Easy and Crude Walk Through Walls guide

[47iscool]

Sonic R uses a different method than any other game I've seen. First after you've found your position set cheat engine to show you the writes and as soon as you're close to a wall it constantly writes, when you back away it stops. Basically NOP a few addresses behind the ASM code that causes it and you can go through most walls.

I'm having trouble with Way of The Samurai though, after I found the X/Y address it constantly writes when he is walking or running into a wall, I NOP'ed a good bit of address in front of it and behind and found nothing. This game really has got me puzzled.

The address I get is 00126F10 and the value of it is C4410020. Are there any other methods besides the X/Y position type?

[nolberto82]

The address I get is 00126F10 and the value of it is C4410020. Are there any other methods besides the X/Y position type?

What happens when you edit the memory address?

[47iscool]

What happens when you edit the memory address?

Nothing sadly, I did NOP a few address beneath it and it will put you up on the wall/hill, edit a few more and touching the wall will push you way back. If I knew more about MIPS I might could make the code. The main codes that people NOP on PS2 are 32-bit address which start with "OC" which is a JAL command. When CE gives the code that writes to an address the code you want is usually about 8 addresses behind it.

Here's an example:
It gives me this address:00126F10 and the JAL address behind is located at 00126F08
To get get ASM codes to work in CE you must do two things, since CE mounts the RAM at 0x20000000,
your ASM address would be 20126F10 or the JAL at 20126F08. To see if the codes works make a save state, freeze the address then reload the save state. This is how I make ASM codes, of course they sometimes freeze up on the real system while they don't on pcsx2. NOP a value like this: 0008082D and it will cause a lockup on the real system.

So any ideas? Are there any other methods you use besides the X/Y position? That Chrono Trigger WTW code you made works perfect. I wanted to try my hand at it for some practice but the farthest I got was a WTW upward and can't go downward. Your code is only one address and it works way better than the other ones in the DB. If you have any other ideas/methods please let me know. I have much respect for you and the other longtime hackers here that's why I ask. Have you ever used pcsx2 for hacking? My PC doesn't run it at full speed but it's enough to make PS2 codes.

[nolberto82]

No I meant what happens when you edit the RAM address? I usually use X/Y position but when I can't find it sometimes I've used the camera position or other addresses related to X/Y it all depends on the game. For some games WTW can be made in many different ways Chrono Trigger is one of those games I had to do a lot tracing to get the correct code.

NOP a value like this: 0008082D

NOP should be 0x00000000 if PS2 MIPS is like PS1 and PSP. Emulators tend to be more forgiving than real thing. I have tried PCSX2 before but never got any code using CE. I'll have to try again.

[47iscool]

No I meant what happens when you edit the RAM address? I usually use X/Y position but when I can't find it sometimes I've used the camera position or other addresses related to X/Y it all depends on the game. For some games WTW can be made in many different ways Chrono Trigger is one of those games I had to do a lot tracing to get the correct code.



NOP should be 0x00000000 if PS2 MIPS is like PS1 and PSP. Emulators tend to be more forgiving than real thing. I have tried PCSX2 before but never got any code using CE. I'll have to try again.

Oh I know, sorry I worded it wrong. I meant if you turn this 0008082D into this 00000000 it will NOP the value and it will cause a freeze up.
lee4 said the pcsx2 team found a way to lock down pcsx2's addresses to mount like it does. If you meant the older pcsx2 I was never able to make any codes with it either because it didn't mount like it does now.

If you mean the X/Y position address that controls where he's at changing it will move him left, right, up or down. I'm not sure if the
X/Y position changes if you restart it or not because I'm using a save state I made a few day ago.

Important note for CE, the "ESI" is the actual ASM read or write code, just change the first 0 in the ESI address into a 2.


NOTE: CE only says it's "EXPIRED" because it's April fool's day.

[Keylan]

I guess I should do a MESS version for the Genesis walk through walls codes as that is what I use to make Genesis codes.

That would be awesome. I am able to find the positions using Regen (MESSUI doesn't even let me have a cheat menu to search, even though I have searched through many posts about how to do it.) However, when I try to set the breakpoints in MESSUI, I get things to break on some break points, but it only tells me that it broke, and nothing about what causes it to break.

Snes9x gives info like this for the breakpoints (taken from your guide)
00/E697 85 03 STA $03 [$00:0303] A:0098 X:0000 Y:0000 P:envmXdizc

But I can't figure out a way for MESSUI to tell me anything other than "stopped at breakpoint" I must be doing something wrong, as I can't figure it out at all for Genesis.

[olala]

huh? why only me who cant understand tha tut above:P, wey megaman@ i think you need to changin tha main topic title, its not "Easy" um well for me at leash heh:x
dood

[47iscool]

That would be awesome. I am able to find the positions using Regen (MESSUI doesn't even let me have a cheat menu to search, even though I have searched through many posts about how to do it.) However, when I try to set the breakpoints in MESSUI, I get things to break on some break points, but it only tells me that it broke, and nothing about what causes it to break.

Snes9x gives info like this for the breakpoints (taken from your guide)
00/E697 85 03 STA $03 [$00:0303] A:0098 X:0000 Y:0000 P:envmXdizc

But I can't figure out a way for MESSUI to tell me anything other than "stopped at breakpoint" I must be doing something wrong, as I can't figure it out at all for Genesis.

Same here, I found the M68k main RAM but it won't let me set a BP on it anywhere. I'm using QMC2 with the debug version of MESS.

[Mezmorize]

You guys are using the watch point command, right? For example (Game Boy/Gear):

wp C234,1,r

will break and open the debugger when the RAM address is read from.

Or:

wp C234,1,w,pc!=1234 && pc!=4321

will break on writes to the RAM address unless the ROM addresses 1234 or 4321 caused it.

[47iscool]

You guys are using the watch point command, right? For example (Game Boy/Gear):

wp C234,1,r

will break and open the debugger when the RAM address is read from.

Or:

wp C234,1,w,pc!=1234 && pc!=4321

will break on writes to the RAM address unless the ROM addresses 1234 or 4321 caused it.

I'm still learning to use this emulator so I didn't know. Can this be done with QMC2?

[rimsky82]

I'm still learning to use this emulator so I didn't know. Can this be done with QMC2?

QMC2 is only a launcher. It has nothing to do with the functionality of the debugger. Also, you don't need the debug version of MESS, unless you plan on debugging MESS itself as opposed to the games you run in it. On QMC2, to enable the debugger, go into the configuration.

I use QMC2 as well, but it is ultra bloated. Try using my launcher for a simpler interface. There is a checkbox for enabling the debugger.

[47iscool]

QMC2 is only a launcher. It has nothing to do with the functionality of the debugger. Also, you don't need the debug version of MESS, unless you plan on debugging MESS itself as opposed to the games you run in it. On QMC2, to enable the debugger, go into the configuration.

I use QMC2 as well, but it is ultra bloated. Try using my launcher for a simpler interface. There is a checkbox for enabling the debugger.

Thanks.

What's the software folder for? ROMs?

[Mezmorize]

Months ago, Helder uploaded a version of MESS already fully set up here.
The link is now dead but I re-uploaded it if you want to grab it:
http://www.filefactory.com/file/5x3i...az/Mess_GH.rar

Also, another important command to know for the debugger is the one to clear watch points:

wpclear

Here's another thread with some good info on the debugger too:
http://www.mamecheat.co.uk/forums/vi...php?f=2&t=5743

[rimsky82]

Thanks.

What's the software folder for? ROMs?

MESS keeps lists of roms, called software lists, that require certain names and directory structures. When you have them set up correctly, you can specify the software folder and launch games from the software list.

Otherwise, just open a file with the open file dialog.

[47iscool]

Thanks guys. The main reason I wanted to use MESS was because I figured it may have a better debugger than Regen. I'm downloading the mess link you provided Mez and I'll give it a shot.

Although the way Regen displays breakpoints is a little annoying (constantly covering up the main window) I'll continue to use it.
If only other emulators had a BP/Debug menu the way that rimsky's fceux mod or Geiger's snes9x did it would be better, allowing you to search for address and use the BP/debug at the same time.

Hopefully Helder won't be upset with his thread being used for other purposes. Sorry about that, if I have anymore questions I'll create my own thread.