Make your own free website on Tripod.com

3219b400.jpg

PS2 Code Hacking Tutorials
Home | T.H.A.W Untested Code Vault | Clan | Python | Downloads | PS2 Code Hacking Tutorials | Pictures | How to become a hacker | THAW Codes | Links | Contacts | DOS

PS2DIS Hacking tutorial

INTRO
 
What Do i Need To Prepare to start Hacking?

Do i need alot of expensive equipment like "Franken Station!?" No You DONT! Do i have to Download alot of Programs? No You Dont! Do They Require a DVD drive, or is there a cable like the X- Link that connectes my PS2 to my PC like the cable for N64 and PSX? No they dont, but it would be nice if they did! Can You Make an Online Hacking FAQ? Yes i can, yes i will, but not now! If that all how do i make Codes?!?!? OK first things first, You Are goin to need Madd(alot) of patiences, 2nd you are goin to need alot of caffine, i suggest soda(Mountain Dew, Coke, Orange Slice, Sierra Mist, Blue Pepsi) or Coffee i suggest Ecspresso(Cafe' Bustelo)

=-=-=-=-=-=-=-
Extracting an Elf File
-=-=-=-=-=-=-=

Things you need...
1. A DVD Drive on your Computer (PC)
2. The Game
3. WinRAR

=-=-=-=-
How To...
-=-=-=-=
Open WinRAR
in the Search below the Toolbar
locate your DVD Drive
Once inside your DVD Drive
locate the Elf file
ELf?.. Slus/Scus/Sles/slps/pbpx/elf/...
Look for any of those file names
Right Click on the file
Click "Add To Archive"
a new window should pop up
in location click "Browse/Location"
Pick your Desktop
click OK
on the Bottom of the Window click Ok
it will Zip Up the File.
Now all you have to do now is email the
file to who ever.


-=-
FAQ
=-=
Why WinRAR?
WinRAR has better compress then anything i tried.
And it will Zip up pretty much anything to fit
into an email!

Why do you need an Elf File for?
Want codes? its the file used to make code,
such as EVERYTHING.

What if i dont have a DVD Drive on my PC?
Then my friend your S.O.L! Unless you can
go to a friends house and Zip it up. Or
You know someone online who can send the
File.

Get hacking!

First something about the structure of the codes. The codes we are talk about are HEX codes (decrypted), because it?s the original code. If you want to create codes for the AR2, you have to encrypt them, before you can use them, but if you?re the lucky owner of an XP2, you don?t have to. It works with decrypted and with encrypted codes. How to encrypt them is explained the Converting-Tutorial.
A normal one-rowed HEX code consists of three parts:

?Command? - the command line of the code
?Address? - it?s where you can find the code and it tells you what the code is doing
?Value/Digit? - together with the ?Command? it specifies how the code is working

C = Command
A = Address
D = Digit
C AAAAAAA DDDDDDDD

2 027A569 FFFFFFFF <----- this is a normal HEX/RAW code

There also are some other types of codes, but for now they aren?t important. (You can find them in the ?Code-Type? guide.)
First you have to download ?PS2Dis?, made by Hanimar. You can find it in the ?Tools? section of this website.
To create codes, you either have to own a DVD drive or know someone who does. You have to put the game DVD in the drive and copy the ELF file of the game. That?s the file where you can find the addresses to create codes. If you and your friends don?t have a DVD drive you have to ask somebody on the Internet to send you the file (it?s about 3MB).

SLES_###.##
SLUS_###.##
SCES_###.##
SCUS_###.##
SCPS_###.##
SLPS_###.##
PBPX_###.##

That?s how the files can look like.
When you have the file, open it with PS2Dis. Now you will see a lot of descriptions and numbers. In the very left column there are many numbers which look a little bit like codes. Those are the addresses of which you will create the codes. They all are in the HEX format.

__________________

Now let?s start creating codes ^^
But something you have to know: creating codes needs patience and time! But with some practice you will get faster, so don?t worry.
There are different ways of creating codes and the easiest of them I will explain you.

Hacking with Labels:

(That?s the easiest and fastest method of creating codes.)
Labels you can use without problems aren?t in "".

First example is GTA3
We open the file, start the Invoke Analyzer and look for some useful labels.
One of them is the label RespraysAreFree_8CGarages.
We cklick on the label and jump to the address.



Address: 00418490 00000000

The only thing we can do is to try some values out (But don?t change the address!)
00418490 0000000 0 --> nothing happens
00418490 0000000 1 --> Free Resprays
00418490 0000000 2 --> game freezes

So the code we?re looking for is 00418490 00000001.
(And remember: this is a HEX code. It works with the XP2, but if you use the AR2 you have to encrypt it first.)
You ask why the command is 0 and not 1 or 2?
That?s what I?m explain now. The command depends on the value.

If the value is less than or equal 0000 00FF, the command is 0.
If the value is less than or equal 0000 FFFF, the command is 1
If the value is less than or equal FFFF FFFF, the command is 2.

For better understanding here?s an example:

Tidus MAX HP (FinalFantasyX)
We have a working PAL version code for XP2 from xploder.net and decrypt it.

Tidus MAX HP
1031EAB8 0000FFFF
1031EAC0 0000FFFF

We look on the command of the code. It?s 1, so the value is limited. We know, that the maximum size of the value is 0000 FFFF if the command is 1. We know, that FFFF stands for the decimal digit 65535 (If you don?t know it, use the Calculator). But in FFX the maximum HP is 99.999.

We want Tidus to have 99.999 HP, so we change the command from 1 to 2.
The maximum value for this command is FFFF FFFF what is decimal 4294967295, so the limit is high enough now.
We only have to convert 99.999 in HEX now (1869F) and put the new value in the codes:

2 031EAB8 000 1869F
2 031EAC0 000 1869F

Don?t forget: the addresses are the same, we only changed the values/digits and the command!
That?s all to tell you about hacking with labels. Here are some labels you could look for in games.
Bypass
Disable
Enable
Free
Add
Remove
Get
Activate
Apply
cheat/ bcheat
Display


As an example for hacking with labels we will take the racing game GTC Africa.(Thanks to Nachbrenner)
We first start the "Invoke Analyzer". Now we?re looking for labels which sound useful for a racing game, e.g. car, lap, track, time, championship, AI and so on.
In the ELF file of GTC Africa we sound an interesting label named CheatUnlockAll.



When we choose the label, we?re jumping the addresses.
We double click on the lable.



001aa660:24050001 ,li a1, a1=0x00000001
001aa664:3c010028 ,lui at, at=0x00280000
001aa668:ac25a588 ,sw a1 ,[_0027a588]
001aa66c:3c010028 ,lui at, at=0x00280000
001aa670:ac25a594 ,sw a1 , [_0027a594]
001aa674:3c010028 ,lui at, at=0x00280000
001aa678:ac25a598 , sw a1 ,[_0027a598]

Now we look to the "sw", 3 times they link to other Adresses. But how we get the Digit?

Normally Unlock - Codes have the Digit 00000001 so we test this first.
The Codehacker who make this code (Nachbrenner) take the Command "1" and let run the Code in 16 Bits (dont know why he takes this command cause normally when you dont know in how many bits the address runs you choose the command "2" which runs the code in the normal 32 Bit but maybe he test it out this way)

So we get these codes:
1 027A588 00000001
1 027A594 00000001
1 027A598 00000001

Try the codes one after another. We find out that the codes are:

Unlock All Challenges
1027A588 00000001

Unlock All Championships
1027A594 00000001

Unlock All Single Races
1027A598 00000001

In this case we find in PS2Dis what to do with the code and what value it has. But sometimes we don?t get that much help.


Hacking with Labels in quotes:


Not every game has labels which even look like codes. Most labels are in " " and let us jump to a so called byte routine. A byte routine only shows how the name of the label is built and are useless for us. But we?re lucky to have ps2dis, which helps us out.

Ok... lets take as example the Game "Guilty Gear XX US - SLPS_251.84"
We start "Invoke Analyzer" and look into the Labels. We see some trash in it... but then we find the Label "Player Load %d %dn"
Press Enter and we come to the Address 0030b4c0



ok... now we see where the Label is locatet but this not our real Address...
this is just the part where name of the Label is build.
So we press Space Bar + F3. Now ps2dis brings us to address 0010589c



Ok.... now are in the right part. Directly below we see two addresses with the op "lh" (load halfword) which have a referer.
These referers links to other addresses which holds very often the effect we want. So we mark the addess 001058a0 with
spacebar and press "right" and come now to the address



Now you should ask you why ps2dis brings you to 00289c50 instead of 002892c52..... this is very easy cause ps2dis shows us the addresses in 32 Bit which mean that the addresses are always shown in "4" steps (0 -> 4 -> 8 -> C -> 0 ..... ).
Ok but how to choose now the right code.... you remember the two Addresses with the op "lh" (Load Halfword)? This op tell us that the address there runs in 16 Bits (cause the op "word" runs in 32 Bit and the "half" of a "word" is 16 Bits). So what we have to do now?

1.Referer:
00289c50
00289c51

2.Referer:
00289c52
00289c53

Easy we test the code in16 Bits too! For this we need the Command "1" (1 xxxxxxx 0000????).
"Player Load" means that something should be load into the game so it would be not that good when we disable it with "0000". Instead of 0000 we choose now "0001" and see what happens.....

10289c50 0000001 <--- Play Sol Badguy as Player 1
10289c52 0000001 <--- Play Sol Badguy as Player 2

When we change the value again (0002, 0003 you will get all the players which are availbel)
Cool we have found now our Player Mod :)

Hacking with Strings:

Now we come to an advanced part in the art of Code hacking. The first thing is that you get information about the game you want to hack.
For example with how many Health Points you start with and what is the maximum Number of Health etc. you can get.
This method is dealing with searching for strings/values which are sometimes written into ELF-Files and not just into the Ram.

Let?s for example take how the FFX-2 PAL Health Code was hacked.

Ok now comes the part where you have to get information about the game.
In FFX-2 your Health is shown as Health Points (HP). The minimum of HP you can get is 1 HP. The maximum is 9999HP but with a special Item you can get 99999 HP.
Let?s see how we can use this information for hacking a code.

First we load the FFX-2 PAL ELF into a dissembler (in this example I used ps2dis) and start Invoke Analyzer. Now we start with searching specific strings. We know that the maximum value is 99999 which is in Hex/Raw 1869F. Now we press Ctrl + F and enable Option "As hex string". When you don?t know exactly how the OP-Code is build but which value it has in the game we take the last 4 Digits. In this example it is 869F. But if we were to write this into the Search Box now it will not find the right results. We have to change the Bytes in these 4 Digits: 869F -> 9F86. If u notice all we did there was put the last 2 digits in front u do this with any hex value when using this method.



So we write 9F86 into the Search option and press ok. The first address where ps2dis brings is 001cf604.



This area with a bunch of Addresses doesn?t look that bad, look at the parts which stands in " ( ) " behind. We see some values which are often used in this game: "0001869f"; "0000270F"; "000000FF"
So we test the addresses in this aria with different values. But we see it doesn?t change anything or just freeze the game. We may have modified other Options in the game that we don?t see yet. But ok... we search again..... Press F5 to get the next result of search.



This brings us to the address "001d1564" (Now you can see why we just search for the last 4 Digits.... the op-code is 34c6869f so if we were to search for 1869f instead of 869f it wound not have shown us this address, and we could have missed it).
So we look into this cluster of Addresses and see that this Address is also not bad. Look at this....

lui a2, $0001
addiu v1, zero, $270f (shown as li)
andi v0, v0, $0001
ori a2, a2, $869f

This is the part where the where the Health Values are set.
lui a2, $0001 and ori a2, a2, $869f belongs together. this means that the value 0001 is stored in the first for Digits of a Value (0001xxxx), ori a2, a2, $869f stores 4 Digits (in this example 869f) in the last 4 Digits of a Value.... means (xxxx869f). We see that all results belongs to Register a2 so the Digits come together and build the Value 0001869f .
addiu v1, zero, $270f means that a value is stored in register v1 (v1 = 0 + 270f).
This was just a little Example which is for us not that really important. Now we came to the boring part..... Testing the Addresses with different Values...

For example:
"201d155c 2403270f" or 201d155c 240300FF or sth, like this... but damn... nothing seems to work for the described Addresses. Ok but we don?t give up and look to the addresses in this bunch and test them. So we come to the jal op on address 001d1570. But how to give a jal a constant value... we have to change the op code jal in something different. We want to store an address so we take the op "addiu". Now we have found a register where we can store the result, which is not used in this routine btw. Which the game allows us to use that it will not freeze. I choose Register v0. The op-code should like this addiu v0, zero, $270f ($270f for the value we want to get). Make a double-click on the Address and type this ( "addiu v0, zero, $270f" ) into the command line. It will give you now the value "2402270f". So we test the Code 201d1570 2402270f and see it brings us 9999 of Health Points :)
Now we have the Code for Health.... Another interesting thing is below we see the value $03E7 which is the maximum value from MP.... As far as we can tell is that the health code lies on a jal op we test the next jal too.....
We take the same op as before just with the value 03E7 to get the full 999 MP Points.... and after a quick test we see we got all 999 MP-Points...

Ok this was just a little example how to hack with Strings hopeful it will help you a little bit :)

Joker Commands

Structure of a Joker Command :

Dxxxxxxx 0000 ????
xxxxxxx = Address of Joker Command
???? = Pad

Table Joker Command

Taste Normal
JC
Reversed
RJC
Complementary
CJC
Reversed Complementary
RCJC
L3 0200 0002 FDFF FFFD
R3 0400 0004 FBFF FFFB
L2 0001 0100 FFFE FEFF
R2 0002 0200 FFFD FDFF
L1 0004 0400 FFFB FBFF
R1 0008 0800 FFF7 F7FF
Dreieck 0010 1000 FFEF EFFF
Kreis 0020 2000 FFDF DFFF
X 0040 4000 FFBF BFFF
Viereck 0080 8000 FF7F 7FFF
Select 0100 0001 FEFF FFFE
Start 0800 0008 F7FF FFF7
oben 1000 0010 EFFF FFEF
rechts 2000 0020 DFFF FFDF
unten 4000 0040 BFFF FFBF
links 8000 0080 7FFF FF7F

 

Finding Address of Joker Commands:
Method 1:
Need Labels without " " , e.g. Entrypoint.... if the game dont have it use our "Label Mates"
Search for (pad_dma_buf) and add 2.
Example: GTC Africa:



just add 2 and we have our Max Reserved Joker!
D02DB380 0000????
Note:
The same method can you use with this labels:
Pad_DMA_Buffer
g_Pad_Dma_Buffer
PADD1
Padinfo
Pad_rdata1

_____________________

Methode 2:
Search for Label ("libpad: buffer addr is not 64 byte align. %08xn" )
Beispiel: Half Life (DE) v1



ps2dis brings us to the Byte - Address of the Label



we mark this address with Space and press F3 (Invoke Analyzer)



From this Address we have to go a few lines above till we come to an Addres like this ( ::FNC_xxxxxxxxx ). In a ELF-File which have Labels e.g. Entrypoint or by using our Tool "Label Mates" this address is named (scepadportopen) sein.This Address we also mark with Space and press F3 again.



Now we are near on our Joker Command. From the Addrees which ps2dis brings us (JAL #xxxxxxxx), we have to look (under and above) for an addiu with the Register a2.
We see that this Address links us to a nop which is our Joker Command (sometimes it dont links to another Address so try the Addiu as the Joker Address).
If we are on the nop which is our Joker - Address just add 2.
Joker Command Halflife
D03a5402 0000????

To get the Joker Address for Controller 2 just add 100.
Joker Command Halflife Controller 2
D03a5502 0000????
___________________

Multiple Line Joker Command
Sometimes you have to aktivate more than one line to get the right effect, so we need a special type of Joker Command.
Structure:
E0 xx ???? yyyyyyyy
x = how many lines you want to aktivate
???? = Pad
yyyyyyyy = Address of Joker Command

Example:
Joker Address (Add + 2):
00636782

Health:
201fd648 2402FFFF
201fd64c 2402FFFF
201fd650 2402FFFF

We want to refill our health by pressing R3
R3 = FFFB
The Healt Code has 3 Lines so we Take E00"3"

Press R3 to refill Health:
E003FFFB 00636782
201fd648 2402FFFF
201fd64c 2402FFFF
201fd650 2402FFFF

Using scePadInfoAct to make a joker. Not all games use this.

Example: The Punisher
001da1ac 0c06e518 jal $001b9460 [scePadInfoAct]
001da1b0 005eb021 addu s6, v0, fp
001da1b4 aec20000 sw v0, $0000(s6)
001da1b8 8ec30000 lw v1, $0000(s6)
001da1bc 18600094 blez v1, $001da410
001da1c0 0003082a slt at, zero, v1
001da1c4 10200024 beq at, zero, $001da258
001da1c8 0000902d daddu s2, zero, zero
001da1cc 3c0201a6 lui v0, $01a6
001da1d0 329000ff andi s0, s4, $00ff
001da1d4 2442e600 addiu v0, v0, $e600 (01a5e600)
001da1d8 005e8821 addu s1, v0, fp

Reverse Joker Command Pad1
D1A5E602 0000????

Master Codes

First you have to load the ELF-Files from your Game DVD in your ps2dis. Mostly called there as:

SLES_###.##
SLUS_###.##
SCES_###.##
SCUS_###.##
SCPS_###.##
SLPS_###.##
PBPX_###.##

There are many many methods to make Mastercodes.
First we have to know that there are 2 main Digits/Values for unlock the Mastercode.

(!!!In Raw/Hex Format!!!)

1. : 0000000E
2. : 000001FD


Important: All Adresses and Digits/Values you find here are always in Raw/Hex - Format. If you want to use them for e.g. AR2 you have to convert them. Tutorials for converting Codes are also in the Code Guides Section!

1.Method:

You have to load the Elf - File in your ps2dis. It brings you to the start Adress. If the game have an Entrypoint, normally it is similar to the Start Adress. But you can also go the Option "Jump to Labels" and searching for "Entrypoint" (Without " " ).

Now we have found Entrypoint.......




Entrypoint Adress for this Game is = " 00100008 " (Digit/Value behind this Adress is unimportant for us)

A normal Mastercode have to start with a "F" in front of the Adress. So we change the First Number ----> = " F 0100008" .

Now we only have to use only one of the unlock Digits.
Mastercode = " F0100008 0000000E " or " F0100008 000001FD "

Important:
Actionreplay/Gameshark doesnt use "Entrypoint" - Enables/ Mastercodes. Entrypoint is specific for Codebreaker / Xploder!




2. Method:
Example: GTC Africa
First we open the Elf - File and go to the Option "Jump to Labels". Now we search for Label "memcpy" (without " ")





Adress =" 0011e620 "

but this is not the Adress we can use for a Mastercode. On the Adress we have to press Space + F3 to start Invoke Analyzer. The first time pas2dis bring us to Adress = "0011c32c" but this is also not our adress. We have to press F3 since we have found "scepadread" above or "scepadgetstate" under the "memcpy" Adress.
 
memcpy Adress for using Mastercode = "00142f8c"

We can use the 2 unlock Digits/Values but we can make a better Mastercode! We only have to add + 3 to the memcpy Adress ---> 00142f8c + 3 = 00142f8f
Now just change the first number into a "F"

Mastercode (memcpy) = F0142f8c 00142f8f

Note: This type of Mastercodes Codejunkies use!! You can use this Method with all Cheatdevices!


3. Method:
Example: GTC Africa.

By this Method we put Entrypoint and Memcpy + 3 together. We use entrypoint as the Adress and memcpy + 3 as Value/Digit

Adress = 00100008 00142f8f

Now we change the first Number into a "F".

Mastercode = F0100008 00142f8f

Note: This type of Mastercodes use Codebreaker and Xploder but did not work for AR2v2 / GS2v2 cause it use the Entrypoint Enabler.

4. Method:
This method you have to use if the ELF-File doesnt have useful Labels.
We can use all of the first 3 Jals starting from Start Adress. This Jals are called Main-Jals. If you have one of this Jals just put one of the unlock Digits/Values to it (dont forget to change the first number to a "F")

Mastercode
"Main-Jal + 0000000E/000001FD "

Update:
How did I find memcpy if it is not in the Labels?

Memcpy is normally under a Adress which have the Digit "8e060060"
So wie go to the Option "find plattern" (make sure that "case as Hex - String" is enabled) and write 8e060060. But first we have to change 2 * 8 Bytes.
--------> 6000068e (a tutorial for this you will find on the "Pal2Ntsc" Guide)

Example: FFX

002de288 8e060060 lw a2 $0060(s0)----> one line under this Adress is our mempcy

Mastercode "Mempcy +3 = F02DE28C 002DE28F

Multi-Elf Mastercodes for CB/XP

Example: 007 Agent under Nightfire
Multi-Elf Games have more than one Elf-File. You see it if you look on your game DVD and there are files which have ".elf" on the end of the name.

'007: Agent Under Fire'

We have:
Slus_202.65
action elf
driving elf
movie elf

We searching for the Adresses of "memcpy" without Add +3

1st elf... Action Elf
0034539C 0C04EC72

2nd elf... Driving Elf
00277E24 0C090ABB

3rd elf... Movie Elf
00133734 0C049877


OK....now "slus 202.65"!!!!
Here we have to add +1 to the Memcpy Adress

01F00008 < Entry Point
01F000CC < Main Jal

"Memcpy"
01F0976C (01F0976B)

Now put Entrypoint and Memcpy + 1 together and change the first number into a "F"

M Code
F1F00008 01F0976B

Now the other Elfs....

F1F00008 01F0976B
0034539C 0C04EC72 < Action elf
00277E24 0C090ABB < Driving elf
00133734 0C049877 < Movie elf

Instead of a F we change the first Numbers of the Elfs into a 9 !
F1F00008 01F0976B
9034539C 0C04EC72
90277E24 0C090ABB
90133734 0C049877

finisch! If you want you can convert it to Xploder/Codebreaker Format but this Cheatdevices also uses Raw/Hex - Codes so it doesn`t matter if you convert it or not.

Codebreaker/Xploder
FB75206E 31EE003D
9A242B73 18F711F9
9AAC5E06 187B06D5
9ADC4A5F 180EACD0

How did I make an AR2 Multi Elf Mastercode?

007: Agent Under Fire PAL

You will find:
Sles 505.39
Action.elf
Driving.elf
Movie.elf


AR2 doesnt use Entrypoint Enablers!
wir have to find Memcpy

memcpy JAL = 002783A4 <--- but this is not our Adress for the Code this is our Digit/Value!

xxxxxxxx 002783A4

To get the Adress we have to Add +1 to the Adress!

002783A5 002783A4

*Multi Elf Mastercodes for AR2 changes the first numer to a 8 instead of a F

802783A5 002783A4

Now we have to find the other memcpy in the Elf files
Action... 00345557 0C04EC80
Driving... 002783A7 0C090C17
Movie... 001380B7 0C04AAD5

now we have:
802783A5 002783A4 < Sles 505.39
00345557 0C04EC80 < Action.elf
002783A7 0C090C17 < Driving.elf
001380B7 0C04AAD5 < Movie.elf

We have to change the Adress with the Digit/Value (at the other Elf - Files)

0C04EC80 00345557 < Action.elf
0C090C17 002783A7 < Driving.elf
0C04AAD5 001380B7 < Movie.elf

and change the Digit/Value simply with 00000000
0C04EC80 00000000 < Action.elf
0C090C17 00000000 < Driving.elf
0C04AAD5 00000000 < Movie.elf

Now we have our complete AR2 Multi-elf Mastercode in Raw/Hex - Format
802783A5 002783A4
0C04EC80 00000000 < Action.elf
0C090C17 00000000 < Driving.elf
0C04AAD5 00000000 < Movie.elf

convert to AR2 - Format
7E977325 BCD01E27
CAFA0A7E BCA99B83
CAF5EA97 BCA99B83
CAFA54D5 BCA99B83
but dont forget the Key Code (0E3C7DF2 1853E59E)

Final Master Code
0E3C7DF2 1853E59E
7E977325 BCD01E27
CAFA0A7E BCA99B83
CAF5EA97 BCA99B83
CAFA54D5 BCA99B83


Make the world your own.