Hacking Sequential codes PSX

[jin299]

Thanks for explaining that to me, i really value the help have giving me man.

I'm currently trying to hack an control the computer code for player 1 in the game, so here's what i tried doing to hack the code in the game went into the main menu of the game and waited until Demo mode race appeared I then searched unknown search when in Demo mode and as the computer took control of player 1 in the race, i then exited that mode and went into Arcade mode as player 1 human controlled and when in the the race I searched changed value, then i went back over to demo mode and searched changed value again, I repeated these steps until I narrowed down the search results to the least amount of addresses in the pec cheat search engine.

Eventually I found the ram code for control of the computer for player 1 the ram code was 30098852, and the values where 0001 for the cpu player and the 0000 for human controlled player. So I went into Arcade mode a player 1 to test the code and and noticed that when i inputted the values to play as the computer in the race, Demo mode came up on the screen of the race press any button to exit. which usually signals that the player is being cpu controlled in the race and is in Demo mode. but the problem I'm having is the player 1 is still human controlled in the race, any idea on how I can solve this issue, and make player 1 human controlled while in Arcade mode in the game?

[Helder]

I guess that can assumed to be DMA, but DMA usually either works in one level and not others or works through the whole game until you reset the game and it no longer works. To take care of it with ASM just hack a simple ASM code like you have been doing since the ASM usually affects all these different Modes and Levels but make sure to put some D code type conditional just in case the ASM changes with the games loading.

[jin299]

Helder I heard before that Crash Team Racing uses DMA coding ,can you give me an example on how to defeat the dma using asm hacking
I found a weapon modifier for arcade mode in the game, but noticed that it wouldn't work on most of the other modes of the game, example adventure mode. is that an example of an DMA code in a psx game because if it isn't then I truly misunderstood what DMA exacly means.

[jin299]

will do man. Now there's a code I'm trying to hack for the game , in Adventure you race against a final boss called N. Oxide at the end of this mode, and during the race the cpu uses a combination of different weapons, in which it seems only the bossses in the game can use example during the race against Oxide the cpu can throw tnt's and postions up in the air backwards.

So long story short I hacked the code that controls what boss weapon the cpu uses in the race the problem is It's for the cpu controlled bosses only in the game who happen to always be player 2 in the races in Adventure mode so since adventure mode only a ine player mode the question is how can I find the boss weapon modifier ram address for the human controlled player 1 in adventure mode of the game because I can't copy the values over from player 2 to player 1 because, it's virtually impossile to find the the same code for player 1 because only the cpu player 2 in that mode can use the boss weapon modifier?

Also here's a video clip of cpu boss Oxide in action in adventure mode of the game.
https://www.youtube.com/watch?v=2SE35bpKkKc&app=desktop

[Helder]

There are times that you can't do things with ram hacking therefore ASM is the way to go, why not ask Hacc how he made the code and what he used as the ram address to make the code.

[jin299]

Okay It's just because I was trying to hack a code in the game through ram hacking, that would enable the player to always have his gas meter full giving a the player a turbo speed boost when at the start of a race., now I found the value that controls when the meter is max out, however, it won't function like it normally should the game in the game when it's maxed out it's supposed to give you a turbo boost but all it does is display the gas meter is full instead on the screen for the whole match?

Is it possible that I only found the gas meter display value and not the actual code that controls the action of the code?

Hacc found the code below through asm hacking, but I don't know how to find the code through ram hacking?

P1 Hold X to Max Gas Meter (Race Startup and Landing on Course)
80067F44 1D92
80067F46 0800
80007648 800A
8000764A 3C01
8000764C 900C
8000764E 8C21
80007650 0008
80007652 2402
80007654 0593
80007656 A022
80007658 0008
8000765A 03E0

Never mind I found the code, it took a lot of searching through ram hacking to find the code though.

[Helder]

I remeber hacking something for this but it was likely for the NDS, what about this game? Also I never did any NTSC/PAL codes but Hacc linked some info in a thread recently (2days ago or so).

[jin299]

Helder have you ever hacked any codes for the game Crash Team Racing, for the psx and are you by any chance familiar with hacking the game in general?

[jin299]

Any idea Helder on how a no charge needed ram hack could be hacked For Street Fighter Ex2 Plus?

Because I tried previously hacking the code using increased value and decreased value searches, increased value for when the player is charging and decreased value when standing still, but couldn't find anything, I then tried to find the code using the different to search value method, example when the player was charging I used different to value and when standing still I then used different to value again, but couldn't seem to find any address for the code?

Also any idea on how to hack a hypermode ram hack for the game aka speed everything up code, or a convert Pal to NTSC ram code for the game, Because I don't exactly know how either of these two code are hacked through ram hacking?

[jin299]

Yeah It certainly was the right address all I had to do was change that lw instruction to ori v0, zero, $1D, and it loaded the flag.

Now there something strange that has been happening with the debugger, example If I put a write breakpoint on the ram address 801E669C, and go into to arcade mode and pick a normal character like Ryu for example as player 1 and wait for the stage select screen load, and soon as the debugger breaks on the address, the values in register in v0 it's loading is 20000101 on the first breakpoint, and on the second breakpoint it changes to 60000101 being loaded into register v0 after any reason why this is happening, because I don't understand why this is happening because it should loading the value 0101 into register v0 because that's the value for the human controlled player, but I don't understand why it's loading these two other word long values along with it ?

[Helder]

It might be the correct Load as I don't know much about it till I see it but usually a load and store of any kind uses pointers and you posted a great example up above: lw v0, $2C(a0)

This is saying to put the contents of the address at a0 plus $2C (so add 2C in hex to that address in a0) and put it into v0.

so what I meant is that the constant breaks are loading different addresses which pertain to different things or characters, so I would look at what address is in a0 with the added $2C to it and put a break on that address to see what changes it or that might be a static address which hold the value that loads with Flag Bison II and you can use a simple RAM code to change it.

[jin299]

Okay now i'm confused Helder say i'm trying to load the flag for bison II for player 1 in the game which is 801E669C 001D, i use the memory viewer to help me find and change that instruction in the debugger

Example after breakpointing on the store instruction when I got the a write breakpoint on the ram address 801E669C I scrolled up the debugger line by line and found an lw instruction so I broke on that instruction the reason why I broke on this instruction was because the memory viewer said this this correct address which is 801E669C= 6004001 and 6004001 was the value correct value register loading at the time of the breakpoint, the memory viewer was pointing to the correct address which is 801E669C right so i changed that instruction which was lw v0, $2C(a0) to ori v0, zero, $1D and it loaded flag bison II.

Now here's where i'm confused man is that lw the correct instruction I should of altered or should I of looked for an lbu instruction or another load instruction of some sort instead when tracing up in the debugger, because when i altered that instruction it loaded the correct value?

Also I'm finding the constant breakpoints to be quite confusing?

[Helder]

I have a little free time tomorrow so post all codes you found along with whatever addresses you tried to set breaks on and write some info on each so I have an idea of what's what. I think you altering the V0 is causing issues because more than likely it's breaking a few times right? so that means it's a pointer so you would need to trace up a bit to see the address that loaded that Bison II Flag and Non Flag and manually change that address.

This is where tracing and observing registers comes into play, when the pointer loads that value of Bison and I assume player 2 character there is an address where that value came from and altering the value there will load the value into the registers.

[jin299]

Helder I was talking to Hacc a few hours via a pm, and he suggested me to try the following.

If you got Bison II to work in all modes, and have hit a bump in allowing the continuation of play in Arcade with him, then I'd say there is a way, seeing as you've reached this far on achieving the hack. Based on your issue though, debug the Stage (as in Stage 1, 2, etc; not background modifier address) and round modifier addresses. One of the codes might be causing an issue somewhere. I haven't played the game in a long time (been finishing up other games and projects).

So I attempted to try and do the following.

I put a write breakpoint on the ram code address for the round status modifier which is 801E6671, I then went into arcade mode, and inputted the code to play as non flag Bison II, for player one, I then waited for the stage select loading screen to appear on the screen and as soon as it did it triggered the breakpoint, it broke on the round address multiple times, and each time It did I took note of what what was being loading into the registers, which was register v0.

I then compared the value that was being loaded into register v0, to the value it was loading into register v0 when Flag Bison II came into play, and noticed that the values of the 2 Bisons were different.

So i then changed flag Bison II value in register v0 to non flag Bison II value, but unfortunately all that did was load the same opponent, I had already beaten in stage 1 when controlling him?

Also there's is something that I find strange about how these two Bison's are programmed in the game, example When your playing as non flag Bison II, as player one in arcade mode you, have to fight two rounds of a fight, but when using flag Bison it's always only 1 round for some reason?

Another thing that I found strange about when playing as flag Bison II in the game, is if you input the his ram character modifier value and flag code along with it when using the debugger and then go into Arcade mode with him you can win the match like as if you were playing as non flag Bison in the game, but you still can't continue on through Arcade mode like normal but if you loaded both these codes using a gameshark, the game won't allow you to win a match when using him?

[Helder]

I was thinking of putting a joker on Player 2 health so when it's zero 0000 it will load regular Bison or shut off the flag and put another joker on Player 1 health so when it's full (like beginning of a round) to enable the flag.