How to patch PS1 ISO's with ASM codes?

[orcanaoftime]

Here is 100 patches for USA games, all in one file.
Back when the release groups made those, they were for BIN CUE releases.

If you have IMG CCD SUB disc images and the patches do not work, the disc images are easy to convert.
Just mount the disc image with Daemon Tools, and use ImgBurn to made a BIN version.

Thanks for the link Mezmorize, I do have all of those trainers saved from back in the day . When I came across IMG, CCD, SUB type files, I used CDmage to convert to BIN+CUE which worked really well even for files that have more than one .BIN file.

[Mezmorize]

I have used some old trainers from back in the day from Paradox and others on some games too.

Here is 100 patches for USA games, all in one file.
Back when the release groups made those, they were for BIN CUE releases.

If you have IMG CCD SUB disc images and the patches do not work, the disc images are easy to convert.
Just mount the disc image with Daemon Tools, and use ImgBurn to made a BIN version.

[orcanaoftime]

Thanks for the explanation and links Pyriel. If I ever get motivated enough, I'm going to see what I can do. The reason I want to patch games is that I'm using a PS2 with the POPStarter PS1 emulator and I would like to have my games patched with codes. I have used some old trainers from back in the day from Paradox and others on some games too.

[Pyriel]

It all depends on how deeply you want to delve. If you have a code that just modifies lines in an executable file, or overlays bits of data in other files, you can apply that directly to the ISO with a hex editor if you want. For quick and dirty modifications, a 16-byte string of data from an executable is usually enough to get one unique hit in the ISO in a search, and then you can just type over the data. This is a very simple method that doesn't work for many things, but there's very little hassle involved with it.

If you want to get more complex, check around romhacking.net for good information. Kingcom, a poster there, has a tool called "armips" that's pretty useful for patching PSX files.

How you insert modified files into the ISO is a matter of preference or necessity based on what you've done. If you only replace data in the file, you can pretty easily use something like CDMage or a number of other tools to overlay the file in the image. If you have to resize the file for some reason, it gets more complicated. Supposedly CDMage and maybe a couple of other tools can handle the task somewhat properly. The problem is that seeking based on the file system and the table of contents on the disc was egregiously slow on the PSX. Many games seek by LBA (logical block address) instead and use reference tables constructed as the CD was written for that purpose. Those can't be maintained by typical tools like CDMage, and require you to pretty much rebuild the ISO if you move anything. You'll need to keep track of the locations and sizes of all the files in order to update the list. And the list itself might exist in multiple places.

I've got a pretty complex patch setup for Suikoden II that might be helpful if you need to insert codes add custom routines and expand file sizes here. It uses armips to apply most of the actual patches, and LUA scripts + CD Tool to rebuild a patched image from a source ISO. It's a bit of overkill if you just want to plug an infinite ammo code into the PSX EXE, but it gives you a lot of flexibility if you need to modify what you're patching in over time.

[orcanaoftime]

If you can explain how to patch Gameshark codes into PSX games, that would be great

[rimsky82]

The valid range for PSX RAM addresses are 0x80000000 - 0x801FFFFF. So technically, a cheat engine has the high 11 bits to work with, but the gs uses 8. I think the XplorerFX only uses 4.

So yeah, the first 2 digits.

[Mezmorize]

Yeah it's that simple, always remember that the first digit stands for what type of code you have

D??????? Equal to
8??????? 16 bit write
3??????? 8 bit write (thanks lee4)
There are more but these are the basics.

Thanks for the info, but I already knew about the different code types :-)
But isn't the first 2 digits the code type, not just the first?
Like I know there is a D0 and a D1.

I know, I'm just saying that when patching an ISO that the first digit is left out.

When I used PS2Dis, I used the full address including the 8.

The process of patching the ISO's will be very helpful when I get around to updating my PS3 from 3.55 and trying out loading PS1 backups. I won't have to worry about how to load up cheat disc's and such, just load the game and cheat from the get-go ^.^

[Pyriel]

I'm not quite clear on what people are trying to say with the "leave off the first digit from the code" stuff. A PSX executable, an ELF from a PS2, or an EXE from Windows are all structured files. When you open the file in a hex editor it bears no resemblance to how it's mapped into memory. All the header data is there, including file headers, segment headers and tables, etc. The code segment might reliably be located at 0x1000 or something, but even if that's so, it could be mapped to different locations in memory based on the headers. I don't know how much leeway there is with PSX executables, but the load address and entry point can be almost arbitrary on some systems.

When you're talking about an ISO it's even worse. You have the volume descriptors, the table of contents, segment headers, ECC data, and on and on depending on the mode, and how the CD was mastered. The main executable for the game might not even be in the first 100 MB of the ISO, let alone in a location that can be divined from its load address in the PSX's memory.

[lee4]

the 8 in 80040ffc (memory viewer) is hardware mapping, 8 is RAM location

[47iscool]

I think you are confused here

There no codetype involvement needed here

For what is Mez doing patching iso here

I know, I'm just saying that when patching an ISO that the first digit is left out.

[lee4]

Yeah it's that simple, always remember that the first digit stands for what type of code you have

D??????? Equal to
8??????? 16 bit write
3??????? 8 bit write (thanks lee4)
There are more but these are the basics.

I think you are confused here

There no codetype involvement needed here

For what is Mez doing patching iso here

[47iscool]

Hmm, is it really that simple?
I actually went to that location before but it don't show any of the hex sequence there, is that normal?



Above is an image of the hex editor at the address 0x40ffc I see a byte of 0x38 which isn't in the replaced line of coding (3c028007), or in the above (80040ff8) or below (80041000) lines.

Yeah it's that simple, always remember that the first digit stands for what type of code you have

D??????? Equal to
8??????? 16 bit write
3??????? 8 bit write (thanks lee4)
There are more but these are the basics.

[Pyriel]

Yeah, PS2Dis isn't made for patching. Anything it saves will be a disassembly database that includes labels and comments you've added along with the identified types for different segments of data.

What you did with the search string is plenty effective for something this simple. If you want to cut out a step, a 16-bytes search string is usually sufficient to find a single hit in the ISO itself, as long as you're not searching for image or audio data, or anything with a similar tendency towards repetitive values.

[Mezmorize]

Thanks for your help, finally figured it out!

I just went to the address 80040ffc in ps2dis and used the grid at the top to know what sequence to look for in the hex editor.
I still used a hex editor since ps2dis wanted to save as a .pis file type whatever that is.

The highlighted bytes ended up being the correct location:

[lee4]

Hex Editor do not open ELF at correct offset

there some programs on the GH download section, like ELF Mutilator, PS2Dis, ELF Modder.

if you insist using hex editor try search for 0780023c