Hacking VitaCheat/FinalCheat Database

tomberyx

Well-Known Member
Member
Joined
Jan 9, 2020
Messages
1,659
Trophies
2
XP
4,382
Country
Germany
About XYZ (conditional ) pattern it seems I have found a solution to eliminate it in a simple way with the help of B200. I have tried it on several games including the last 5 above. The result was very good. Will experiment more to be sure too. The games above (walking Vialote and Barbarian have extremely this pattern but now I have kicked it in the ass...;-)
 

Yohoki

Well-Known Member
Member
Joined
Dec 4, 2018
Messages
824
Trophies
0
Age
34
XP
1,213
Country
United States
About XYZ (conditional ) pattern it seems I have found a solution to eliminate it in a simple way with the help of B200. I have tried it on several games including the last 5 above. The result was very good. Will experiment more to be sure too. The games above (walking Vialote and Barbarian have extremely this pattern but now I have kicked it in the ass...;-)
Is this the noASLR+b200 fixing the issue, or have you found another method? I'm excited to hear.
 

NeoGranzon

シュウ 「グラビトロンカノン 発射!」
Member
Joined
Aug 4, 2019
Messages
2,995
Trophies
1
XP
7,963
Country
Italy
Already done that.
I used the English translation of the Chinese game version yet the game is crashed after I got to the second battle on Gundam Story, the one after Gundam Rising episode.
Do you have a discord?
@Guyverd ,It is normal for the game to crash if you use the cheats for another version of the same game and you run the risk of damaging your saves as well.
Yes i have Discord why?
 

tomberyx

Well-Known Member
Member
Joined
Jan 9, 2020
Messages
1,659
Trophies
2
XP
4,382
Country
Germany
This plugin Noaslr has nothing to do with it. These patterns are also there with Noaslr. The way around XYZ is very simple to solve, you only need Vitacheat and a Hex-Calc. For example;
Money Code 82X11111 (XPattern)
Set Fuzzy (below) the range of Seg1 and the Adress (above) between 82211111-82111111 you wil get some results try the first one and make a b200 with it.

This way is very simple but there are addresses that do not have the pattern better to say it changed all the numbers ,here it does not work. I wonder if it is possible to get everything stable with this method, I think not but will do more investigations on it..

What pointer to find within segment for B2 code?

For Static address - Find the starting block address as pointer; that holds alleged static address.

For Static & Dynamic address - Find the pointer that has consistent offset like normal routine but within the segment.

For Multi-level pointer - First pointer must be within the segment. The rest can be found elsewhere.

The 2nd method is better than 1st for various reasons but time consuming because you're looking for unknown pointer.
 
Last edited by tomberyx,
  • Like
Reactions: XMYDL

Yohoki

Well-Known Member
Member
Joined
Dec 4, 2018
Messages
824
Trophies
0
Age
34
XP
1,213
Country
United States
This plugin Noaslr has nothing to do with it. These patterns are also there with Noaslr. The way around XYZ is very simple to solve, you only need Vitacheat and a Hex-Calc. For example;
Money Code 82X11111 (XPattern)
Set Fuzzy (below) the range of Seg1 and the Adress (above) between 82211111-82111111 you wil get some results try the first one and make a b200 with it.

This way is very simple but there are addresses that do not have the pattern better to say it changed all the numbers ,here it does not work. I wonder if it is possible to get everything stable with this method, I think not but will do more investigations on it..

What pointer to find within segment for B2 code?

For Static address - Find the starting block address as pointer; that holds alleged static address.

For Static & Dynamic address - Find the pointer that has consistent offset like normal routine but within the segment.

For Multi-level pointer - First pointer must be within the segment. The rest can be found elsewhere.

The 2nd method is better than 1st for various reasons but time consuming because you're looking for unknown pointer.
.... I see..... So what I'd been saying years ago....

At least with noASLR it should be easy to find pointers inside seg0 or seg1.

I finally found my stupid charger cable. Thank god Sony used an easily available cable to charge their handhelds, not a proprietary one, am I right? So As soon as my vita's charged tonight I'll do a few dumps with noASLR and try these things out and see if I can get a clearer picture of how it affects the code.
 

Guyverd

Well-Known Member
Member
Joined
Jun 9, 2013
Messages
137
Trophies
1
Age
32
Location
City of Hope
XP
498
Country
Indonesia
@Guyverd ,It is normal for the game to crash if you use the cheats for another version of the same game and you run the risk of damaging your saves as well.
Yes i have Discord why?
I think your cheats is for PSCH00242.
Is your cheat for the English translated version?
If it's possible I'd like to chat to you by discord .
 

Yohoki

Well-Known Member
Member
Joined
Dec 4, 2018
Messages
824
Trophies
0
Age
34
XP
1,213
Country
United States
I think it's time to start fresh.... which is REALLY painful, because I've been sitting on 120gb of dumps...... But I REALLY believe that this noASLR plugin is the fix we've been needing for years. It REALLY hurts to delete that many dumps, hundeds of lines of notes, test codes....

The only thing I'm leaving is my Plants vs Zombies codes, because that one code that I wrote has a special placed in my heart, and nobody here has made anything like it.... hacking vitacheat's code list, to edit the cheat being run, as the cheat is running.... It's my baby and I love how janky it is.

RIP years of data that I spent hours skimming through in HxD. But, it's time to make a comeback. >:)
 

Yohoki

Well-Known Member
Member
Joined
Dec 4, 2018
Messages
824
Trophies
0
Age
34
XP
1,213
Country
United States
So, aslr turned off IS actually working as I thought. Quickly looking at Ys:VIII, I'm seeing seg0/1 always at the same spot (actually for ALL modules!) . I loaded 2 dumps up in TempAR and was able to find my b200 pointer that never showed up in TempAR before, since the seg1 always moved around. Compare this Generated code to the b200 code I made years ago....
1664086012899.png
This pointer NEVER showed up as green in TempAR. NEVER. I had to manual search through raw hex in HxD and compare pointers manually. But here, in only 2 dumps, it's started showing up. It's a lvl 2 pointer here, but it's lower level is actually inside the seg0, so it can be converted to a b200, essentially making it a lvl 3 pointer, rooted in seg1.

Compare that to THIS picture with noASLR disabled. Seg0/1 move around between dumps. Since seg0 positions move around, TempAR no longer things they're valid pointers. So they no longer show up as green, and expanding the list of pointers also doesn't show a green lvl 2 pointer.
1664085555200.png
You'll notice now that the same pointer with offset 0x3870 is now BLACK, not Green. Even though this pointer is rooted in seg1, and IS there on both dumps and can be followed with a b200 code, TempAR cannot see it and tries to make you ignore it. Same with Universal Pointer Scanner, and Cheat Engine. With ASLR turned on, no pointer scanner can find the pointer rooted in seg1, because it moves.

I would REALLY like to push noASLR as a REQUIRED plugin, at least for SEARCHING for codes. So long as the code is converted to b200 afterwards, then noASLR is not required for users, only those doing pointer searches.
 
Last edited by Yohoki,
  • Like
Reactions: XMYDL and tomberyx

NeoGranzon

シュウ 「グラビトロンカノン 発射!」
Member
Joined
Aug 4, 2019
Messages
2,995
Trophies
1
XP
7,963
Country
Italy
I think your cheats is for PSCH00242.
Is your cheat for the English translated version?
If it's possible I'd like to chat to you by discord .
@Guyverd ,it says both in the video and inside the link file where you can download it.
Yes it is for the sub-english version.
In Discord,i chat only with serious and experienced people no trolls,i just need those of this thread for this i have limited access to only followers in my profile.
 

Yohoki

Well-Known Member
Member
Joined
Dec 4, 2018
Messages
824
Trophies
0
Age
34
XP
1,213
Country
United States
Even more definitive proof that noASLR is helping.... YsVIII is also a game that suffers from pointers messing up when the system language is changed. Normally, my codes (aside from the b200) would fail on this game if the system language was set to something other than english. And sure enough, with ASLR, my codes still fail.

But with noASLR installed, suddenly it no longer matters. Since this community is very diverse, with multiple users speaking other languages, codes would frequently fail. Even with a different language (tried spanish and Japanese here) the segments are still loaded in at static locations, so any pointers made for one language, still work on the others. The same pointer (with offset 3870) is STILL showing up.
1664090401374.png
What's even more interesting, the code's address itself has yet to change. Adol's HP is consistently loaded in at 0x8CEBB654, A pointer (so far) is not even needed if noASLR is loaded. Maybe this varies per game, and it isn't as stable as it seems right now.... but so far, that address has not changed for me, even after changing system language.

A MASSIVE majority of the pointers are now also static. This is probably due to how many of them are hardcoded and rooted in seg0/1... something I wouldn't have noticed before, because so many of these addresses would have been green/black and I would have just ignored them, since they didn't look like valid, static pointers. Now that segments don't move, pointer searchers can see these locations and use them.

Since this is so valuable now.... I think I am also going to make an update to TempAR.... Since we have the segment locations, there is no reason why we couldn't add them into the searcher and let TempAR make note of it. So I'm going to make a few changes to allow us to add our segments in, and make the pointers bolded or something if they are within a segment, and automatically add b200 to them if they are. This should make pointer searching infinitely easier and give much more useful codes.... if, and ONLY IF, you are using noASLR. Without it, the pointer searches will be as useless as they have been.
 
  • Like
Reactions: tomberyx

tomberyx

Well-Known Member
Member
Joined
Jan 9, 2020
Messages
1,659
Trophies
2
XP
4,382
Country
Germany
I think it's time to start fresh.... which is REALLY painful, because I've been sitting on 120gb of dumps...... But I REALLY believe that this noASLR plugin is the fix we've been needing for years. It REALLY hurts to delete that many dumps, hundeds of lines of notes, test codes....

The only thing I'm leaving is my Plants vs Zombies codes, because that one code that I wrote has a special placed in my heart, and nobody here has made anything like it.... hacking vitacheat's code list, to edit the cheat being run, as the cheat is running.... It's my baby and I love how janky it is.

RIP years of data that I spent hours skimming through in HxD. But, it's time to make a comeback. >:)
I think it's time to start fresh.... which is REALLY painful, because I've been sitting on 120gb of dumps...... But I REALLY believe that this noASLR plugin is the fix we've been needing for years. It REALLY hurts to delete that many dumps, hundeds of lines of notes, test codes....

The only thing I'm leaving is my Plants vs Zombies codes, because that one code that I wrote has a special placed in my heart, and nobody here has made anything like it.... hacking vitacheat's code list, to edit the cheat being run, as the cheat is running.... It's my baby and I love how janky it is.

RIP years of data that I spent hours skimming through in HxD. But, it's time to make a comeback. >:)

So, aslr turned off IS actually working as I thought. Quickly looking at Ys:VIII, I'm seeing seg0/1 always at the same spot (actually for ALL modules!) . I loaded 2 dumps up in TempAR and was able to find my b200 pointer that never showed up in TempAR before, since the seg1 always moved around. Compare this Generated code to the b200 code I made years ago....
This pointer NEVER showed up as green in TempAR. NEVER. I had to manual search through raw hex in HxD and compare pointers manually. But here, in only 2 dumps, it's started showing up. It's a lvl 2 pointer here, but it's lower level is actually inside the seg0, so it can be converted to a b200, essentially making it a lvl 3 pointer, rooted in seg1.

Compare that to THIS picture with noASLR disabled. Seg0/1 move around between dumps. Since seg0 positions move around, TempAR no longer things they're valid pointers. So they no longer show up as green, and expanding the list of pointers also doesn't show a green lvl 2 pointer.
You'll notice now that the same pointer with offset 0x3870 is now BLACK, not Green. Even though this pointer is rooted in seg1, and IS there on both dumps and can be followed with a b200 code, TempAR cannot see it and tries to make you ignore it. Same with Universal Pointer Scanner, and Cheat Engine. With ASLR turned on, no pointer scanner can find the pointer rooted in seg1, because it moves.

I would REALLY like to push noASLR as a REQUIRED plugin, at least for SEARCHING for codes. So long as the code is converted to b200 afterwards, then noASLR is not required for users, only those doing pointer searches.

You got the same address twice in the first picture, try it in the second picture too.
 

Yohoki

Well-Known Member
Member
Joined
Dec 4, 2018
Messages
824
Trophies
0
Age
34
XP
1,213
Country
United States
You got the same address twice in the first picture, try it in the second picture too.
Can do. They fail, because those addresses were correct. I checked them in HxD as well. Here they are:
1664091244412.png

1664091332250.png
First one, the address is not correct and does not show hardly any good pointer. (max offset is set to 1000. That's how I've done all the searches until opening a pointer)

Second one, the address is correct for 1st dump, so it shows up in list, but because it is not in second dump, it does not turn green.

So, yes. Those addresses WERE correct in the first post. The address being different in one dump is EXACTLY the thing that ASLR causes, why pointer searching has been such a pain in the ass, and why noASLR is so useful.

Edit:
For clarity, I also did not just sit there in-game and make 6 dumps consecutively. I closed the game after each dump, to reset addresses and pointers. I also played for 10 or so minutes before making a dump. I changed maps, fought enemies, moved around, changed characters, changed system languages. I was not lazy making these dumps. These are very detailed dumps with a lot of variance between them. If the pointers and addresses were going to change, they SHOULD have. The fact that they didn't is evidence that the plugin is working correctly, and actually much better than I imagined it would be from the feedback I had been seeing....
 
Last edited by Yohoki,

Yohoki

Well-Known Member
Member
Joined
Dec 4, 2018
Messages
824
Trophies
0
Age
34
XP
1,213
Country
United States
I found it with Noaslr .-))))))
Yep. That's the correct one. I found that guy years ago, and it was such a pain to get it working correctly. Now it just pops right up.

I'm working on an update for TempAR to make it work even better with this newfound info. If you aren't using TempAR anymore, you might have a reason to go back when I'm done.
1664097096823.png
 

Guyverd

Well-Known Member
Member
Joined
Jun 9, 2013
Messages
137
Trophies
1
Age
32
Location
City of Hope
XP
498
Country
Indonesia
@Guyverd ,it says both in the video and inside the link file where you can download it.
Yes it is for the sub-english version.
In Discord,i chat only with serious and experienced people no trolls,i just need those of this thread for this i have limited access to only followers in my profile.
My game is same like in the video yet I got crashed after entering the second battle.
The version is same like on the video.

Where could I find the VitaCheat for Gundam Extreme VS Force USA?
I couldn't find it anywhere.
Also, how to update the game from PKGJ and got the DLC?
 

Guyverd

Well-Known Member
Member
Joined
Jun 9, 2013
Messages
137
Trophies
1
Age
32
Location
City of Hope
XP
498
Country
Indonesia
@Guyverd ,it says both in the video and inside the link file where you can download it.
Yes it is for the sub-english version.
In Discord,i chat only with serious and experienced people no trolls,i just need those of this thread for this i have limited access to only followers in my profile.
 

Attachments

  • IMG_20220925_142414.jpg
    IMG_20220925_142414.jpg
    2.3 MB · Views: 29

NeoGranzon

シュウ 「グラビトロンカノン 発射!」
Member
Joined
Aug 4, 2019
Messages
2,995
Trophies
1
XP
7,963
Country
Italy
My game is same like in the video yet I got crashed after entering the second battle.
The version is same like on the video.

Where could I find the VitaCheat for Gundam Extreme VS Force USA?
I couldn't find it anywhere.
Also, how to update the game from PKGJ and got the DLC?
@Guyverd ,what cheat do you use?
Simple for Gundam Extreme VS Force USA version you will not find them here and elsewhere if they have not been created.
Next time,instead of taking a picture of the PS Vita,taking a screenshot(PS+Start button)is more defined to see.
 
Last edited by NeoGranzon,

Yohoki

Well-Known Member
Member
Joined
Dec 4, 2018
Messages
824
Trophies
0
Age
34
XP
1,213
Country
United States
Almost there! Should be able to get it finished by tomorrow. I only have a bit more to add, but I have to cook dinner and mow the lawn tonight. So will continue working on it in the morning. But, it now lets you input the seg0/1 address and size. If you choose to add these, pointers firmly rooted in the static areas will now be highlighted, indicating that a b200 code should be used.

I've got a couple more things I'd like to add before I release the update, but it's working well ATM and should be ready by around this time tomorrow.
1664146903492.png
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    K3Nv2 @ K3Nv2: They really wanna get the head