(PSX) PSX 1.13 Save State Hacking

[TiffanyHex]

OS : Windows Xp
PSX game : Twisted Metal 2
Emulator : Psxfin (Psx 1.13)

I saved two states of Twisted Metal 2 in Psxfin. In one state I have 2 special weapons , 4 fire missiles , 3 homing and 1 Napalm and in the other one I have 3 special weapons , 2 fire missiles and 5 homing missiles. I used Hex workshop pro to compare the replacements but could not successful in finding the replacements for weapons or anything else. I had found more than 100 replacement results. Actually I wanted to change the quantity of my fire missile. I request for your experience to solve my problem. Is it good to use Psx emulator save state to perform this kinda task ?

best regards,

[Helder]

PSXfin is a debugger if I'm not mistaken and it would be best to just hack an ASM code which could be patched to the ISO with a little bit of work but could be used as a stand alone code.

[TiffanyHex]

To understand the debugger , I will have to learn basics of ASM first. I am able to change text messages in the game by hacking save game state with the help of Hex Editor. The method your suggested seems accurate , I will give it a try. The good thing is I learned how to work with Hex Editor Workshop.

[Helder]

I can make the code with a short tutorial that you or anyone can use to make similar codes for most games.

[TiffanyHex]

sounds great I can patiently wait for your tutorial. and BTW I can't even figure out how to use Psxfin debugger to save the memory dump.. it asks for "address" and "size". It only saves one line at a time.

[Mezmorize]

I was just wondering if you've tried Cheat Engine yet (or have made basic RAM cheats)?
You definitely want to be pretty proficient with RAM cheats before trying ASM stuff.

[TiffanyHex]

Mezmorize : I have made some Ram cheats by changing the registry of Twisted Metal 2(PC version) save slots. Although I have not performed anything geek yet. I have been trying to hack Psxfin save state but failed every time. Psxfin save state also contains Psx emulator stuffs. I could not differentiate between Psx emulator Memory Dump and Psx Ram Dump.

[Mezmorize]

I made a tutorial long ago that may be somewhat helpful:
http://gamehacking.org/vb/threads/41...g-Cheat-Engine

The reason why it's about re-creating an already known code is to locate the PS1's RAM block inside the computer RAM.
You can at least use the guide to know how to attach Cheat Engine to the process and do basic scans.

Save state hacking is generally harder to do than the basic ram searching.
It's best to do as little as possible between saves.

For example, make the initial save state.
Then without moving, shoot one single missile and make a second state as soon as possible.

[TiffanyHex]

thanks for your tutorial. I am about to try your tutorial and will definitely learn something useful from it.
Edit : Deleted a stupid question as first three lines of your tutorial already answered it. :P

[Helder]

Ok so start up the emulator and load your game and when you get in the game pause it and go to the Debug Menu > Monitor > r3000. In this new window you want to have the Disassembly, Registers, Memory and of course Breakpoints open. Using a ram address from our site we have to give us infinite missiles (801882E8). Now right Click in the breakpoints window and choose Add, in this new window we have to do something very important for this to work we need to change the code 801882E8 to 0x001882E8 or it won't work. After entering the address chose Memory in the top right and check off Write and nothing else and hit ok.

Now when you shoot a missile the debugger freezes and the Disassembly window shows us some instructions but the only thing we need to do without getting to deep into ASM is look for a sub command or in some cases an add command with FFFF which subtracts 1 from the weapons. The address 001046a0 has this instruction so a quick and dirty trick would be to change the FFFF to 0000 or change the instruction value to 2400 which pretty much cancels that whole instruction. So go to the Memory window and press "CTRL & G" to open the "Go To" window and type in 0x001046a0 and there you will see FF FF 63 24. Using the info I showed you change them 00 00 63 24 and delete the breakpoint in the breakpoint window and don't forget to press F9 to resume the game after you get a breakpoint. You will notice that you have infinite ammo for all weapons and even gain one per use. If we change the 63 24 to 00 24 then we will never lose ammo but we also won't gain 1 instead of losing it. This might be alot to take in but it's basically:

1. Find Ram address and replace the 8 in the code with 0x0 and set a Memory Breakpoint on Write.
2. Loose ammo and game freezes, look for a sub or add with FFFF a few lines above where the cursor is in the Disassembly Screen.
3. Goto location that has that sub or add and change the second part (not the FFFF) to 00 24 and Press F9 to resume game.

[TiffanyHex]

Helder : thank you so much. It worked Two best things I learned from your tutorial are :
1. Converting gameshark codes to ram address
2. Uses of break point and memory window.
So far so good. It made my all weapons unlimited not just fire missile. Everything weapon I pick up doesn't go. Maybe using your tutorial ,I can make other things such as making our enemies invulnerable. Bad luck for me, I still failed to hack Psxfin save state as it contains all cd rom information such tim , db , dmd etc files. Although Asm approach is by far better and accurate or the cheat engine approach what Mez suggested.

[47iscool]

removed