PS2 Dev system

[blincoln]

Umah, this is what you need to snag for me when you're distracting Chris:

http://www.psxextreme.com/screenshots/psx_2/ps2_tool.jpg

=)

[Chris@Crystal]

While she's distracting me? :)
Good luck getting one of these. We only have a few and we need them to make games.
~Chris

[blincoln]

We have a plan. Umah is going to distract by batting her eyelashes you so I can swipe one of your TOOLs =).
I can see why you only have a few. According to the article I got that picture from, they cost about $19,000. At least, they did in 1999.
It would be overkill for me anyway. I'm not a developer, and having a disassembler and a MIPS simulator should be enough for now.

[warpsavant]

Maybe they will let us borrow one for a little while!

[blincoln]

I have a friend who works for a game company here who has access to one, but really I wouldn't know what to do with it. I just think they look cool.
Right now I'm using PCSX2, which has a built-in debugger, to figure out what I need =).

[Wise Man Domingo]

And all I have is a ruddy RPG Maker... man it'd be sweet to be able to make my own PS2 games... I've been trying to find a way to make an LoK game based on my fanfic, but the RPG Maker just isn't flexible enough for that...

I want to be able to make my own games! But every time I try, it flops!!! WHY?!?!?! Am I cursed or something?!?!?!?!

[necropotence]

Why make a game it's very difficult just make a movie.

[Lady Kreliana]

And now for the idiot's questions of the day. :D

What is that thing for and how does it work?

[blincoln]

It's the system that game developers write Playstation 2 games on.
I bet it has a better debugger than the one in the emulator I'm using =).

[Lady Kreliana]

Ahh, so that would mean even more hacking into unexplored territory, right?

[Vampmaster]

You found a MIPS simulator and an emulator (that works)? Try looking for something called Naplink. It's used for writing very basic PS2 games/programs and I've heard it can be used with the gameshark for something. Now if I understood you right (Blinc), the (M) codes find a place to jump to an unused space in memory then run the GS2 subroutine there, then jump back. (At least I thought you said something like that) If we could find someone who could (and would) write a different program to put in this slot that would output the RAM to a PC or something using the (I think it's called the UBS port) then we would at least have similar facilities to Datel, even if we couldn't make our own games (which would be too hard anyway). Actually this would probably work since the shark port uses this and the old version for PS1 let you do stuff like that. Or if the emulator works properly, we could just view the RAM directly from the PC. I wonder what we would need to customise a PS2 into a TOOL? An extra memory card there, a significantly cheaper than the whole thing chip there... These are just some idle thoughts and would probably be very hard (impossible for us anyway) to implement but I am interested in the emulator as that idea could work.

[Umah Bloodomen]

Okay Blinc. It's good to have the objective in mind. I figure I'll start with the eye batting but I think it's going to take a little more than that. So I've developed the patented 'lip biting pouty look' to further sway the attention of the Butterfly Lord away from the console.

Oh yes, it will be mine..... Muhahahahah ;) :D :p

[blincoln]

Lady Kreliana: Yes, I suspect that given an hour or two's access to a TOOL, I could finally figure out which address is getting modified by pre_process_functions in DEBUG_Menu so I could make Raziel start moving again automatically when the debug menu is exited =).
Vampmaster: I was wrong at first about the master codes. There are several types, but the one used by SR2 is pretty straightforward. The first address is used as a tripwire by the gameshark. Once the JAL (jump and link) at that address is called, it makes the rest of the codes active. The second address is the call to memcpy that the scePadRead function uses (this is some kind of standard Sony function that all/most games use to determine user input). Basically it's telling the shark/ar to modify memory every time that memcpy is run.
I'll have a look at Naplink. I started out trying to use PCSpim for a MIPS emulator, but that crashes with PS2 code. Then I tried using the debugger in PCSX2, but you can't properly jump to arbitrary addresses. Now I'm using the one that's built into PS2Dis (ctrl-shift-r).
Umah: That sounds like a great plan =). If you can keep him occupied for awhile, we can swap it for a stand-in, like the suitcase in Ronin.

[Omega One]

*wipes drool away*

Mmm... looks cool...

Ok, I've no programming experiance - but still... I'm sure it'd be cool.... ;)

Good luck getting that $19k blinc :)

[Umah Bloodomen]

Originally posted by blincoln
Umah: That sounds like a great plan =). If you can keep him occupied for awhile, we can swap it for a stand-in, like the suitcase in Ronin.

Now you're talking. :p (Glad you agree)

Look out Sopranos, here comes Blinc and Umah. :p ;) :D

We'll take the organized crime world by storm I say! Muahahhaha.

[blincoln]

I just need a fedora =).

[eclipse_reaver]

what about the linux kit?

[blincoln]

You can't run commercial games from Linux, only homebrew ones =(.

[Vampmaster]

Originally posted by blincoln
Lady Kreliana: Yes, I suspect that given an hour or two's access to a TOOL, I could finally figure out which address is getting modified by pre_process_functions in DEBUG_Menu so I could make Raziel start moving again automatically when the debug menu is exited =).
Vampmaster: I was wrong at first about the master codes. There are several types, but the one used by SR2 is pretty straightforward. The first address is used as a tripwire by the gameshark. Once the JAL (jump and link) at that address is called, it makes the rest of the codes active. The second address is the call to memcpy that the scePadRead function uses (this is some kind of standard Sony function that all/most games use to determine user input). Basically it's telling the shark/ar to modify memory every time that memcpy is run.
I'll have a look at Naplink. I started out trying to use PCSpim for a MIPS emulator, but that crashes with PS2 code. Then I tried using the debugger in PCSX2, but you can't properly jump to arbitrary addresses. Now I'm using the one that's built into PS2Dis (ctrl-shift-r).
Umah: That sounds like a great plan =). If you can keep him occupied for awhile, we can swap it for a stand-in, like the suitcase in Ronin.

Ah, then the old (M) code either didn't use memcpy or memcpy wasn't run often enough.

[blincoln]

Possibly. I didn't feel like spending another week figuring out what babelfish's pseudo-English Japanese translation of the AR2 documentation was saying about the two-line master codes, so I don't know how they really work. I just know how that particular kind of one-line master codes works. Devil May Cry, for example, uses *another* type of one-line code that also references the memcpy, but I don't know what the first half of it is doing.

[Vampmaster]

I couldn't find Hellion anywhere but here's what Kpdavatar (the guy who made the convertor) said:

I have not had much time to study the (M) codes.(work)

From what I have seen the (M) code is one or two addresses that point to MIPS JAL(Jump And Link) commands.
First part unencrypted is "F" or "8" for Master code.
Then a JAL address with the last 2 bits set for some reason.

There are 8 types of (M) codes I have seen.
Codes starting with "F" unencrypted and
with the last 2 bits in an address as 00 Initailize hit one?
with the last 2 bits in an address as 01
with the last 2 bits in an address as 10
with the last 2 bits in an address as 11 multable hits?

Codes starting with "8" unencrypted and
with the last 2 bits in an address as 00
with the last 2 bits in an address as 01
with the last 2 bits in an address as 10
with the last 2 bits in an address as 11

The (M) code is mostly addresses of when to make the GS2 the codes work.
Exception two line (M) code.
Two line (M) codes have "DEADFACE" encoded
then a different encryption then
the JAL addresses.

Most (M) codes are address of mips jal commands.
Jump And Link

The order of the addresses should be,
the order in which the game hit them.

As for which jal address to use,
it depends on where you want the codes to work.

If you want a code to work before the level is initialized,
you need the address of a jal before the level is initialized.

If you want a code to work while a level is being played,
you need the address of a jal that is hit often in that level.

If you use an address that is used alot by a game,
it will slow the game down.

A good (M) address is one that is hit often but not too much

Making a (M) code:

(M) = Aaaaaaaa bbbbbbbb
A = F-Hex for (M) code
aaaaaaa = jal1 address
bbbbbbbb = jal2 address

if only one jal1 address then
bbbbbbbb = 0000000E-hex or bbbbbbbb = 000001FD-hex
Why, I don't know but it is one or the other is used.

GTA3
jal1 address1 0027ed20-hex initailize cd file (before level codes)
jal2 address2 0011f347-hex game pad check hit (while playing codes)

Making first part of (M) code:
Take first jal address add F-hex for (M) code
jal1 0027ed20-hex
F027ed20-Hex

Making second part of (M) code
just put it on.
f027ed20 0011f347-Hex

Then encrypt
GTA3 (M)
ECB26E481445B464-GS2
Done!
**************************

(M) code in order of what I grabbed first to last.

TimeSplitters
(M)
ECB784201456E79B-GS2
F02003F80000000E-Hex
Only one jal address = 002003f8-Hex
fill with 0000000E-Hex

DOA HardCore
(M)
ECBEC4AC1456E60A-gs2
F02B4384000001FD-Hex
Only one jal address = 002b4834-Hex
fill with 000001FD-Hex

Test Drive: Off-Road Wide Open
(M)
EC8782E4142CE55C-GS2
F01001BC002A024F-Hex
Two jals
001001bc-hex
002a024f-hex

Oni
(M)
ECB3FF0C142BD5F8-GS2
F0247CE4002B12D3-Hex
jal1=00247ce4-Hex
jal2=002b12d3-Hex

Smugglers Run2
(M)
EC8782941429D008-gs2
F010016C00351FE3-hex
jal1=0010016c-hex
jal2=00351fe3-hex

Hot Shots Golf 3
(M) two line code
0E3C7DF21853E59E-gs2a
EE8D8B1EBCBA0D82-gs2b

DEADFACE04030209-hexa Deadface encryption seed?
F0116BA0001172FF-hexb jal addresses
jal1=00116ba0-hex
jal2=001172ff-hex

Sky Odyssey
(M)
EC8798041456E60A-gs2
F01017DC000001FD-hex
jal=001017DC-hex
fill=000001FD-hex

Silent Scope
(M)
EC8D4B1C1456E79B-gs2
F01AC8F40000000E-hex
jal=001ac8f4-hex
fill=0000000e-hex

That is as far as I have gotten.
There is still some more I have to find out.

[Wise Man Domingo]

What's this?! What's this?!:confused:

This is the kind of stuff you have to know to be a game designer... isn't it?

[Umah Bloodomen]

This is the stuff you have to know to be The Caterpiller Squire (TM) and his partner in crime, Vampmaster. (haven't picked a name for you yet ;) ).

[blincoln]

It sounds like kdpavatar is at about the same place I was a week ago, having read that crazy Japanese document through Babelfish.
Do you have his email address, Vampmaster? I'd like to get in touch with him.
He has it pretty much right, but not quite =).

[warpsavant]

Marble Boys email is in the help section for the Thing...

http://mywebpages.comcast.net/dstrobri/bonus.html

Just click on help, his email is right there above Hellions00

[Vampmaster]

That was his reply when I PMed him at the gameshark forums. By the way, check out Hellions "Thanks" page.