSX2 and use its Patch Finder to search for the easiest value, MONEY!

Skipping through the tons of events and movies and et cetera (quite a hardship) we finally arrive at a scene where you're in control, and you have $500! (500 'Cole', actually). At the same time, rooting around in PS2Dis we found that the game have a label called "Money"

Such a convenient labeling exist? I can't believe my eyes!

Going to the label brings us to :


Marking and following referral brings us to :

And the very suspicious address (marked in red)!

Back to PCSX2, after some shopping and patch finding, we did find that indeed, that suspicious address is our Gold address, voila!

There's a third method I learned from Be Natural (Max quantity/value check) that I also took to confirm this approach, since not everytime you get conveniently convenient labeling (H'lo Persona!).

This is it for now, still in the middle of searching around so I'll continue later.
-- edit --
Pardon me for not checking on the image linking, fixed, also found a few more suspicious addresses so going to root around some more, will post more later !
-- edit --
Start on hill-climbing trek to find item pointer, item check, and item calculation.


Climb starts from the "Got item" text (it's that one highlighted) and climbing up, marking each and every subroutines and checking each one.
I'm hungry btw... it's cooking time...
<Pause>

[Lazy Bastard]

Cool. We can always use as much documentation as possible. And, do feel free to translate Be Natural's page in the future sometime...I've been wanting to read it in something other than Google translation, heh. Thanks for the walkthrough.

[Luminax]

Experience/Gold x times codes, revealed !

Back to shin(Be Natural)'s code, all these times I've been using his codes (most of the codes on altcodex seems to be from him as well) without knowing how cool the codes actually are!

Folks, are you aware of the 'embedding routine' procedure ?
Let's dissect this code by shin,

EXP xx times

9C827888 0C53B422
9C9A513C 384FE7xx
9C9A5140 14AFFFAE
9C9A5148 0C59B2EE
9C9A514C 204FE756

(GS2V1 format / X-Terminator / XPloder)
The raw codes goes as follow :

A017F760 0803F385
A00FCE14 240F0032 <-- the multiplier EXP x 50
A00FCE18 00AF2819
A00FCE20 0805FDD9
A00FCE24 3C0F00B1

Now if you notice, all codes are in 'One-Time Write' mode, first time I tried this code, it doesn't work! however, after changing the first part into 16-bit write always, we get:

2017F760 0803F385
A00FCE14 240F0032
A00FCE18 00AF2819
A00FCE20 0805FDD9
A00FCE24 3C0F00B1

What about the other codes you ask? not important as long as the memory address holding it aren't touched by other routines, and the game won't touch it anyway.
Now let's take a look at how cool it really is and how it works:
The head code (the only one I changed to 16-bit write always)
2017F760 0803F385

A look in PS2DIS at 0017F760:


Patching with 0803F385


And it turns into a Jump! By the way, this kind of embedded routines, especially ones that involve jumping in the middle of another routine, requires knowledge in MIPS instructions and the odd-ball "Branch Delay Slot".

Now let's follow that jump:
Now I won't go dissecting the jump instruction itself, please read the MIPS manual, suffice to say that it's a relative jump, and it jumps backward, toward 000FCE14, and does this address look familiar? yes, it's in the list of codes up there.

Jumping to 000FCE14:


"But it's all blank NOPs!" you said?
But of course, because we(or rather shin) are going to embed our own code into the blank region.
Starting from 000FCE14, all the way to 000FCE24:

And suddenly it turned into a full-fledged routine!
Oh don't worry about the solitary nop, nor the lui AFTER the jump, Branch Delay Slot dictates that it'll get executed anyway.

Now most of you would've known how the routine works from just looking at it, but for the benefit of the masses:

• Hijacking the lui into a Jump, we fill register t7 with $0032 (this is 50, btw)
• Next we multiply the value in register a1, with t7 (50) and reassign the value to a1.
• Coffee break...
• We jump back to where we hi-jacked the routine, and put the original hijacked command below so it get executed by Branch Delay Slot rule

Hijacking the lui into a Jump, we fill register t7 with $0032 (this is 50, btw)

Don't ask me how he got this after-battle exp address (still trying to find) but rather than hard-writing a value to the static variable of whatever, I like this way better, much cooler too! all hail shin!

And that's that for now... more later!