Hacking Sequential codes PSX

[jin299]

Helder apart from the two asm codes i originally found, and the music modifier ram code which loads the six character tracks in arcade mode, I don't really know where else to look, because so far I have tried debugging the stage modifier address, player 1 and player 2's character modifier, but didn't find anything interesting, I even scrolled up the debugger line by line noting any conditional jumps along the way that might give me what i'm looking for but came up with nothing in the end?

Also there's seems to be a bug in the debugger I'm using i noticed that whenever I place a breakpoint on an address in the game, just before I get the initial break, that I have to click the somewhere on the debugger screen of the emulator so that It breaks on the intended address I wanted it to originally break on, any reason why this bug happens with the emulator?

[Helder]

A read breakpoint is useful to know when the address is being read or loaded a value to, after you see the load it almost always has a massive set of instructions following it and it usually stores the value of the address into some temporary ram location to load again. On other occasions you get multiple routines loading the value and each one has it's own purpose and it's our job to find out what that is. A read breakpoint is useful in knowing where it stores the value in the temporary Ram location so we can alter that location with a Ram code or alter where it stores it.

The game loads the second character's music because you aren't freezing that ASM instruction, more than likely you changed it to whatever and after the fight that ASM gets reset to it's default. So try using PEC or Artmoney or whatever to keep the ASM code you made always constant and see how that works.

I've mentioned this before that I assume from observation that the music is tied into the Fighter that you're facing and also assume it loads a set of characters to fight which has a certain amount of tracks to play. You say that changing the character or stage makes it play the music you want then you're almost there as there must also be another routine or value loaded with the character or stage that triggers the music played. Keep going through those routines to see what you're missing to load the music, I'm sure you'll get something.

[jin299]

I understand, if only all games where programmed the same, then it would make it a whole lot easier to hack a game.

Now there's something confusing me about breakpoints is this a read/ write breakpoint ?!! or is it this ?! because I can't seem to follow the correct breakpoint format in the debugger

Also when the registers are changing during a read breakpoint, how do you know when exactly to modify a register that storing the correct value, do you do it after the first read breakpoint of do you do it on the last?

Also I found something strange when experimenting with the debugger, I placed a write breakpoint on player 2 character modifier in the game, then changed a register which, basically allows me me to load player 1 character music when choosing him in arcade mode for player 1, example say i wanted Ryu's music to play in arcade mode for player 1 then all i have to do is pick Ryu and it plays his music anytime I fight with him in a fight instead of playing the opponent, theme music, for one fight only then the opponents music plays like normal in a stage 2 again for some reason, would nopping the address fix the problem?

I also found an ASM code with the stage modifier address code for the arcade mode in game, that allows player 1 to play in his own stage in a fight, as oppose to the opponents. example if I pick Bison as player 1 in arcade mode well then it loads his stage in the fight instead of the opponents, pretty cool huh lol.

So do you think these two codes i found are the correct codes used in loading the music and stage fight in the game?

[Helder]

Hacking Ram is always an assumption of what we perceive the game is doing and as you have seen it isn't always what we assume it is. Basically you just figure a strategy of how you think the game is working and try to find the code that way, if you get shit then you think of a different method. A great example is a timer code where in many games it either goes up when it's counting up and down when it's counting down, BUT on occasion I have run into the timer doing the opposite (up is down and down is up) so don't always assume but theorize.

The ori command will always put the value (half word/16bits) into the register you specify BUT you have to have that 0 (zero) in the instruction otherwise it will add you value to the existing value in the register. You get freezes because it might have been the wrong register you modified, or there was some instructions that required the original pointer in that instruction you replaced with the ori to have a certain value and you forcing you value caused a crash.

Pointers such as the loads or stores that we altered in the last few pages are fine to mod since it mainly affects the Player but there are times (may times) in which the pointer is used for many things besides the Player, and if the value is something that the following instructions require to have loaded correctly the game crashes. (Holy Run On Sentence Batman!)

[jin299]

Helder can I use the ori command to load whatever byte or half word I want to into a register in the debugger, because many times I have done this I found I have ended up freezing the game in the process?

Also I have found that when searching for a ram code through ram hacking the game, it sometimes isn't always as easy as I had anticipated it would be.

Example I was trying to hack color fireball modifier code for the game, Street Fighter Alpha 3 and noticed that whenever I tried hacking the code and used the unchanged value scan to narrow down the address results, that using this method actually eliminated the code address from the list, simply because the value for each fireball executed by each player in the game stays the same all the time, so by actually searching changed value say when using changed value when switching from say Ryu fireball in the game to Ken's actually results in making an horrendous error resulting in not being able to find the code.

It's little trip ups like this or false assumptions about how a game is programmed that determines if hacking an code is possible or impossible to hack in a game, I was always under the impression that values in games always change and never stay the same, but then again I'm still learning the programming of games, and it seems to vary quite a bit from game to game.

I was trying my luck to recreate and find the hit anywhere code for the game, so I put a breakpoint on player 2 health address, then scrolled up the debugger and nopped A beq instruction, and found i could hit the opponent anywhere on the screen but i found that the hacker who hacked the code Codemaster had to backtrace quite far up in the debugger to find the code, so I was just wondering how exactly was this code traced without a tracer, how do you swing from branch to branch when tracing up in the debugger, do you put a breakpoint on beq or jai instruction?

[Helder]

Hey I wouldn't think ill of you if you decided to do a Sega Saturn Debugger *hint* *hint*.

[Parasyte]

My goodness, I love me some debuggers.

Sorry for derailing the thread. I just had to say that. I love them so much, I'm building more...

[jin299]

Okay thanks man for having a look into the hack for me, so i guess all i can do now is keep on trying to find the code then, oh and the reason why I not posted any pictures showing my current progress on the hack using the the debugger, is because I was afraid that you and the other game hackers wouldn't help me out, if I asked you guys but now I know that isn't the case at all, and I will continue to post pictures illustrating my hacking attempts and progress for you and the other's to see on the site.

[Helder]

I already took a look at it and didn't find anything useful and when you say help you find the ASM you mean do it for you and like I said I already tried and I don't really care enough about this code to warrant my time (which is bound to be a lot of time). Keep trying and post pictures of whatever you're trying or having some trouble with and we can help but to do it for you is not what I really want to do. Oh and yes alot of the good codes we want to make require ASM for the most part but you can get away with alot of codes with RAM just not super complex codes.

[jin299]

Helder I'm starting to realize that many of the new codes I want to hack for Street Fighter games or any game for that matter, require asm hacking to a large extend, would you be interested in helping me find the ASM address in the debugger that loads the music of a fighter in Street Fighter Alpha 3?

I know it's a big ask, but i feel this code might not be as complicated to find as we once thought, the reason why I'm saying this is because, I'm assume that the instruction that controls the music, isn't to far away from the address of the initial breakpoint of the address 8019ED9D in the debugger, what do you think?

[jin299]

I understand thanks for pointing that out to me man, also any idea why the offsets on the pec are are not accurate,when hacking codes?

Helder I was playing around trying to hack some new codes for MegaMan 8 and found the speed modifier code for MegaMan, however the code I found seems quite buggy, and doesn't actual execute correctly in the game like a speed modifier is normally supposed to, I take it this dues to how the games was originally programmed. here's the ram code anyway 8015E23E 0102.

And as usual your always a step ahead of me in the hacking field man you have accomplished so much in asm hacking and ram hacking alone, and that's something I truly admire about you. as for myself I have already come to the conclusion and have acknowledged that gaining skills and experience in hacking game codes doesn't automatically come over night, you have to learn dedicate yourself to it and try and understand to try and grasp an understanding of the programming behind how exactly that code and any other for that matter is hacked, and this process can take an extensively long amount of time to grasp correctly.

If only we had some sort of visual insight into a game was programmed, it would make the process of hacking codes that much easier, but there isn't.

So by dedicating myself to learning more about how games are programmed, I'm certain that I to will be able to hopefully some day will be able to discover and create my own game hacks for a game in time man so that I can share them with everyone, like how you and all the other dedicated game hackers on this site can do.

[lee4]

lee4 that disable character animation intro code is buggy and doesn't work fully, but i managed to find the real address for the code it effects both players. simultaneously here's the code it's for the NTSC version of the game 80198CC7 3A69.

80198CC7 3A69 code is misaligned
properly write is this 80198CC6 3A69

halfword (XXXX) value must always write on even address (last digit of address must end with 0, 2, 4, 6, 8, A, C, E)

[jin299]

lee4 that disable character animation intro code is buggy and doesn't work fully, but i managed to find the real address for the code it effects both players. simultaneously here's the code it's for the NTSC version of the game 80198CC7 3A69.

[lee4]

Hey all I found the address that controls the disabling of whether or not a player preforms his/her character animation intro's the before the fight starts for both players in Street Fighter Alpha 3, here it is. player 1 80198C86 000? player 2 80198C85 000?

Value FF is for allowing the players to perform there character animation intro, and value 0 is for disabling both characters animation intro's sequences before the fight, and will allow both players to fight immediately as soon as the fight starts, without any countdown

this address controls of controllers enabling

80198C86 00??
00= controllers enabed
FF= controllers disabled

[jin299]

Okay I get what your saying now man, so we need to modify this previous asm address in the debugger and if so what do we need to alter it to? 801BEA14 90820006 lbu v0 ,$6(a0)