Hacking VitaCheat/FinalCheat Database

[tomberyx]

Coming soon (PCSB00499)
With deep kick ass codes

 

[subworx]

# Title: Demon Gaze
# ID: PCSE00358
# Region: US
# Version: 1.00
# Type: NoNpDrm
# Vita-Language: German
# Reset Game: 10+
# Code Author: tomberyx

Spoiler: Code

# PCSE00358

_V0 Oz inf.HP
$B200 00000001 00000000
$0200 00018C18 00021E61

_V0 Oz max.HP-MP
$B200 00000001 00000000
$0100 00018C16 00001B5E
$0100 00018C1A 000002E4

_V0 max.Level after Fight
$B200 00000001 00000000
$0200 0000CDC0 0076ADF1

_V0 inf.Money
$B200 00000001 00000000
$0200 001B7550 04A2CB71

_V0 inf.all Items Bag
$B200 00000001 00000000
$4001 001B6D72 0000004D
$0064 00000014 00000000

_V0 Unlock inf.all Items in Storage
$B200 00000001 00000000
$4201 0015D488 004D0001
$03E8 00000014 00000001

_V0 All Items 99-Plus in Storage
$B200 00000001 00000000
$4201 0015D48A 00630001
$03E8 00000014 00000001

_V0 inf.Stock
$B200 00000001 00000000
$0000 002FBDAA 00000007

_V0 Zero Stock
$B200 00000001 00000000
$0000 002FBDAA 00000000

Tried with Vita (OLED, 3.60, VitaCheat 3.60.z04 Beta ) language set to German, but the cheats (HP, HP-MP, Money) don't work for me at all
Game version is 1.00 from NPS Browser, with all DLC installed, no updates, no comp pack.
Anything I might be doing wrong?

Also, what does "Reset Game: 10+" mean?

 

[NeoGranzon]

Tried with Vita (OLED, 3.60, VitaCheat 3.60.z04 Beta ) language set to German, but the cheats (HP, HP-MP, Money) don't work for me at all
Game version is 1.00 from NPS Browser, with all DLC installed, no updates, no comp pack.
Anything I might be doing wrong?

Also, what does "Reset Game: 10+" mean?

@subworx ,maybe they were created with enso 3.65 with Vitacheat Z06 and with no DLC installed,that's why they don't work.
Try removing all the DLCs in ux0:addcount/PCSE00368 by copying them elsewhere and doing a refresh livearea with triangle from VitaShell main menu.
If they still don't work you need to update to CFW enso 3.65.

 

[subworx]

@subworx ,maybe they were created with enso 3.65 with Vitacheat Z06 and with no DLC installed,that's why they don't work.
Try removing all the DLCs in ux0:addcount/PCSE00368 by copying them elsewhere and doing a refresh livearea with triangle from VitaShell main menu.
If they still don't work you need to update to CFW enso 3.65.

Thank you.
The DLC didn't change anything, so it must be the FW version.
After searching a bit on how to edit the original code to possibly match what I need and not finding B200 codes in the VitaCheat documentation, I found this post from you: https://gbatemp.net/threads/how-to-create-b200-codes-manually-with-vitacheat.610496/

"Note:The B200 Code type don't function on CFW 3.60,you must be using Z05 or Z06(preferably)on CFW 3.65 or VitaCheat will crash when used."

So haha, it won't work of course. Didn't crash for me, though.
Now thinking whether I should update to 3.65 or not.

 

[NeoGranzon]

Thank you.
The DLC didn't change anything, so it must be the FW version.
After searching a bit on how to edit the original code to possibly match what I need and not finding B200 codes in the VitaCheat documentation, I found this post from you: https://gbatemp.net/threads/how-to-create-b200-codes-manually-with-vitacheat.610496/

"Note:The B200 Code type don't function on CFW 3.60,you must be using Z05 or Z06(preferably)on CFW 3.65 or VitaCheat will crash when used."

So haha, it won't work of course. Didn't crash for me, though.
Now thinking whether I should update to 3.65 or not.

@subworx ,the phrase is taken from here

and i made this tutorial because many do not know certain things and can mess up their games.

 

[subworx]

@NeoGranzon i updated to 3.65 with VitaCheat z06, cheats work now as intended.
Thanks again

 

[MNero]

NO. There are new codes that release every so often. Keep track so you don't miss out, or if a cheat has not yet been made, attempt to make them yourself. Share your findings if possible

OK thank you!

 

[tomberyx]

Coming soon !
Deception IV: Blood Ties
With deep kick ass codes
At the moment 30+ codes compressed
My aim is to find a code to control body-Parts very hard to get.... pictures below is not what im looking for but nice to have...
Also trying to find a code to finish the whole game with one button...

 

[tomberyx]

# Title: Breach & Clear
# ID: PCSE00641
# Region: US
# Version: 1.00
# Type: NoNpDrm
# Code Author: tomberyx
# only for VitaCheat z06 and FW 3.65+

Spoiler: Code

# PCSE00641

_V0 -------------------
$0000 00000000 00000000

_V0 max.Skill-Points [after Mission] X
$3004 85A804F4 0000000C
$0000 00000000 000000D4
$0000 00000000 00000010
$0000 00000000 000001A4
$0000 00000000 0000004E

_V0 max.Skill-Points [after Mission] Y
$3004 859804F4 0000000C
$0000 00000000 000000D4
$0000 00000000 00000010
$0000 00000000 000001A4
$0000 00000000 0000004E

_V0 max.Skill-Points [after Mission] Z
$3004 85B804F4 0000000C
$0000 00000000 000000D4
$0000 00000000 00000010
$0000 00000000 000001A4
$0000 00000000 0000004E

_V0 -------------------
$0000 00000000 00000000

_V0 Use only X Y or Z do not mix.
$0000 00000000 00000000

_V0 Codes can switch from XtoZ and back.
$0000 00000000 00000000

_V0 Do not activate codes permanent.
$0000 00000000 00000000

_V0 [NOTE] I recommend turn Code-ON in Skill-Menu.
$0000 00000000 00000000

 

[MNero]

Good afternoon! Do you have any cheats for The Amazing Spider-Man US version?

 

[XMYDL]

# Title: Breach & Clear
# ID: PCSE00641
# Region: US
# Version: 1.00
# Type: NoNpDrm
# Code Author: tomberyx
# only for VitaCheat z06 and FW 3.65+

Spoiler: Code

# PCSE00641

_V0 -------------------
$0000 00000000 00000000

_V0 max.Skill-Points [after Mission] X
$3004 85A804F4 0000000C
$0000 00000000 000000D4
$0000 00000000 00000010
$0000 00000000 000001A4
$0000 00000000 0000004E

_V0 max.Skill-Points [after Mission] Y
$3004 859804F4 0000000C
$0000 00000000 000000D4
$0000 00000000 00000010
$0000 00000000 000001A4
$0000 00000000 0000004E

_V0 max.Skill-Points [after Mission] Z
$3004 85B804F4 0000000C
$0000 00000000 000000D4
$0000 00000000 00000010
$0000 00000000 000001A4
$0000 00000000 0000004E

_V0 -------------------
$0000 00000000 00000000

_V0 Use only X Y or Z do not mix.
$0000 00000000 00000000

_V0 Codes can switch from XtoZ and back.
$0000 00000000 00000000

_V0 Do not activate codes permanent.
$0000 00000000 00000000

_V0 [NOTE] I recommend turn Code-ON in Skill-Menu.
$0000 00000000 00000000

If you have any time my friend you may have a look at the discussion.

 

[tomberyx]

Good afternoon! Do you have any cheats for The Amazing Spider-Man US version?

Yes but be patient
At the Moment inf.Skill Points

 

[Yohoki]

Been a few years since I've stalked this thread. Good to see a few familiar faces. I figured I'd drop by and drop a little info I've discovered, that would have been super helpful years ago when I frequented the scene.

There used to be (and probably still is) an issue with addresses randomly being shifted by something like 0x100000... I'm pretty sure now this is called Address-Space Layout Randomization (ASLR) and is a security and memory optimization feature on systems, and the vita certainly uses it.

What this would mean, is sometimes you would find a working code, dump it, and use that dump to pointer search. The issue happens when you reboot the game, the addresses have shifted. Making a new dump with the new addresses is fine, but you can't find good pointers because of the 0x100000 shift. This caused a lot of issues finding useful pointers and getting codes working because the game would randomly shift and there would be no way to stop it. It wasn't just that the pointers were pointing to new areas, but that the root of the pointers was also moved around, and there was no way to find a root since it was moved. I would know, because I spent hundreds hours searching by hand in hxd and seeing these trends in thousands of dumps. There was SOME memory map somewhere that had the info, but vitacheat could see that map, it's how the b200 codes work, but we did not have access to that map, nor could our pointer searchers use that map's info when trying to search.

Except there was... About the time I stopped making codes, Princess of Sleeping released a plugin called NoASLR, specifically to stop ASLR to make it easier to develop homebrew. But, I don't see why it would not also work to get a stable address space for the games to allocate to. I'm 90% positive that any cheats made with the plugin active would require users to also have the plugin. But I'm pretty sure this would also make finding and using cheats a lot easier.

https://github.com/CelesteBlue-dev/PSVita-RE-tools/tree/master/noASLR

I probably won't come back to the scene, but I would like to drop this info and maybe do a few tests next week, if no one else decides to try it. Either way, this plugin is probably going to make getting gold pointers a trivial task. This was the exact reason why I was trying to make an AoB scanner code, but now that I've found the plugin, It isn't necessary. Good Luck. Happy hunting.

 

[tomberyx]

I can't believe it you are back,
Welcome Yohoki.

I will ask my questions later, there are too many at the moment

 

[Smoker1]

VitaCheat does not work with PSM Games, does it? Just checking

 

[Yohoki]

Lol. I make no promises to being back. Just wanted to drop some sage advice that I just happened upon while hacking a diff system on my spare time. This info's been out there for a long time, just none of us knew what is was called or how to stop it. Since there's a way now, if no one's noticed the connection yet, then you're welcome. XD

But really tho, the info's been out there... Like the Henkaku Vita Dev Wiki:

Shared Module ASLR​

Since PS Vita 2.06, user shared modules like SceLibKernel are loaded to randomized addresses. The randomization was later improved to be more random in FW 2.60.

Application ASLR​

Since PS Vita FW 2.60, usermode applications (the main library) themselves can be compiled with ASLR support. Although not all games and applications choose to use this feature of the compiler, more and more are.

Or in theFlow's writeup of H-Encore:

Partial ASLR​

It seems like ASLR is only enabled for executables/modules. Normally this is not an issue, since the executable is the first thing allocated and its randomization will propagate and affect subsequent allocations (for example thread stacks).
But as our executable is statically loaded, all other allocations will be deterministic. Hence we can choose our destination address to be in a thread stack and overwrite a return address.

The answer has been in our faces for years, we just didn't know it. We've got a name for it now, and a plugin to stop it.

 

[Peoples92]

does anyone have a freeze timer cheat for attack on titan wings of freedom pcse 00812?

 

[monodevil]

@Yohoki​

Haven't been around myself, you popped in at the same time as I did. Actually 2 days ago for me but something told me to keep checking here lol. Was catching up on months of posts until I saw your name.

As for that tool, It sounds like I'd have to start from scratch with my dumps as I usually been saving them which sucks. In fact I'm gonna have to start from scratch and redo a lot of codes. This sounds more horrific than anything, really ain't looking forward to that.

 

[Yohoki]

@Yohoki​

Haven't been around myself, you popped in at the same time as I did. Actually 2 days ago for me but something told me to keep checking here lol. Was catching up on months of posts until I saw your name.

As for that tool, It sounds like I'd have to start from scratch with my dumps as I usually been saving them which sucks. In fact I'm gonna have to start from scratch and redo a lot of codes. This sounds more horrific than anything, really ain't looking forward to that.

If I'm right, you won't NEED to stash dumps.

The whole reason we needed so many dumps was because of randomized memory allocation ruining so many of the dumps. This is also why even the gold pointers would fail sometimes.

With no randomized memory chunks, pointers located within the seg0/seg1 zones should ALWAYS be in the same spot. Multiple dumps will still be more accurate, but the amount of false positives should go down. Just make sure that the base pointer is located within seg0/seg1 and it should always be in that same spot.

Likewise, pointer searchers should ALWAYS find a pointer in seg0/1 now, because those areas will be statically loaded. It *might* even help with DLC/Language settings shifting things around. But I can't say for certain on the last one and don't feel like doing any testing at 4am.

 

[Yohoki]

Here's a quick example...

You load up a game and vitacheat says seg0 is at 0x8100000. You find a cheat, and dump the address to pointer search.

You load the game up again, and vitacheat now say seg0 is at 0x81100000. You find a cheat, repeat.

When you go to pointer search, Let's say it finds a pointer in dump1 at 0x81001337. That pointer is still there on dump2, but the pointer searcher can't see it, because it's at 81101337.... That's the issue. The shift has hidden the pointer in the searches, because the base location has moved.

I worked around this in Ys VIII, by making a b200 code + a lvl2 pointer... But that required a lot of REALLY understanding the data structures, and manually reading the raw data in hxD and Cheat Engine.... I never got a valid pointer in TempAR, simply because of the randomized memory.

But, this plugin should stop the randomized memory allocation. If the game loads at 0x81000000, it should always load at 0x81000000. That means TempAR will always find the pointer in the second dump and upgrade it to green. Add more dumps, and it will stick out like a sore thumb. Or, use more powerful pointer searchers like Cheat Engine, and it'll single it out completely.

At least, that's the theory. Needs tested. I'm currently transferring jobs and prob won't be able to do anything this weekend while I transition into the new position. But if no one tests it until then, I'll give it a go soon.

A couple troublesome games I can remember that would be good to test on:
Ys VIII - Fairly easy to get the float values, but the game used 2-4 different "Zones" for it's random memory allocation.
Criminal Girls 2: Party Favors - If I remember right, this game was a piece of crap. It moved locations in memory every time you went to a different map. Tomberyx seems to have found values with a b200 and no pointer, though, so maybe not as tough as I thought it was.

Mods: Sorry for double post. I could have sworn this forum had an auto merge.. Haven't been in a few years.