Psx code hacking

[jin299]

I know there is is but the reason why I asked you about how to hack the code, was purely for learning purposes, you see I wanted to know how to hack the code myself, so that as gamehacker I could gain a better understanding about how to hack different types of codes, That normally I would't be very knowlegeable in hacking, if that makes sense LOL

[Helder]

Yea it makes sense as we all want to learn as much as we can but I gave you the explanation on how to hack the code the way I did so you can take that to any other game that has charge moves and it will more than likely work.

[jin299]

Thanks, for telling me how to hack a no charge code Helder, hopefully with a bit of luck I'll be able to hack the code myself for the game,

Now there's something that has been bothering me about, code addresses that have 2 lines of an address, ill use an code from Driver 2 as an example, to help illustrate my issue.

Get Out When Chased
80055B7C 000A
80055B7E 1000

When hacking these type of codes, how is the second line of the code address found, is it normally found next to the first address in the memory, or is the second line of the address separately different from the first line of the codes address.

So basically what I mean is are these types of codes actually, 2 separate codes condensed into one to give of a different type of code effect in the game?

[Helder]

Usually 2 lined codes like the one above are really 1 line of 32bit but the PSX GS and other devices like it only accept 16bit codes so we have to split up the code. A good rule of thumb is to look at line before and after the code you found to see if there is something else that might need to be included. Many ASM codes are 2 lines because the PSX CPU writes out instructions in 32bit so when I made certain codes that are ASM you will see many codes that are sequential like your example above and that is to cover the 32bits of instructions.

[jin299]

Right so say I found the first code address, should the second code of the address be somewhere near the first in the memory of Art Money?

Also, after I have found the second address of the code is it important to have found the correct values for the second address, in order for the code to work properly?

[Pyriel]

You're kind of putting the cart before the horse, dude. You have to know what specific, low-level task the code is accomplishing before you worry about things like that. The code you posted is most likely changing a branch instruction to, "BEQ zero, zero, +10". The op codes (instructions) on the PSX are always 32 bits, so to fully overwrite one, you need two lines, and they will be adjacent. If the code was overwriting data, the second could just as easily be 50 bytes away from the first. Or, if the instruction was already branching to +10, you might only need the second line, which makes the operation branch always, because register zero is always equal to register zero.

This isn't the sort of code that was likely found by searching with Art Money. For one thing, you typically can't do difference searches on the game's program, and even if the executable segments do change, it almost certainly won't be a small number of operations that are replaced. For another, you'd have to be able to decode the operations in your head while viewing memory in Art Money, which is not impossible, but it's impractical enough that nobody would recommend it.

[jin299]

I understand so most likely, ASM was used in the creation of the code, but I always thought in order to modify any code using ASM there already needs to be an existing code found to do so, by this I'm refering to when you are placing a breakpoint on an existing code, like Infinite Health for an example?

[Pyriel]

It's hard to say how that cheat was found. I've always done things by reverse-engineering the game, so I might never have inserted breakpoints into anything. I might have just had reason to suspect that the function surrounding that address had to do with escaping, and then tried breaking it to confirm. And by "breaking", I mean actually breaking, not a breakpoint. Hacking is a process of elimination, so I'm perfectly happy to make the game crash, if it helps me test a hypothesis.

I don't know exactly how you're using the term "code" in your post. I tend to use "cheat" to refer to cheat codes, and "code" to refer to any part of the game's programming. Although, the unfortunate choice of shortening "cheat code" to "code" will always lead to the terms being interchangeable and ambiguous at times.

In order for a cheat code that writes assembly instructions to have any effect, the instruction being written has to be executed, almost always by the game. So generally speaking, an instruction must already exist at the address being written to. The cheat is replacing instructions in the game's programming with new instructions that cause it to behave differently. In the case above, it forces the game to not execute instructions below it, and to instead branch to an instruction farther along. That's the value of using assembly. You can create major changes in the way the game works by modifying its executable code, and forcing it to do things in a way that's advantageous to the player.

In your post above, it seems like you're confusing the game's executable code and cheat codes, mistaking them for a single concept. It also sounds like you might think assembly (ASM) can exist in a vacuum. That's not the case. You can't just write assembly operations to any address. It has to be in a section of memory that will eventually be an executable part of some running process.

[jin299]

No, when I meant by code I was refering to the ram address of a code in the memory, which then the code can be converted to a gameshark code, for playable usage on the Psx now if I was to use the word cheat well then I would specifically mean in game cheats,not gameshark cheat codes, sorry for the confusion, I suppose the two definitions could be perceived by other people to be interchangeable, but I always regarded codes to be distinguishable different from one another, now as far s debugging goes I was always under the assumption that in order to to effectively game hack, using a debugger, it's vital that you have grasped a reasonably good understanding Of ASM language in order to manipulate a particular code to your liking?

[Pyriel]

What do you mean by "RAM address of a code". When you say it like that, it sounds like you're attaching some inherent link between that memory location and a cheat code. Maybe it's a language barrier issue. Just in case here's an example of what I mean when I say "code" in reference to the game's programming:

TEXT:80074BAC RestorePartyHPMP:                        # CODE XREF: Cmd67?+8p
TEXT:80074BAC
TEXT:80074BAC var_10          = -0x10
TEXT:80074BAC var_C           = -0xC
TEXT:80074BAC var_8           = -8
TEXT:80074BAC var_4           = -4
TEXT:80074BAC
TEXT:80074BAC                 addiu   $sp, -0x20
TEXT:80074BB0                 sw      $s0, 0x20+var_10($sp)
TEXT:80074BB4                 move    $s0, $0
TEXT:80074BB8                 sw      $s2, 0x20+var_8($sp)
TEXT:80074BBC                 lui     $s2, 0x8011
TEXT:80074BC0                 sw      $s1, 0x20+var_C($sp)
TEXT:80074BC4                 li      $s1, 0x9465
TEXT:80074BC8                 sw      $ra, 0x20+var_4($sp)
TEXT:80074BCC
TEXT:80074BCC loc_80074BCC:                            # CODE XREF: RestorePartyHPMP+40j
TEXT:80074BCC                 lw      $v0, -0x2930($s2)
TEXT:80074BD0                 nop
TEXT:80074BD4                 addu    $v0, $s0
TEXT:80074BD8                 addu    $v0, $s1
TEXT:80074BDC                 lbu     $a0, 0($v0)
TEXT:80074BE0                 jal     RestoreHPMP
TEXT:80074BE4                 addiu   $s0, 1
TEXT:80074BE8                 slti    $v0, $s0, 6
TEXT:80074BEC                 bnez    $v0, loc_80074BCC
TEXT:80074BF0                 nop
TEXT:80074BF4                 lw      $ra, 0x20+var_4($sp)
TEXT:80074BF8                 lw      $s2, 0x20+var_8($sp)
TEXT:80074BFC                 lw      $s1, 0x20+var_C($sp)
TEXT:80074C00                 lw      $s0, 0x20+var_10($sp)
TEXT:80074C04                 addiu   $sp, 0x20
TEXT:80074C08                 jr      $ra
TEXT:80074C0C                 nop
TEXT:80074C0C  # End of function RestorePartyHPMP

All those addresses represent executable code. The disassembler has kindly made the individual operations more readable by decoding them into assembler mnemonics, i.e., text like "addu $v0, $s0. In memory, that operation would simply appear as 21105000 starting at 80074BD4 (this is actually backwards, but I won't go into that). In contrast, this is an array of logical block addresses and file sizes that a game uses in place of the CD's table of contents to seek files:

TEXT:800E83BC CDPos_???:      .word 0x44, 0x17, 0x9F000, 0x18, 0x74CA100, 0x157, 0x13D24
TEXT:800E83BC                 .word 0xCE21, 0x19FB4, 0xCE49, 0x4F978, 0xCE7D, 0x4ECB8
TEXT:800E83BC                 .word 0xCF1D, 0x1D198, 0xCFBB, 0x283C8, 0xCFF6, 0x28DC8
TEXT:800E83BC                 .word 0xD047, 0x12E78, 0xD099, 0xD868, 0xD0BF, 0x99A0
TEXT:800E83BC                 .word 0xD0DB, 0xE068, 0xD0EF, 0xD3A8, 0xD10C, 0x193B4
TEXT:800E83BC                 .word 0xD127, 0x19384, 0xD15A, 0x193B4, 0xD18D, 0x19244
TEXT:800E83BC                 .word 0xD1C0, 0x192F4, 0xD1F3, 0x18D54, 0xD226, 0x19274
TEXT:800E83BC                 .word 0xD258, 0x19374, 0xD28B, 0x44F88, 0xD2BE, 0x1E184
TEXT:800E83BC                 .word 0xD348, 0x4ED94, 0xD385, 0x4BC34, 0xD423, 0x4F0E4
TEXT:800E83BC                 .word 0xD4BB, 0x3B2B0, 0xD55A, 0x24F9C, 0xD5D1, 0x3D154

This is simply data. Both of these can be subject to modification by a cheat code, but there's nothing intrinsically "cheat code" about either set of information. If I know what they represent, and how the game uses them, I can make modifications to them to alter the way the game works.

I think Datel actually did us a disservice by making "8" the basic, 16-bit write command. I believe they did it for ease of use, so that hackers only had to copy the address to make the simplest codes, but I've seen this equality lead to odd confusion more than once.

[jin299]

I think it's me that has all my information wrong man, would it be right to assume that game programs like cheat engine and artmoney only serve one specific purpose in game hacking and that's to hack the emulator, while the main purpose for using a disassembler, is so that it's possibly to hack the ram address of a game, which seems to be the most effective of making codes but it's not necessarily the easiest way for hacking game codes?

Unfortunately, as you may have acknowledged by now, my grasp of on game programming language is somewhat very limited, so inevitable that's only going to make understanding of the process that much more difficult to accomplish, But I'm wlilling to learn what it takes, to gain a solid in inderstanding the fundamental basics, of game hacking.

Also is there any helpful resources available regarding how to use a psx disassembler, that may be of any assistance, in providing me with some additional support on how effectively use a disassembler, and if so would you be able to give some insight?

Thanks.

[Pyriel]

Personally, I would take the approach of learning how to use the assembly language, rather than jumping immediately into trying to disassemble games. If you already know an assembly language somewhat well, it's possible to just jump right in and figure things out in the disassembler as you go along. If you're completely new to the concepts, it's better to learn them in a way you have more control over. Going from pretty much zero to trying to pick apart and understand a game would be like trying to restore a painting when all you've ever done before is finger paint. If you don't get frustrated and quit, you'll eventually learn, but you'll have some fairly spectacular failures along the way.

This looks like a fairly good MIPS tutorial here. It's in no way specific to the PSX, but the concepts are the same. If you want, you can also learn x86/x64 assembly and write small programs for you PC as practice. You'll run into some fairly major differences between the MIPS and the Intel architectures, though. For the most part, the low-level tasks are similar. Understanding one well will help you with the other, but moving between them could cause some confusion at first.

You can't really pin those tools down to one specific task like that. Art Money and Cheat Engine are better for PC games obviously. With respect to the PSX, yes they can only be used to attack the emulator, and unless you intend to hack the emulator, all the features beyond basic memory scanning and poking are useless. The main purpose of using a disassembler is to understand the game's programming and behavior. One possible goal of that is finding a RAM address to modify with a cheat code.

The best general advice I can give is this: Don't worry too much about how to hack the code you want. You need to split that up into smaller goals, and try different methods of attack to accomplish those goals. At each step, the objective is to accumulate just a little bit more information, just a little bit more understanding of how the game works, until you know what you need to make the code. If all you're concerned with is methods for hacking X type of code, you'll just end up following sets of instructions. When those instructions fail, you'll be at a loss for alternatives, and you'll have to give up.

By way of example, a few months back, I wanted to modify the game Suikoden II to fix some issues with its music. There are several songs that don't play properly in the US game, even though they're fine in the Japanese and European versions. My process basically went:

Ultimate Goal: Fix the Music

1. Is the music on the disc? Several sources say yes, and point out that you can listen to it by using one of the PSX Media Players available on the net. I download one of the players and confirm that, yes, the music is there.
2. I know nothing about how the PSX handles sound, so I look through the technical documentation on it. This helps confirm that the music is the XA data on the disc (BGM.XA) and that the game is almost certainly using the streaming capabilities of the PSX.
3. My disassembler includes signature files for the PSX Software Development Kit (SDK). It can automatically identify and label many of the functions it provides. I look through a disassembly of the game's executable for the CD functions.
4. Finding the SDK functions that set up the streaming audio, I use a tracing emulator to watch what happens when the background music changes. What values are passed, what functions are calling these SDK functions, etc.
5. Using the traces, I managed to follow the calls back to a function that establishes the starting location of music tracks, and passes them along to initiate playback.
6. From that function, I found a table of track information that includes the time indices, channels, and so forth.
7. From the traces, I knew which entries in the table represented the two tracks I'd been testing with. To confirm my hypothesis, I replaced one with the other, and checked the game. Instead of swapping music when I changed locations, the first song just began again. I tried a couple more tests with different entries in the table, just to see what was there.
8. Now I knew how the game figured out what tracks to play and how to find them, but I still had no idea what was wrong with the broken music.
9. Going back to the functions that initiate playback, I set up another trace just before one of the broken songs played.
10. Nothing looked wrong with the data passed around by the functions, and the entry in the table that was used looked fine.
11. Playing a hunch, I modified the channel number, and the song started up fine.

So the song can be fixed with a one line code that changes one byte of data. If I had set out from the beginning to just try to make this code, I never could have done it. I would have had no reason to have that hunch, and no idea where to start looking in memory. Hell, I wouldn't have had any reason to think a code could fix it all. I started with the sinking feeling that I was going to have to repair megabytes of data on the disc and re-encode them to even make start fixing the issue.

[jin299]

One of the greatest barriers I'm trying to overcome at the moment, is trying to grasp the idea of assembley language, I'm finding the process of learning the language to be incredible difficult, time consuming, and confusing so I don't think i'll be learning how to use a debugger anytime soon, so the question at this point in time is can I still hack cheat codes of any value using, cheat programs, like Art Money or cheat engine?

Like any code that was hacked by a disassembler, can be recreated using cheat engine programs lke Art money, or is there limitations on what type of codes can be hacked using them?

[Pyriel]

Oh, yeah. You can definitely make useful codes with memory scanners. A lot of things are actually easier to hack if you can apply that sort of tool. There are just limitations to what you can do is all. And sometimes you won't realize what they are until you hit a brick wall, and somebody explains why, or you figure it out later after you expand your bag of tricks.

[jin299]

I completely agree with you man, as far as memory hacking goes, the only limitations the hacker sets is on themselves right I mean realistically speaking say you have an idea on how a code is hacked, well then a memory scanner could be a valuable tool in assisting you in finding the code, however say you wanted to hack a code, but had completely no idea on how to hack it, then automatically you'd hit an stand still, simply because you have no knowledge in how to go about hacking the code you desired in the first place, so my question is how do you go about hacking new codes wth a memory scanner.

Like I know that each code is specifically hacked differently from one another, but as long as you have an general idea on how to hack a certain code, that helps to certain extent right, but what do you do when you want to hack a new code, but are completely clueless on how to approach hacking the code example, say you just happen to be completely lacking in any notion of thought or idea, then how would you go about hacking the code you seek so dearly?

Also is it right to assume that all the codes that were hacked for the Psx console, at GS Central, were hacked purely by using a memory scanner?