Hacking Sequential codes PSX

[nolberto82]

The write to the address is happening a few instructions back. Scroll up little by little and see if you can see a jump or branch(aka beq, bne etc) to 801010A0.

[jin299]

Sure thing Nolberto I'll post a screenshot for you so that you can see, what I'm on about.

http://tinypic.com/r/azfc44/5

In order to see the screenshot in a bigger size, just click the screenshot, then click raw image in the bottom left hand corner of the screen.

[nolberto82]

Just a quick question before you go, the breakpoint broke on this instruction lw ra, $18 (sp) what would the opposite instruction be to lw, I was thinking sw but I'm unsure?

That's restoring the return address from the stack. You don't want to edit this instruction as it will lead to a crash. Can you post a picture or write the preceding instructions?

[Demonic722]

>what would the opposite instruction be to lw, I was thinking sw but I'm unsure?
Yes, the opposite of lw (load word) would be sw (store word).

[jin299]

Just a quick question before you go, the breakpoint broke on this instruction lw ra, $18 (sp) what would the opposite instruction be to lw, I was thinking sw but I'm unsure?

[Abystus]

Okay I replaced the instruction with nop but for some reason the game froze on me?

I think you should take time to learn the instructions associated with the MIPS language. Without learning what your modifying, you'll never know how to modify it properly. Modifications depend on what length the original instruction was. If you don't modify the whole instruction, or too much the game might freeze. Take the time to learn this before jumping into it, we can only take you so far... and I believe that might be it for me.

[jin299]

Okay I replaced the instruction with nop but for some reason the game froze on me?

[Abystus]

Hey Abystus, one question what instruction do I change it to, so that it gives me infinite lives?

Change it to any instruction that does not decrease your lives? The whole point in modifying it is to not allow it to perform it's original action. Best bet would be to just short nop using a 2400 value, but it's really up to you.

[jin299]

Hey Abystus, one question what instruction do I change it to, so that it gives me infinite lives?

[Abystus]

Right I set a read breakpoint on the address, for infinite lives [801C3370] ?, started up the level, the game constantly broke looked at the registers and it said that register v0/r2 is storing the infinite lives, now what do I do?

Also If you want me to show your a screenshot of the debugger just ask man.

If your lives are displayed on the screen then you will get those constant breaks because the game is updating the counter onscreen (it has to read that address to update the screen). If your wanting to make an infinite lives code, you will need to set a breakpoint for write, die, and the debugger should snap at the code decreasing your lives. From there you would just modify that line of asm to not decrease your lives. Maybe you should start with a simpler system perhaps?

[jin299]

Right I set a read breakpoint on the address, for infinite lives [801C3370] ?, started up the level, the game constantly broke looked at the registers and it said that register v0/r2 is storing the infinite lives, now what do I do?

Also If you want me to show your a screenshot of the debugger just ask man.

[Helder]

Thats not helpful much, looks like its loading data from the stack. What you need to do is set a read breakpoint on the address for lives when you choose a level, you will get many breaks so you have to see which is really loading the value into the registers and then change that. No$psx doesn't have the best "change instruction" feature so I use ps2dis to make a new instruction and manually change the value so the instruction changes to what I want.

[jin299]

Helder I was recently talking to Hacc about the code, another hacker,cool guy, and he replied to back to my message and said the following,

Look at the register that is being written to (it's v0), when the debugger snaps. If you look at the address before the given address in the debugger, it holds the following registers: addu, v0, v0, a0. The "addu" instruction is used for addition. You can modify that to your liking (change it to li v0 which translates to 2402vvvv) to store 9999 into your score. Also, to make things more understandable, put the value of your score into the Windows calculator (convert it from Dec -> Hex). You'll see that it matches the value written in the debugger.

Now I tried myself changing the addu instruction from addu v0 to li v0 9999, but all I keep getting on the debugger is unknown command, why is this happening?

Anyway I have hacked quite a few ram codes for Megaman 8 already, it's a pretty easy game to hack basic codes with anyway, so I want to make an asm code that will give me 5 lives instead of 2, so I set a breakpoint on the infinite lives address, and the debugger broke on these list of instructions.

http://tinypic.com/r/5oyzc7/5

So I looked at the registers and found that v0, r2 registers is storing the lives address, so what instruction do I need to modify so that It will give me 5 lives instead of 2? if I grasp this idea man I have got one foot in the door regarding asm hacking.

[Helder]

Helder can you still create a lot of cool codes with ram hacking, like do you see the point in asm hacking, for creating codes, I think you mentioned before that in your opinion Asm is really only useful for creating health code modfiiers

Of course you can do great codes with RAM but ASM is the ultimate since you can actually change the way the game is programmed but thats something you can learn in time so dont rush it.

[jin299]

Helder can you still create a lot of cool codes with ram hacking, like do you see the point in asm hacking, for creating codes, I think you mentioned before that in your opinion Asm is really only useful for creating health code modfiiers