INTRO
What Do i Need To Prepare to start Hacking?
Do i need alot of expensive equipment like "Franken
Station!?" No You DONT! Do i have to Download alot of Programs? No You Dont! Do They Require a DVD drive, or is there a cable
like the X- Link that connectes my PS2 to my PC like the cable for N64 and PSX? No they dont, but it would be nice if they
did! Can You Make an Online Hacking FAQ? Yes i can, yes i will, but not now! If that all how do i make Codes?!?!? OK first
things first, You Are goin to need Madd(alot) of patiences, 2nd you are goin to need alot of caffine, i suggest soda(Mountain
Dew, Coke, Orange Slice, Sierra Mist, Blue Pepsi) or Coffee i suggest Ecspresso(Cafe' Bustelo)
=-=-=-=-=-=-=- Extracting
an Elf File -=-=-=-=-=-=-=
Things you need... 1. A DVD Drive on your Computer (PC) 2. The Game 3.
WinRAR
=-=-=-=- How To... -=-=-=-= Open WinRAR in the Search below the Toolbar locate your DVD
Drive Once inside your DVD Drive locate the Elf file ELf?.. Slus/Scus/Sles/slps/pbpx/elf/... Look for any
of those file names Right Click on the file Click "Add To Archive" a new window should pop up in location
click "Browse/Location" Pick your Desktop click OK on the Bottom of the Window click Ok it will Zip Up the
File. Now all you have to do now is email the file to who ever.
-=- FAQ =-= Why WinRAR? WinRAR
has better compress then anything i tried. And it will Zip up pretty much anything to fit into an email!
Why
do you need an Elf File for? Want codes? its the file used to make code, such as EVERYTHING.
What if i dont
have a DVD Drive on my PC? Then my friend your S.O.L! Unless you can go to a friends house and Zip it up. Or You
know someone online who can send the File.
Get hacking!
First something about the structure of the codes. The codes we are talk about are HEX codes (decrypted),
because it?s the original code. If you want to create codes for the AR2, you have to encrypt them, before you can use them,
but if you?re the lucky owner of an XP2, you don?t have to. It works with decrypted and with encrypted codes. How to encrypt
them is explained the Converting-Tutorial. A normal one-rowed HEX code consists of three parts:
?Command? - the
command line of the code ?Address? - it?s where you can find the code and it tells you what the code is doing ?Value/Digit?
- together with the ?Command? it specifies how the code is working
C = Command A = Address D = Digit C
AAAAAAA DDDDDDDD
2 027A569 FFFFFFFF <----- this is a normal HEX/RAW code
There also are some other types
of codes, but for now they aren?t important. (You can find them in the ?Code-Type? guide.) First you have to download
?PS2Dis?, made by Hanimar. You can find it in the ?Tools? section of this website. To create codes, you either have to
own a DVD drive or know someone who does. You have to put the game DVD in the drive and copy the ELF file of the game. That?s
the file where you can find the addresses to create codes. If you and your friends don?t have a DVD drive you have to ask
somebody on the Internet to send you the file (it?s about 3MB).
SLES_###.## SLUS_###.## SCES_###.## SCUS_###.##
SCPS_###.## SLPS_###.## PBPX_###.##
That?s how the files can look like. When you have the file, open
it with PS2Dis. Now you will see a lot of descriptions and numbers. In the very left column there are many numbers
which look a little bit like codes. Those are the addresses of which you will create the codes. They all are in the HEX format.
__________________
Now let?s start creating codes ^^ But something you have to know: creating codes needs
patience and time! But with some practice you will get faster, so don?t worry. There are different ways of creating codes
and the easiest of them I will explain you.
Hacking with Labels:
(That?s
the easiest and fastest method of creating codes.) Labels you can use without problems aren?t in "".
First example
is GTA3 We open the file, start the Invoke Analyzer and look for some useful labels. One of them is the label RespraysAreFree_8CGarages.
We cklick on the label and jump to the address.
Address: 00418490 00000000
The only thing we can do is to try some values out (But don?t change the address!)
00418490 0000000 0 --> nothing happens 00418490 0000000 1 --> Free Resprays 00418490 0000000 2 --> game
freezes
So the code we?re looking for is 00418490 00000001. (And remember: this is a HEX code. It works with the
XP2, but if you use the AR2 you have to encrypt it first.) You ask why the command is 0 and not 1 or 2? That?s what
I?m explain now. The command depends on the value.
If the value is less than or equal 0000 00FF, the command is 0.
If the value is less than or equal 0000 FFFF, the command is 1 If the value is less than or equal FFFF FFFF, the command
is 2.
For better understanding here?s an example:
Tidus MAX HP (FinalFantasyX) We have a working
PAL version code for XP2 from xploder.net and decrypt it.
Tidus MAX HP 1031EAB8 0000FFFF 1031EAC0 0000FFFF
We look on the command of the code. It?s 1, so the value is limited. We know, that the maximum size of the value is
0000 FFFF if the command is 1. We know, that FFFF stands for the decimal digit 65535 (If you don?t know it, use the Calculator).
But in FFX the maximum HP is 99.999.
We want Tidus to have 99.999 HP, so we change the command from 1 to 2. The
maximum value for this command is FFFF FFFF what is decimal 4294967295, so the limit is high enough now. We only have
to convert 99.999 in HEX now (1869F) and put the new value in the codes:
2 031EAB8 000 1869F 2 031EAC0 000 1869F
Don?t forget: the addresses are the same, we only changed the values/digits and the command! That?s all to tell
you about hacking with labels. Here are some labels you could look for in games. Bypass Disable Enable Free
Add Remove Get Activate Apply cheat/ bcheat Display
As an example for hacking with
labels we will take the racing game GTC Africa.(Thanks to Nachbrenner) We first start the "Invoke Analyzer". Now we?re
looking for labels which sound useful for a racing game, e.g. car, lap, track, time, championship, AI and so on. In the
ELF file of GTC Africa we sound an interesting label named CheatUnlockAll.
When we choose the label, we?re jumping the addresses. We double click on the lable.
001aa660:24050001 ,li a1, a1=0x00000001 001aa664:3c010028 ,lui at, at=0x00280000 001aa668:ac25a588 ,sw a1
,[_0027a588] 001aa66c:3c010028 ,lui at, at=0x00280000 001aa670:ac25a594 ,sw a1 , [_0027a594] 001aa674:3c010028
,lui at, at=0x00280000 001aa678:ac25a598 , sw a1 ,[_0027a598]
Now we look to the "sw", 3 times they link
to other Adresses. But how we get the Digit?
Normally Unlock - Codes have the Digit 00000001 so we test this first.
The Codehacker who make this code (Nachbrenner) take the Command "1" and let run the Code in 16 Bits (dont know why he
takes this command cause normally when you dont know in how many bits the address runs you choose the command "2" which runs
the code in the normal 32 Bit but maybe he test it out this way)
So we get these codes: 1 027A588 00000001 1
027A594 00000001 1 027A598 00000001
Try the codes one after another. We find out that the codes are:
Unlock
All Challenges 1027A588 00000001
Unlock All Championships 1027A594 00000001
Unlock All Single Races
1027A598 00000001
In this case we find in PS2Dis what to do with the code and what value it has. But sometimes
we don?t get that much help.
Hacking with Labels in
quotes:
Not every game has labels which even look like codes. Most labels are
in " " and let us jump to a so called byte routine. A byte routine only shows how the name of the label is built and are useless
for us. But we?re lucky to have ps2dis, which helps us out.
Ok... lets take as example the Game "Guilty Gear XX US
- SLPS_251.84" We start "Invoke Analyzer" and look into the Labels. We see some trash in it... but then we find the Label
"Player Load %d %dn" Press Enter and we come to the Address 0030b4c0
ok... now we see where the Label is locatet but this not our real Address... this is just the part where name
of the Label is build. So we press Space Bar + F3. Now ps2dis brings us to address 0010589c
Ok.... now are in the right part. Directly below we see two addresses with the op "lh" (load halfword) which have
a referer. These referers links to other addresses which holds very often the effect we want. So we mark the addess 001058a0
with spacebar and press "right" and come now to the address
Now you should ask you why ps2dis brings you to 00289c50 instead of 002892c52..... this is very easy cause ps2dis
shows us the addresses in 32 Bit which mean that the addresses are always shown in "4" steps (0 -> 4 -> 8 -> C ->
0 ..... ). Ok but how to choose now the right code.... you remember the two Addresses with the op "lh" (Load Halfword)?
This op tell us that the address there runs in 16 Bits (cause the op "word" runs in 32 Bit and the "half" of a "word" is 16
Bits). So what we have to do now?
1.Referer: 00289c50 00289c51
2.Referer: 00289c52 00289c53
Easy we test the code in16 Bits too! For this we need the Command "1" (1 xxxxxxx 0000????). "Player Load" means
that something should be load into the game so it would be not that good when we disable it with "0000". Instead of 0000 we
choose now "0001" and see what happens.....
10289c50 0000001 <--- Play Sol Badguy as Player 1 10289c52 0000001
<--- Play Sol Badguy as Player 2
When we change the value again (0002, 0003 you will get all the players which
are availbel) Cool we have found now our Player Mod :)
Hacking with Strings:
Now we come to an advanced part in the art of Code hacking. The first thing is that you get information about the
game you want to hack. For example with how many Health Points you start with and what is the maximum Number of Health
etc. you can get. This method is dealing with searching for strings/values which are sometimes written into ELF-Files
and not just into the Ram.
Let?s for example take how the FFX-2 PAL Health Code was hacked.
Ok now comes the
part where you have to get information about the game. In FFX-2 your Health is shown as Health Points (HP). The minimum
of HP you can get is 1 HP. The maximum is 9999HP but with a special Item you can get 99999 HP. Let?s see how we can use
this information for hacking a code.
First we load the FFX-2 PAL ELF into a dissembler (in this example I used ps2dis)
and start Invoke Analyzer. Now we start with searching specific strings. We know that the maximum value is 99999 which is
in Hex/Raw 1869F. Now we press Ctrl + F and enable Option "As hex string". When you don?t know exactly how the OP-Code is
build but which value it has in the game we take the last 4 Digits. In this example it is 869F. But if we were to write this
into the Search Box now it will not find the right results. We have to change the Bytes in these 4 Digits: 869F -> 9F86.
If u notice all we did there was put the last 2 digits in front u do this with any hex value when using this method.
So we write 9F86 into the Search option and press ok. The first address where ps2dis brings is 001cf604.
This area with a bunch of Addresses doesn?t look that bad, look at the parts which stands in " ( ) " behind. We see
some values which are often used in this game: "0001869f"; "0000270F"; "000000FF" So we test the addresses in this aria
with different values. But we see it doesn?t change anything or just freeze the game. We may have modified other Options in
the game that we don?t see yet. But ok... we search again..... Press F5 to get the next result of search.
This brings us to the address "001d1564" (Now you can see why we just search for the last 4 Digits.... the op-code
is 34c6869f so if we were to search for 1869f instead of 869f it wound not have shown us this address, and we could have missed
it). So we look into this cluster of Addresses and see that this Address is also not bad. Look at this....
lui
a2, $0001 addiu v1, zero, $270f (shown as li) andi v0, v0, $0001 ori a2, a2, $869f
This is the part where
the where the Health Values are set. lui a2, $0001 and ori a2, a2, $869f belongs together. this means that the value 0001
is stored in the first for Digits of a Value (0001xxxx), ori a2, a2, $869f stores 4 Digits (in this example 869f) in the last
4 Digits of a Value.... means (xxxx869f). We see that all results belongs to Register a2 so the Digits come together and build
the Value 0001869f . addiu v1, zero, $270f means that a value is stored in register v1 (v1 = 0 + 270f). This was just
a little Example which is for us not that really important. Now we came to the boring part..... Testing the Addresses with
different Values...
For example: "201d155c 2403270f" or 201d155c 240300FF or sth, like this... but damn... nothing
seems to work for the described Addresses. Ok but we don?t give up and look to the addresses in this bunch and test them.
So we come to the jal op on address 001d1570. But how to give a jal a constant value... we have to change the op code jal
in something different. We want to store an address so we take the op "addiu". Now we have found a register where we can store
the result, which is not used in this routine btw. Which the game allows us to use that it will not freeze. I choose Register
v0. The op-code should like this addiu v0, zero, $270f ($270f for the value we want to get). Make a double-click on the Address
and type this ( "addiu v0, zero, $270f" ) into the command line. It will give you now the value "2402270f". So we test the
Code 201d1570 2402270f and see it brings us 9999 of Health Points :) Now we have the Code for Health.... Another interesting
thing is below we see the value $03E7 which is the maximum value from MP.... As far as we can tell is that the health code
lies on a jal op we test the next jal too..... We take the same op as before just with the value 03E7 to get the full
999 MP Points.... and after a quick test we see we got all 999 MP-Points...
Ok this was just a little example how
to hack with Strings hopeful it will help you a little bit :)
Joker Commands
Structure of a Joker Command :
Dxxxxxxx 0000 ???? xxxxxxx = Address of Joker Command
???? = Pad
Table Joker Command
Taste |
Normal JC |
Reversed RJC |
Complementary CJC |
Reversed Complementary RCJC |
L3 |
0200 |
0002 |
FDFF |
FFFD |
R3 |
0400 |
0004 |
FBFF |
FFFB |
L2 |
0001 |
0100 |
FFFE |
FEFF |
R2 |
0002 |
0200 |
FFFD |
FDFF |
L1 |
0004 |
0400 |
FFFB |
FBFF |
R1 |
0008 |
0800 |
FFF7 |
F7FF |
Dreieck |
0010 |
1000 |
FFEF |
EFFF |
Kreis |
0020 |
2000 |
FFDF |
DFFF |
X |
0040 |
4000 |
FFBF |
BFFF |
Viereck |
0080 |
8000 |
FF7F |
7FFF |
Select |
0100 |
0001 |
FEFF |
FFFE |
Start |
0800 |
0008 |
F7FF |
FFF7 |
oben |
1000 |
0010 |
EFFF |
FFEF |
rechts |
2000 |
0020 |
DFFF |
FFDF |
unten |
4000 |
0040 |
BFFF |
FFBF |
links |
8000 |
0080 |
7FFF |
FF7F |
Finding Address of Joker Commands: Method 1: Need Labels without " " , e.g. Entrypoint....
if the game dont have it use our "Label Mates" Search for (pad_dma_buf) and add 2. Example: GTC Africa:
just add 2 and we have our Max Reserved Joker! D02DB380 0000???? Note: The same method can you use with
this labels: Pad_DMA_Buffer g_Pad_Dma_Buffer PADD1 Padinfo Pad_rdata1
_____________________
Methode
2: Search for Label ("libpad: buffer addr is not 64 byte align. %08xn" ) Beispiel: Half Life (DE) v1
ps2dis brings us to the Byte - Address of the Label
we mark this address with Space and press F3 (Invoke Analyzer)
From this Address we have to go a few lines above till we come to an Addres like this ( ::FNC_xxxxxxxxx ).
In a ELF-File which have Labels e.g. Entrypoint or by using our Tool "Label Mates" this address is named (scepadportopen)
sein.This Address we also mark with Space and press F3 again.
Now we are near on our Joker Command. From the Addrees which ps2dis brings us (JAL #xxxxxxxx), we have to look (under
and above) for an addiu with the Register a2. We see that this Address links us to a nop which is our Joker Command (sometimes
it dont links to another Address so try the Addiu as the Joker Address). If we are on the nop which is our Joker - Address
just add 2. Joker Command Halflife D03a5402 0000????
To get the Joker Address for Controller 2 just add 100.
Joker Command Halflife Controller 2 D03a5502 0000???? ___________________
Multiple Line Joker Command
Sometimes you have to aktivate more than one line to get the right effect, so we need a special type of Joker Command.
Structure: E0 xx ???? yyyyyyyy x = how many lines you want to aktivate ???? = Pad yyyyyyyy = Address of
Joker Command
Example: Joker Address (Add + 2): 00636782
Health: 201fd648 2402FFFF 201fd64c
2402FFFF 201fd650 2402FFFF
We want to refill our health by pressing R3 R3 = FFFB The Healt Code has 3
Lines so we Take E00"3"
Press R3 to refill Health: E003FFFB 00636782 201fd648 2402FFFF 201fd64c 2402FFFF
201fd650 2402FFFF
Using scePadInfoAct to make a joker. Not all games use this.
Example: The Punisher
001da1ac 0c06e518 jal $001b9460 [scePadInfoAct] 001da1b0 005eb021 addu s6, v0, fp 001da1b4 aec20000 sw v0, $0000(s6)
001da1b8 8ec30000 lw v1, $0000(s6) 001da1bc 18600094 blez v1, $001da410 001da1c0 0003082a slt at, zero, v1 001da1c4
10200024 beq at, zero, $001da258 001da1c8 0000902d daddu s2, zero, zero 001da1cc 3c0201a6 lui v0, $01a6 001da1d0
329000ff andi s0, s4, $00ff 001da1d4 2442e600 addiu v0, v0, $e600 (01a5e600) 001da1d8 005e8821 addu s1, v0,
fp
Reverse Joker Command Pad1 D1A5E602 0000????
Master Codes
First you have to load the ELF-Files from your Game DVD in your ps2dis. Mostly called there as:
SLES_###.##
SLUS_###.## SCES_###.## SCUS_###.## SCPS_###.## SLPS_###.## PBPX_###.##
There are many many
methods to make Mastercodes. First we have to know that there are 2 main Digits/Values for unlock the Mastercode.
(!!!In
Raw/Hex Format!!!)
1. : 0000000E 2. : 000001FD
Important: All Adresses
and Digits/Values you find here are always in Raw/Hex - Format. If you want to use them for e.g. AR2 you have to convert them.
Tutorials for converting Codes are also in the Code Guides Section!
1.Method:
You have to load the
Elf - File in your ps2dis. It brings you to the start Adress. If the game have an Entrypoint, normally it is similar to the
Start Adress. But you can also go the Option "Jump to Labels" and searching for "Entrypoint" (Without " " ).
Now we
have found Entrypoint.......
Entrypoint Adress for this Game is = " 00100008 " (Digit/Value behind this Adress is unimportant for us)
A
normal Mastercode have to start with a "F" in front of the Adress. So we change the First Number ----> = " F 0100008"
.
Now we only have to use only one of the unlock Digits. Mastercode = " F0100008 0000000E " or " F0100008 000001FD
"
Important: Actionreplay/Gameshark doesnt use "Entrypoint" - Enables/ Mastercodes.
Entrypoint is specific for Codebreaker / Xploder!
2. Method: Example: GTC Africa First
we open the Elf - File and go to the Option "Jump to Labels". Now we search for Label "memcpy" (without " ")
Adress =" 0011e620 "
but this is not the Adress we can use for a Mastercode. On the Adress we have to press
Space + F3 to start Invoke Analyzer. The first time pas2dis bring us to Adress = "0011c32c" but this is also not our adress.
We have to press F3 since we have found "scepadread" above or "scepadgetstate" under the "memcpy" Adress.
memcpy Adress for using Mastercode = "00142f8c"
We can use the 2 unlock Digits/Values but
we can make a better Mastercode! We only have to add + 3 to the memcpy Adress ---> 00142f8c + 3 = 00142f8f Now
just change the first number into a "F"
Mastercode (memcpy) = F0142f8c 00142f8f
Note: This type of Mastercodes
Codejunkies use!! You can use this Method with all Cheatdevices!
3. Method: Example: GTC Africa.
By
this Method we put Entrypoint and Memcpy + 3 together. We use entrypoint as the Adress and memcpy + 3 as Value/Digit
Adress
= 00100008 00142f8f
Now we change the first Number into a "F".
Mastercode = F0100008 00142f8f
Note:
This type of Mastercodes use Codebreaker and Xploder but did not work for AR2v2 / GS2v2 cause it use the Entrypoint Enabler.
4. Method: This method you have to use if the ELF-File doesnt have useful Labels. We can use all of
the first 3 Jals starting from Start Adress. This Jals are called Main-Jals. If you have one of this Jals just put one of
the unlock Digits/Values to it (dont forget to change the first number to a "F")
Mastercode "Main-Jal + 0000000E/000001FD
"
Update: How did I find memcpy if it is not in the Labels?
Memcpy is normally under a Adress which
have the Digit "8e060060" So wie go to the Option "find plattern" (make sure that "case as Hex - String" is enabled)
and write 8e060060. But first we have to change 2 * 8 Bytes. --------> 6000068e (a tutorial for this you will
find on the "Pal2Ntsc" Guide)
Example: FFX
002de288 8e060060 lw a2 $0060(s0)----> one line under this Adress
is our mempcy
Mastercode "Mempcy +3 = F02DE28C 002DE28F
Multi-Elf Mastercodes for CB/XP
Example: 007
Agent under Nightfire Multi-Elf Games have more than one Elf-File. You see it if you look on your game DVD and there are
files which have ".elf" on the end of the name.
'007: Agent Under Fire'
We have: Slus_202.65 action
elf driving elf movie elf
We searching for the Adresses of "memcpy" without Add +3
1st elf... Action
Elf 0034539C 0C04EC72
2nd elf... Driving Elf 00277E24 0C090ABB
3rd elf... Movie Elf 00133734 0C049877
OK....now "slus 202.65"!!!! Here we have to add +1 to the Memcpy Adress
01F00008 < Entry Point
01F000CC < Main Jal
"Memcpy" 01F0976C (01F0976B)
Now put Entrypoint and Memcpy + 1 together and
change the first number into a "F"
M Code F1F00008 01F0976B
Now the other Elfs....
F1F00008 01F0976B
0034539C 0C04EC72 < Action elf 00277E24 0C090ABB < Driving elf 00133734 0C049877 < Movie elf
Instead
of a F we change the first Numbers of the Elfs into a 9 ! F1F00008 01F0976B 9034539C 0C04EC72 90277E24 0C090ABB
90133734 0C049877
finisch! If you want you can convert it to Xploder/Codebreaker Format but this Cheatdevices
also uses Raw/Hex - Codes so it doesn`t matter if you convert it or not.
Codebreaker/Xploder FB75206E 31EE003D
9A242B73 18F711F9 9AAC5E06 187B06D5 9ADC4A5F 180EACD0
How did I make an AR2 Multi Elf Mastercode?
007:
Agent Under Fire PAL
You will find: Sles 505.39 Action.elf Driving.elf Movie.elf
AR2 doesnt
use Entrypoint Enablers! wir have to find Memcpy
memcpy JAL = 002783A4 <--- but this is not our Adress for
the Code this is our Digit/Value!
xxxxxxxx 002783A4
To get the Adress we have to Add +1 to the Adress!
002783A5
002783A4
*Multi Elf Mastercodes for AR2 changes the first numer to a 8 instead of a F
802783A5 002783A4
Now
we have to find the other memcpy in the Elf files Action... 00345557 0C04EC80 Driving... 002783A7 0C090C17 Movie...
001380B7 0C04AAD5
now we have: 802783A5 002783A4 < Sles 505.39 00345557 0C04EC80 < Action.elf 002783A7
0C090C17 < Driving.elf 001380B7 0C04AAD5 < Movie.elf
We have to change the Adress with the Digit/Value (at
the other Elf - Files)
0C04EC80 00345557 < Action.elf 0C090C17 002783A7 < Driving.elf 0C04AAD5 001380B7
< Movie.elf
and change the Digit/Value simply with 00000000 0C04EC80 00000000 < Action.elf 0C090C17
00000000 < Driving.elf 0C04AAD5 00000000 < Movie.elf
Now we have our complete AR2 Multi-elf Mastercode in
Raw/Hex - Format 802783A5 002783A4 0C04EC80 00000000 < Action.elf 0C090C17 00000000 < Driving.elf 0C04AAD5
00000000 < Movie.elf
convert to AR2 - Format 7E977325 BCD01E27 CAFA0A7E BCA99B83 CAF5EA97 BCA99B83
CAFA54D5 BCA99B83 but dont forget the Key Code (0E3C7DF2 1853E59E)
Final Master Code 0E3C7DF2 1853E59E
7E977325 BCD01E27 CAFA0A7E BCA99B83 CAF5EA97 BCA99B83 CAFA54D5 BCA99B83
|