Hacking Sequential codes PSX

[Helder]

Here is what to do to make it load what we want:


so that is what loads the value into register v1 so simply change it to:

ori v1,0,$??

?? is obviously the value you want.

[jin299]

There is something not right about the debugger I'm using I broke at a completely different location to you? also for some reason the registers won't load the proper value like your did in in your example also some strange reason I had to change the load instruction to or instead of ori in order for the debugger to accept the instruction command I'm inputting, and even then It still won't load the character value of my choice into register v1? instead the runs like normal the value won't change in the register to what i want it to?

[Helder]

You're obviously not following the examples I've given you. You set a break on write and choose a character then we get the break with the sb which is the store and the value is in v1. So you then go up in the ASM till you find a load instruction that puts a value into v1 and double click on it so every time that instruction is run we can see if it's loading the correct value (press F7 on windows) to advance line by line and see the changes occur which tells us that is the correct instruction. Next we test it out by changing it to what I put above or use:
li v1, $??

this will work as well.

Edit: my bad tbe correct instruction is a few lines below the one in the picture it should be the :
80119B60

[jin299]

Helder did I not set the breakpoint to write then like I was supposed to? because I always thought that the ! after an address meant that the break is a write as oppose to a read?

I know that these problems I'm having may seem a bit trivial, but I truly feel that by making mistakes is the only way I will learn, and believe man I have made a lot of mistakes being a novice at game hacking lol

[Helder]

This is how to set a break on write:

[801E7FD2] !



and a break on read:

[801E7FD2] ?

So you did it correctly but the break only occurs when the character is chosen, so what I did was make a Save State aka Snap Shot so I can load the character select screen and test things out. So once I figured out it was that load instruction I put a break on the ASM instruction before it so it breaks before the load occurs and then made a change to the load like I told you in previous post:

li v1,$??
or
ori v1,0,$??

then I pressed F7 (not sure what key it is on a MAC) and saw that the change I made loaded the value I wanted into the v1 register. I let the game continue to make sure it worked and on the next screen the character changed to the corresponding value I chose and success.

Also in the Options> Debugger Setup> Disassembler Syntax make sure to choose Native-MIPS as this allows you to enter the ASM like I showed in this and other posts. When you do reload the Save State you have to change the load instruction again and every time you go back into the Character select screen as the ASM is reloaded back to it's original state.

[jin299]

Helder I went to arcade mode in the game, placed a write Breakpoint on the address 801E7FD2 Choose a character And the breakpoint occurred it broke on this address 80119BA0, so I scrolled up until I found the the load instruction you previously mentioned at the address 80119B60, changed that instruction to or v1, $1B I then placed a break on that address then pushed F7, this caused the address at Register v1 to change but the register in v1 changed to the wrong value which caused the game to crash?,

Also I noticed that when you placed a breakpoint on the address in your example that at the time that the value in register v1 read 00000000, while the register in read 801EEAB0?

[Helder]

What instruction did you use to replace the original with? I posted 2 that can be used 2 posts up. And ignore the registers in the picture as it was to show you where what was.

[jin299]

I replaced it with or v1,$1B I couldn't replace it with ori v1,0,$1B because the debugger will not accept the ori or li commands?

Great news man I think I finally grasped the concept of how to load the proper data into a register, example I was messing around with Street Fighter Alpha 3 and found the correct character modifier address that loads the correct character values I want into the chosen register. I found that the method of setting a breakpoint on any addresses above the initial break that corresponds to the values in the the right register. Also I think what was highly important too was paying extra close attention to the breakpoints and the importance of how great thy are in helping assist you in enabling you to be able load the correct values into a chosen register I found that after carefully looking at the the values of the registers and how they changed after breakpoint was initiated was the the key learning aspect, because the breakpoint shows exactly what values are being loaded into the our register example say I wanted to load an address that loads $5 into the register v1 well the easiest thing i could do is find an add instruction and changed it to ori v1, $5 put a breakpoint on that instruction and wait for it to load $5 into register v1

Now I was messing with this music modifier address in the debugger and I correctly located the right register that was storing the values for the music values the only problem is it will only load the fight music of the characters theme at the character selection screen, and seems to make the music go silent when your reach the fight screen?

Now don't get me wrong man it's pretty cool to hear the the actual characters fight theme while at the character selection screen, but this originally wasn't my main objective or goal I was aiming for.

[Helder]

Glad you learned to atleast figure out how to observe the registers and make some educated guesses to what's going on and make appropriate changes but try an older version of the emulator or change the setting like I said above to Native Mips to see if it will take those instructions. As for the music I believe there are about 5 pages in this thread covering this for Alpha 3, the game music is married to the character that is loaded or maybe the character table that is loaded (remember I touched on this subject and also showed you in a brief example for EX2 character table).

Use these new observation skills of the registers to see if you can find the location of the character tables and possibly edit them to force load the music you want. Don't expect me to help you in this as it's time consuming and I have no real interest in it but is a great exercise for you to learn somethings in the process.

[jin299]

I understand I'll try and see If I can find the Universal music modifier code for Street Fighter Alpha 3 with the debugger, hopefully I make some progress over the next few days.

Also Is it perfectly normal that I have to place breakpoints on the instructions in order to load the correct value into the register, I never knew that actually a lot of the time hacking asm codes is all a trial and error process., a guessing game if you will lol

Also I now know how time consuming finding asm codes actually is, but it's fun and at least It saves you the hassle of trying of having to hack pointer codes in order to bypass the DMA for certain codes in a a game right.

Also I would like to ask you a question what the difference in mips between changing an subu instruction to add or ori, i though add and ori serve the same purpose as one another in asm?

[Helder]

look here for some simple to understand instructions:
http://vhouten.home.xs4all.nl/mipsel/r3000-isa.html

Add will do as it says add to a value or address in a register or in some cases the value at an address.

Ori will do the a similar function as add if used like so : ori v1,$8 (this will add 8 to whatever is in v1). There is no real MOVE instruction in MIPS so ori v1,0,$8 is the same as move v1,$8.

Also a little tip as you might have noticed that there are usually 2 different load instruction right after each other like what's at 80119B64 (look at my picture in above post) lui v0,$801E this will load 801E to the first (left most) 16bits of that register and ori will load to the last (right most) 16bits of a register. There are many times you will see lui followed by an ori, this combo is loading an address into the register starting with the first 16bits (4 characters) then the last 16bits making the 32bit value in the register. This is useful for many things including forcing the address we want to be loaded in an instruction, I would use this to circumvent a pointer to always load the address that has the value I want or load an address with my forced value using some standard ram code.

Alot of possibilities once you know what's kind of going on but setting breakpoints at strategic locations is key to see how the changes we make affects the game code. This is how I make custom routines for the NDS/GBA, I make changes per line and run through the code line by line in the debugger to see it working and make sure it does what it's supposed to.

[jin299]

I'm in desperate need of some help man, I'm trying to load the the correct data Into the right register for the game, but I what i noticed is that even though register v1 is the correct register that loads the character modifier values, that even by modifying that register to my own values doesn't have any effect on the game?



Now since the player value is stored in register v1, i figured I would start by placing breakpoints on any load instruction that stored the value v1 into another register basically any instruction that starts with the register v1 but, that didn't seem to work I have to admit that I don't really understand what value I'm supposed to be loading into register v1, because I originally tried finding the correct lbu instruction that loads the following values into the register v1 but that didn't seem to work, example I found this load instruction v1, $10 (s2) which I used simply because i couldn't find any ibu instructions that loaded the pointer $2 from s2 into the register v1, so any way I tried changing the instruction ibu v1, $10 (s2) to ori v0, $1B, but that didn't work.

I thought looking at the debugger that we were looking for a pointer that loads $2 from the register s2 and then puts that value into register v1? hence giving us our character modifier address?

[Helder]

I thought I explained everything to you on where to look for the load, you have to scroll up till you see some kind of load into that v1 or some kind of addition that gives the value in v1. When you get a break on write the break occurs AFTER the store so you need to go up in the ASM to look for a load and many times it's rather far up in the ASM and other times it's not. Look at my picture for reference as that has the load instructions and it's not very far away from that store that your break occurred on plus you have to use ori,v1,0,$?? see that zero after v1? that has to be there or it won't load the value, it will simply be added to the existing value in the register if that zero isn't there.

[jin299]

Well then we have a problem because changing that load instruction you previously mentioned to ori v1,0,$1B, the debugger keeps saying unknown command, and if I put or v1,0,$1B the debugger still saids unknown command, and I checked the debugger settings and it's already set to native mips, so I don't know what else I can do?

[Helder]

Manually alter the value with the memory viewer and it will take it. I know you're wondering how will you know what to put there so go download ps2dis and using that you can edit any line in the program to ori v1,0, $1b and it will show you the hex vale to use. Also have you tried older versions of no$psx?