Hacking Sequential codes PSX

[Helder]

Well then have you tried pressing F7 so it will advance one line at at time and see when it stores that value? If you follow the instructions line by line you will find when its stored and usually where its loaded and then insert your change in between the load and store. Again you need to do the leg work and if you have trouble we will help, not us do the work and show you how we did it since you will be missing the steps of finding how it was found.

[jin299]

Hey Helder, right I placed read breakpoint on the address looked at the registers and all the rest of the registers changed during the each breakpoint, however one thing I noticed was each time the game broke on a breakpoint the values in register v0/r2, stayed the same what does that mean, is there anyway I can change the values in this register from 00000002, 00000005?

Also I do seem to learn much better with visual images than written explanations, but your know what they say a picture is worth a thousand words.

[Helder]

I was trying to explain it you you before by placing a read break but a write will work also or probably better anyways, so you set the break on the infinite health address before the level starts and it should break many times but one of those times it will display the current value stored so you change that. The only way for you to do it is if I or someone else does it and shows you but how will you learn if we do that? Try doing what I and Abystus said and then post here with your progress and pictures, also post the pictures here since going to another site plagued with ads annoys me.

[jin299]

I nopped this instruction sb v0,$0(v1) and guess what it worked, how on earth did you now the code was this address?

I was originally trying to hack a code that to trick the game into staring of with 5 lives instead of 2,, which is the standard number of lives you start of with in the game, any idea what instruction I changed to give me this result?

[nolberto82]

80100FE8 2442FFFF subiu     v0,$1      - You can NOP this one
80100FEC 08040428 j         $801010A0
80100FF0 A0620000 sb        v0,$0(v1)  - Or you can NOP this one

What kind of code are you trying to make?

[jin299]

Right I did what you said now what do I do, does it involve changing the sb v0,$0(v1) instruction?

[Abystus]

Sorry for the delay in response. I was out getting groceries, but it looks like your in good hands with nolberto82.

[nolberto82]

It does jump but before it does it executes this first:

80100FF0 A0620000 sb        v0,$0(v1)

Branches and jumps in MIPS use delay slots.

EDIT - It shouldn't jump to jal. Did you change 80100FEC?

[jin299]

Yes it does but it jumps immediately to ja1 afterwards, as soon as I go to click the add v0,5 instruction?

[nolberto82]

For some reason it accepts "add v0,5".

[jin299]

still the same problem unknown command?

[nolberto82]

Try addiu v0,v0,$5.

[jin299]

Right I picked this one subiu v0,$1 tried to change the command to addiu v0,$5 but the debugger keeps saying unknown command?

[nolberto82]

You should check to see if there is more of these:

80100FE8 2442FFFF subiu     v0,$1       - You can change these one.
80100FEC 08040428 j         $801010A0
80100FF0 A0620000 sb        v0,$0(v1)   - And this one also. This will execute before the jump.

[jin299]

Right I went up a little and hit a beq branch and I took a screenshot too so that you can see,, where I am on the debugger now what do I do man?

http://tinypic.com/r/xn6qug/5