Hacking Sequential codes PSX

[Helder]

l still don't understand for now I'll just forget about asm, would you call this code an easy one to hack in asm or did I just pick a bad example for an asm code?

That's pretty easy in my opinion, maybe you can go over the things I've written and explained till you get it but if not then stick to the RAM codes.

helder, just a clarification; a Word is 4 bytes length (FFFFFFFF).
Byte: 0-FF (8 bits)
Half: 0-FFFF (16 bits)
Word: 0-FFFFFFFF (32 bits)

regards!

Yes my bad! too late in the day for me ( just got off 12 hour night shift).

[yo_gdg]

lw v1,$144(a1) <-- Load Word (word is 4 hex characters ie FFFF) from Register a1 added to 144 hexadecimal and store into Register v1.

helder, just a clarification; a Word is 4 bytes length (FFFFFFFF).
Byte: 0-FF (8 bits)
Half: 0-FFFF (16 bits)
Word: 0-FFFFFFFF (32 bits)

regards!

[jin299]

l still don't understand for now I'll just forget about asm, would you call this code an easy one to hack in asm or did I just pick a bad example for an asm code?

[Helder]

It means that what ever is at register a2 at that particular time will have that value of 0098967F but after the routines is done it will likely be overwritten with some other data. Registers hold data temporarily for that given routine and this is how you read instructions:

lw v1,$144(a1) <-- Load Word (word is 4byte aka 32bit hex characters ie FFFFFFFF) from Register a1 added to 144 hexadecimal and store into Register v1.

Basically it goes from right to left , and that is a pointer in case you didn't know. A pointer uses a base address stored in a Register in this case a1 and then you add a value $144 in this case as well and you get the address that belongs to a character (your character in this case) so here is a little math for you: Take that address in a1 when you had that break and add 144 hexadecimal and what do you get?..... 801943F4 your characters Score. As you see alot can be learned from observing and making educated guesses to whats happening.



http://logos.cs.uic.edu/366/notes/mi...20tutorial.htm

[jin299]

Okay, so the purpose of a breakpoint is so that the break will direct you to a certain address in the memory, also the registers on the top right Immediately after the first breakpoint looked at the registers at the a2/r6 register and they had the number 0098967F, does this mean that any instruction that starts with a2, will load the value 0098967F into it?

[Helder]

From your post I've come to realize that you have no idea what a breakpoint is. You set a breakpoint on an address so you see what the game is doing when that address is accessed. A breakpoint doesn't change anything all it does it cause the game to stop at that instruction and then you would press F7 to go to the next line that is executed and you will see the changes happen in the registers.

[jin299]

I scrolled up the list like you told me and then went to the instruction lw v0, $144 (a1) broke on it, but it didn't change the score?

I know what your going to say now, and that's give up on asm, but I'm not ready to give up, I'm determined to find this code, even if I have to set a breakpoint on every address after the breakpoint after the first breakpoint I will LOL, regardless of the unforeseeable consequences, that may follow afterwards.

[Helder]

I can't explain it any easier, basically I looked at the line right above the break which is almost always the address that caused the write and thats what it was. The store instruction used a pointer which was something like 144 added to whatever register it was so I scrolled up till I saw a load instruction with the same pointer and register so I set a break on it and guess what I did? It was the whole point I've been trying to hammer into you (Observe whats happening). So observe whats loading and whats adding and what not and make educated guesses on what to change. I broke it down line by line for you in that picture if you can't figure it out from that then I don't think you should be doing ASM.

[jin299]

I've finally got the hang of it now man, thanks for your help, but just out of curiosity what instructions do I need to change in the debugger so that the game gives me 9999 on my score because I'm confused about this part? I don't understand your example you showed me?

[Helder]

I use no$psx for just about everything except when I need to do traces then I use MESS.

[47iscool]

Hey helder, I was just wondering what PSX emulator you use to set breakpoints. I still learning to use nocash psx.

[Helder]

I set the debugger to show Native MIPS and not the no$ cash style, go through the options and look for it. I set my break point with a write condition example: [801943F4] !

[jin299]

Here I uploaded a photo to show exactly what I mean, this Image is screenshot of me starting up the debugger with the game running, notice the way it's said nop on the address that's clicked? to view a larger view of the picture just click the screenshot.

http://tinypic.com/r/5z0fad/5

This picture down below is me typing the addressing in to the goto address box.
http://tinypic.com/r/2ahtgz4/5

The next picture down below Is me putting a breakpoint on the address, notice the way it's saids nop beside the address?
http://tinypic.com/r/2untvdf/5

after I set the breakpoint the game didn't do anything, it didn't break on the address?

[jin299]

There something not right about the addresses I found in the debugger for max score, the instructions in my debugger are different from ones in the screenshot you showed example you showed, all the my register and values are different from what yours are? example in the first address on the debugger your instructions are bne while, mine is jnz,

Also I noticed that when I went to goto to address and typed in the max score address, the address brings to me an nop address for some reason? something not's right? the breakpoint is always on a address that's says nop?

[Helder]

Infinite health and weapons are pretty easy and perhaps health pickups or boss health.