Hacking 101

Make a Pandora's Battery without a homebrew PSP

dlevere@yahoo.com — Wed, 15 Oct 2008 21:29:33 -0400

Ok, so you want to unbrick or downgrade your PSP, but don't have a PSP capable of running homebrew apps. No problem! In this tutorial I will show you how to modify the battery's hardware to make it activate service mode.

Despertar Del Cementerio V7 released (PSP)

dlevere@yahoo.com — Tue, 14 Oct 2008 07:47:36 -0400

Despertar del Cementerio is the universal unbricker developed by Dark_Alex. This method uses a modified version of a Pandora Battery install, and it has been tested to unbrick any PSP, regardless of type, motherboard, (with the exception of the TA-088v3 motherboard) previous firmware, region, etc.

Awakening of the cemetery is the English translation of Despertar del Cementerio. Version 7 of Despertar Cementerio has been released, and it installs 4.01 M33-2 and 4.01.

Download

NDS Tutorials and Misc. Dev Links

dlevere@yahoo.com — Sat, 11 Oct 2008 12:28:53 -0400

NDS Tutorials and Misc. Dev Links

Does Nintendo DS Mod Chip Pose a Threat?

dlevere@yahoo.com — Thu, 9 Oct 2008 08:35:59 -0400

By gamepolitics

How much of a threat are mod chips to game publishers?

Quite a big one, according to U.K. newspaper The Independent. A lengthy article from today's edition deals primarily with a Nintendo DS mod chip known as the R4:

Quote:

The R4 is a tiny Chinese-made device � costing around �14 � that for more than seven million owners of Nintendo's hand-held console, the DS, has blown wide open its capabilities. Combined with a small memory card and plugged into the back of the DS, it enables the console to play MP3s and videos, as well as store copies of games you already own.

Crucially, however, it also enables the user to play pirated games from the Internet, which can be downloaded for free. Add to this that it's simple to use, and available through retailers such as Amazon, and you can see why the R4 and devices similar to it are bringing video game console piracy to the mainstream.

Enabling a DS to play digital music and video is a wonderful thing. Obviously, playing pirated games is not.

In mentioning Amazon, the article is believed to be refering to Amazon UK. Mod chips are illegal in the United States under the terms of the Digital Millenium Copyright Act (DMCA). An English appeals court, however, held recently that the devices do not infringe on copyrights in and of themselves.

On the other side of the coin, British parent Nick Welsh explains why the R4 is attractive:

The trouble with kids is you pay �20 or �30 for a game, and they could only play it once. Let's say I sit down and download 10 new games, the way it ends up is they'll only really play one or two or those, and the others get replaced. I wouldn't be able to afford that number of games.

You can have 70 or 80 games on a 2GB card, and they're all on the back of the machine. There's no fiddling around with cartridges � it's all there to hand... If there was some sort of iTunes equivalent where it was relatively easy and you could try a game for a week for a quid, and pay another four quid to keep it, then I think it's likely I would use it.

In addition to publishers, some game retailers are concerned about the popularity of the R4, which they link to declining sales of DS game cartridges.

Why TA88 v3 cannot be hacked (PSP)

dlevere@yahoo.com — Wed, 8 Oct 2008 05:26:22 -0400

Dark_AleX explains why TA88v3 cannot be hacked.

xiaNaix's Game Shark site

dlevere@yahoo.com — Tue, 7 Oct 2008 06:38:46 -0400

None of the files on this page are supported by PlayStationmods.com. They are here solely as a guide to help you along. Please do not contact technical support with any problems are questions for anything on this page.

By downloading, you agree to abide by copyright and licensing laws attached to any of these files, and you must agree not to use anything on this page for commercial purposes.

xiaNaix's Game Shark site

How to Install The Time Machine (PSP)

dlevere@yahoo.com — Sat, 4 Oct 2008 09:06:37 -0400

How to Install The Time Machine

Action Replay is now on the PSP

dlevere@yahoo.com — Thu, 2 Oct 2008 15:50:11 -0400

Datel, the creators of the Tool battery and service tools (not Pandora itself) has now ported the popular cheating device, Action Replay to the PSP. What does this mean? It means you can insert codes and unlock features within a game without Custom Firmware plug ins.

It'll set you back $39.99 if you buy from the Codejunkies store online.

Here are the features:

* 100% code engine based game enhancer - no Powersaves
* Includes a massive 1GB of storage capacity for game saves and new codes
* Free instant code updates over WiFi* or via PC download � no software to install
* Incredible in-game Action Replay menu means you can turn codes on and off in real-time
* Fluid, intuitive user interface that is fully customizable
* Works with the original SONY PSP and the PSP 2000

The concept is the same as the Pandora. It comes with a battery; called the AR Battery Enabler by Datel, which works with the included software inside the memory stick. Codes are download-able and an exciting feature is the ability to access an in-game menu, to make real-time changes.

Interested? Head over to Codejunkies. The product will ship on the 6th of October.

How to Play PSX Games on 3.80 M33-4 (PSP)

dlevere@yahoo.com — Wed, 1 Oct 2008 09:45:19 -0400

How to Play PSX Games on 3.80 M33-4

Master Guide of Customization (PSP)

dlevere@yahoo.com — Mon, 29 Sep 2008 06:04:31 -0400

Master Guide of Customization

The Detailed Guide to Fake Memory Sticks (PSP)

dlevere@yahoo.com — Sun, 28 Sep 2008 08:21:48 -0400

The Detailed Guide to Fake Memory Sticks

SaveMii launch (Wii)

dlevere@yahoo.com — Sat, 27 Sep 2008 05:24:56 -0400

SaveMii launch
September 26th, 2008 by marcan

Team Twiizers is proud to announce the new SaveMii recovery dongle. This simple device plugs into the GameCard memory slot of any Wii, and will force the Wii into a special �Recovery Mode�. This mode will allow software updates from game discs to be installed, and will boot autoboot discs for those with drivechips installed.

The target audience for this device is people who own Wiis which were bricked by installing an update from a disc from the wrong region. In the case of a semi-brick, this can be fixed using one of the semi-brick fix discs we made, or by just trying to play a newer game (and letting the system install the included update). In the case of a fully-bricked Wii, that is not possible because the system will display the Opera error message before it tries to read from the disc.

It will hopefully be useful for some other recovery scenarios as well; for systems that can boot fakesigned discs, you will be able to boot them and execute whatever code you want. You will probably only need to use it once or twice per Wii; after that, you can keep it as a souvenir, or in case you accidentally brick your Wii again, or you can sell it to a friend.

For more details, please refer to the official site and, in particular, its Wii Troubleshooting page. It should help you determine whether SaveMii will be useful to you.

CWCheat 0.2.2 Rev. D (PSP)

dlevere@yahoo.com — Thu, 25 Sep 2008 09:36:10 -0400

Weltall has released an update to the popular CWCheat universal cheat system. It includes various optimizations to help reduce the size of the binary. Here�s the changelog:

CHANGELOG:

0.2.2 REV.D RELEASE
=====================

- Now> 4.x firmwares are checked for the sony msfatmod thread suspend bug and the check of the memory stick space is disabled to avoid a freeze
situation.

- Optimizations in the firmware checking

- Added support in the gui for setting a button combination to open the text reader directly

- Added the possibility to have cwcheat look after a certain address and show changes happening to it (you can access it from the cheat search menu)

- Updated the pointer searcher to allow use from the command line. These are the arguments it takes in order to use it this way:
-cli - dump1 - dump2 - address - address

- updated the toolchain to the latest version

- Various optimizations which allowed to reduce the size of the binary

CWCheat 0.2.2 Rev. D

How to Tell if your Memory Stick is Fake (PSP)

dlevere@yahoo.com — Thu, 25 Sep 2008 09:13:24 -0400

How to Tell if your Memory Stick is Fake

Create Universal Unbricker V3 Using your Slim PSP

dlevere@yahoo.com — Wed, 24 Sep 2008 17:48:08 -0400

Create Universal Unbricker V3 Using your Slim PSP

The Witcher Trainer (PC)

dlevere@yahoo.com — Tue, 23 Sep 2008 11:30:32 -0400

This game, The Witcher, was pissing me off. I was sick and tired of grinding and only having 600 to 100 pieces of gold at any one time. I decided to hack this game with Cheat O'Matic, without success. I decided to hack this game with ArtMoney, without success. Then I found this link.

How to Hack your PSP

dlevere@yahoo.com — Mon, 22 Sep 2008 13:53:21 -0400

How to Hack your PSP

Recovery Mode Items Explained (PSP)

dlevere@yahoo.com — Sun, 21 Sep 2008 07:10:16 -0400

Recovery Mode Items Explained

How to Make a Magic Memory Stick (PSP)

dlevere@yahoo.com — Sat, 20 Sep 2008 04:25:38 -0400

How to Make a Magic Memory Stick

Hard Modding your Slim Battery (PSP)

dlevere@yahoo.com — Fri, 19 Sep 2008 07:18:37 -0400

Hard Modding your Slim Battery

How to Put Custom Firmware on Any PSP

dlevere@yahoo.com — Thu, 18 Sep 2008 08:53:40 -0400

How to Put Custom Firmware on Any PSP

CycloDS Evolution - Intro To Homebrew Kit

dlevere@yahoo.com — Wed, 17 Sep 2008 11:02:48 -0400

If you are looking for a way to get into homebrew, the good, fun, legal side of homebrew, this would be the way. If you have the time, you could end up creating some wonderful projects�that of course, would be featured on Hacking 101! Click here to pick yours up!

Link

ArtMoney (PC)

dlevere@yahoo.com — Tue, 16 Sep 2008 07:54:29 -0400

A program that works much like CEP, except that you don't need to search for a base address, and the searching function is much more simple. A great program if you're not trying to hack actual GS codes, and just want to make some codes for yourself or a friend, for any emulator, PC game, or hell, even your operating system, heh. This archive has had the known garbage removed, and has shown itself to be at least probably clean.

ArtMoney

Quake 64 GameShark Codes (N64)

dlevere@yahoo.com — Mon, 15 Sep 2008 04:02:22 -0400

Quake 64

INFINITE HEALTH ALL LEVELS
80163931 00C8

255 OF ANY AMMO
80163A2B 00FF

Code Credits:
Dlevere~The Hackmaster: ALL

Filesystem dump of a Korean Wii for analysis

dlevere@yahoo.com — Sun, 14 Sep 2008 13:08:52 -0400

Filesystem dump of a Korean Wii for analysis

PSP Custom Firmware Reference Guide

dlevere@yahoo.com — Sat, 13 Sep 2008 06:53:11 -0400

This guide has everything you need to install custom firmware on your PSP. This will work with ANY PSP with ANY firmware (yes even 4.00) It is also compatible with Vista.

PSP Custom Firmware Reference Guide

T.W.I.N.E. GUN MODS (N64)

dlevere@yahoo.com — Thu, 11 Sep 2008 07:18:35 -0400

HACKED BY DLEVERE~THE HACKMASTER

8039 code area found by Goldenboy

T.W.I.N.E.

COURIER LEVEL GUN MODS (SECRET AGENT DIFFICULTY)

WOLFRAM P2K/INFINITE AMMO/255

80395B37 0063
80395AD7 00FF

MEYER TMP/INFINITE AMMO/255

80395B5F 0063
80395AD7 00FF

MUSTANG .44 MAGNUM/INFINITE AMMO/255

80395B57 0063
80395ADB 00FF

99 DARTS
80395C1F 0063

KING'S RANSOM (AGENT DIFFICULTY)

WOLFRAM P2K/INFINITE AMMO/255/NO RELOAD

80397A73 0063
80397A13 00FF

FRINESI SPECIAL 12/INFINITE AMMO/255/NO RELOAD

80397AF3 0063
80397A1F 00FF

DEUTSCHE M-45/INFINITE AMMO/255/NO RELOAD

80397AA3 0063
80397A15 00FF

RAPTOR MAGNUM/INFINITE AMMO/255/NO RELOAD

80397A83 0063
80397A17 00FF

KING'S RANSOM (00 AGENT DIFFICULTY)

WOLFRAM P2K/INFINITE AMMO/255/NO RELOAD

80395EAF 0063
80395E4F 00FF

FRINESI SPECIAL 12/INFINITE AMMO/255/NO RELOAD

80395F2F 0063
80395E5B 00FF

DEUTSCHE M-45/INFINITE AMMO/255/NO RELOAD

80395EDF 0063
80395E51 00FF

Wii System Software: a guided tour by bushing

dlevere@yahoo.com — Tue, 9 Sep 2008 19:29:01 -0400

Wii System Software: a guided tour by bushing

Marvel Ultimate Alliance - AR MAX Codes (NTSC) (PS2)

dlevere@yahoo.com — Sun, 7 Sep 2008 09:52:02 -0400

Credit: Codes are by www.Codejunkies.com and Undertaker ba.

Action Replay MAX (NTSC)

Hacked by Codejunkies

(M)
MCGU-A47M-UN849
95NE-DPQX-J5YUK
KZAJ-2UVE-Q21BV
JRH3-G9FH-GMYVC
Z1WT-3GMM-XPEBF
3HMU-C10Z-XNQFY
MKJQ-G1KH-FDK8N
G3ET-NEXT-02KTK
5ACZ-6M01-C5YGW
135B-U465-38WDE
2K1R-UMYR-6Z80Y
PUKW-513A-F18B0
ZF0C-97H3-M0W70
AQJD-AY5R-0T609
WM03-XV7T-N3PN6
03AH-5PBC-9K2T7
4HZF-5MKT-G3580

Quick Coins
6Q7R-A483-460TE
JH3D-2Z38-J1EQQ

Hacked by Undertaker ba

MISC Codes
Max Money
77XZ-1PAF-M1QUW
QBH7-UHYA-VDP0K
YB4H-5NBD-JPKEQ
C21H-6C4X-F2C09
EV6G-Z23W-AMQ1V
4FTH-D28Q-JREBG
A2K6-Y036-HBQ4A

Always 50000 Money Picked Up
7REW-33EV-T1UN0
Y9FC-JPBM-UMM2Q

Always 25000 Money Picked Up
N16J-AQMU-E0TZX
ZW69-HNBF-ZG87A

Always 10000 Money Picked Up
R1CB-M7R8-B245E
P6WU-H745-A9092

Always 5000 Money Picked Up
9GBN-NGKY-7RK72
BDV9-2XXW-K2X12

Always 1000 Money Picked Up
9RF6-2AFU-WBMGW
4MBJ-F292-2KTNY

Always 500 Money Picked Up
M4VJ-Q93C-2VXTN
ZBGY-9DAV-FK74B

Always 100 Money Picked Up
C9QA-53BC-AAUZP
BY65-6EAF-4148Y

Unlock All Characters
87YJ-17YN-KM8RT
6BXK-7QHK-47RRF

Max Health
G6EU-JGZA-24W71
XZQB-VBHR-JXYCZ
CV85-80A4-4MP9E
FW3C-M8MT-6GZRT

Infinite Health
QVWB-3ZZG-881U8
F8DW-YUYR-TXXF1
JUZX-1JV1-WVWHV

Unlock Outfits

Black Panther
RQC8-5EA5-R58QG
UH31-2QYD-C8Z5R

Blade
2PZG-6P7Z-Q68K8
UFGQ-H8CD-APY6B

Captain America
0T4X-472K-A87FM
QXJD-XVNV-2UFF5

Daredevil
3KG3-JN3R-Z9R2W
6Q56-QE1H-F6RQ9

Deadpool
3RZA-F301-BGRYM
PXXB-J3BX-A771Q

Doctor Strange
YFTA-A6W2-T3GMG
W0G6-NW8D-DF2ZB

Elektra
KTYD-KJHN-2D111
NR29-T32A-TH8HQ

Ghost Rider
2DQW-2FW7-N2R3X
11TX-JBGJ-0UP1A

Human Torch
WN6Y-1FU2-0FWU2
BAHB-FM59-5P1XH

Colossus
NEK7-BMNE-DB6MT
Z6YQ-35KP-RZ3RC

Iceman
J74R-N1DP-Z8BAB
ZT6M-9TDM-8M8PK

Invisible Woman
C2NP-M45W-EZM2C
P5MW-HJMZ-H2R81

Luke Cage
0YQT-V4XY-TE6FC
1ERN-DG5H-7691E

Silver Surfer
8PBJ-98UN-Q5X2G
QP94-NWC1-28ZNN

Iron Man
NQAY-W095-71382
H5U0-8HM4-AFPMC

Moon Knight
1QEN-QDWC-HFDZ1
VZPC-QW16-KCPUD

Mr. Fantastic
MABN-W7ND-3NQQ8
JDDV-ZQDM-10MPV

Nick Fury
49EC-J8GD-E1U18
PJUM-D8QK-BAW34

Spider-Man
61WP-37JH-TCX5K
XDF1-PZ5W-U3XM0

Spider-Woman
Y3NY-3PEG-1776W
MVCA-R49B-1XGJ6

Storm
CN3N-TA90-3KKP6
EA08-WE0Q-7G8NH

Thing
N9FT-F81J-Y52CZ
1ZBM-P9XG-ARHUQ

Thor
99MZ-MZ37-1T4KP
TY7G-N79U-3BTT8

Ms. Marvel
T4V0-AR45-ZDR3T
MHU4-WCJ2-CFMMC

Wolverine
K6RU-59DK-ZQN9H
T3DG-UE8J-4H5XZ

All Outfits
JB6T-K7YK-89QHY
YTPX-M3BG-C7GHQ
WHWY-XB9H-NPGMC

CODE CREDITS:
www.Codejunkies.com and Undertaker ba

PC Video Game Save Hacking

dlevere@yahoo.com — Sat, 6 Sep 2008 09:43:19 -0400

Are you bored of OLD PC GAMES that you have completed and never play anymore? Well, here is a way to give your old game a new life. Basically, you will learn how to change the save file to get whatever you want in the game.

PC Video Game Save Hacking

How To Cheat On Guitar Hero

dlevere@yahoo.com — Fri, 5 Sep 2008 21:22:24 -0400

Cheating At Guitar Hero: An introduction to show controllers, by David Randolph

David Randolph's back to Systm with a vengeance, out from the studio and dipping into his previous life building interactive museum displays... to cheat at Guitar Hero.

Or, to look at it in a different light, David's figured out how to automate Guitar Hero by wiring one of Gilderfluke & Co's spiffy "Show Control Systems" the BR-miniBrick8 into a Guitar Hero Guitar.

And the tricky part, of course, programming it to play Foghat's "Slow Ride."

Wondering what exactly a Show Controller is? Think tiny gadget that can turn other devices on and off...or trigger them...or, you know, control them!

They're a integral part of the museum exhibits David used to make for a living!

How To Cheat On Guitar Hero

Capcom explains siding with Nintendo in R4 lawsuit

dlevere@yahoo.com — Tue, 2 Sep 2008 16:10:19 -0400

There are companies that sell downloads without any license in the U.S.A., while a considerable number of pirated copies of game software are available in the Chinese market. In response to these situations, this lawsuit took the initiative for the whole industry in terms of taking countermeasures. It does not necessarily have a great effect at this stage, but we intend to send a wake-up call to such companies in the future. - Capcom statement

This really is an issue that could threaten the entire industry, and to a point, it already is. This kind of stuff has to be stamped out before it gets out of hand. The only problem is, there is a great homebrew scene for the R4.

PDP TO SHUT DOWN CODEBREAKER

dlevere@yahoo.com — Thu, 28 Aug 2008 04:34:40 -0400

On July 22nd, 2008, PDP (Performance Design Products, parent company of Pelican Accessories) released a press release to announce the end of the Code Breaker line of products. As a result, code updates will be slow and will eventually end. It is not known what direction CMGSCCC will take at that time, but don't worry...We'll be around for some time.

We will continue to provide the best support we can for our existing customers.

July 22, 2008
PDP TO SHUT DOWN CODEBREAKER - Company to Expand into Game Publishing

Los Angeles - Performance Designed Products, LLC ("PDP") announced today that it is discontinuing its line of CodeBreaker cheat products.

"CodeBreaker has been a nice business for us over the years," said John Moore, Vice President of Marketing for PDP. "Gamers have enjoyed unlocking secret codes to access characters, special weapons and areas in games they normally would not have been able to explore without our CodeBreaker products. However, PDP is entering a new phase of our business and CodeBreaker does not make sense for us given this change in strategic direction."

PDP has been marketing CodeBreaker under the Pelican brand since 1999 including the most recent versions for the PlayStation 2 and Nintendo DS, which were sold at major retailers around the country. Support of these products will continue on-line for our existing customers for a period of time; however, no new content will be generated. For more information please log on to www.codebreaker.com

"As we expand into the video game publishing business we didn't want to be perceived as having a conflict of interest as both a game publisher and a company that offers cheat code products for other publishers' video game titles," said Moore. "We also wanted to focus more of our attention and efforts on other growth areas of our business."

Performance Designed Products is an industry leader in designing and manufacturing products for all major video game platforms including the PS2, PS3, PSP, Wii, GameCube, Nintendo DS, XBOX 360, and XBOX. The company has been supplying video game accessories to the U.S. market for more than a decade. PDP sells products under the Pelican and Score brands with sales in the U.S., Canada, Mexico, and throughout Europe. For more information on PDP and its products, visit www.pdp.com

Pandora Kit - UNBRICK ANY PSP

dlevere@yahoo.com — Sat, 23 Aug 2008 05:01:44 -0400

Pandora Kit - UNBRICK ANY PSP

Action Replay DS - The Official Guide

dlevere@yahoo.com — Thu, 21 Aug 2008 18:29:42 -0400

By Vermillion

Because many people ask questions related to the Action Replay DS, I have decided to write this tutorial, to teach you How to install Action Replay DS properly, how to add codes, and how to use Action Replay DS.

Note that this tutorial only covers the info for Action Replay DS, if you have Action Replay DS MAX, sorry, you will have to ask somewhere else.

If you have any questions, feel free to ask here, your questions will be answered by people from the community or by myself. Hope you find this useful.

Action Replay DS - The Official Guide

Ultimate PSP Apps Collection

dlevere@yahoo.com — Wed, 20 Aug 2008 06:53:11 -0400

This Thread is made of up almost every single PSP App there is.

Ultimate PSP Apps Collection

Introduction to Nintendo DS Programming v4.0

dlevere@yahoo.com — Sun, 17 Aug 2008 09:00:59 -0400

Jaeden Amero has updated his Introduction to Nintendo DS Programming, which is a manual for all you DS homebrew developers out there. The manual covers topics important to the homebrew community, such as the legality of homebrew and the politics behind it, displaying backgrounds on both screens, sprites and some aspects of game mechanics.

According to the author, Introduction to Nintendo DS Programming v4.0 features a brand new section on VRAM exploration in the manual's Appendix A. The section includes VRAM usage and layout. If you're having problems with designing a 2D graphics engine, this version would be a lot of help. Aside from that, Introduction to Nintendo DS Programming v4.0 has an updated page layout for easier reading.

Download: Introduction to Nintendo DS Programming v4.0

Libdi and the DVDX installer (Wii)

dlevere@yahoo.com — Sat, 16 Aug 2008 02:40:41 -0400

By Erant

To all newcomers to Wii Homebrew:

Welcome! We hope you enjoy the wonderful world of homebrew software. Since this post is primarily about the DVD player in particular, and assumes that you are at least familiar with the usage of homebrew software on the Wii, we would appreciate it if you avoid asking general questions like �How do I run this on my Wii?� in the comments - replying to these questions is very hard and clutters up the already long comment list. Instead, you�ll find lots of information at Wiibrew.

Short version: You will normally use The Homebrew Channel to boot Wii Homebrew. Modchip users with firmware version under 3.2 can just download the installer ISO and boot it. Users of firmware 3.3 or without a modchip will need a (legit) copy of Twilight Princess and a special hacked savegame that will let you boot the Homebrew Channel installer from your SD card. More detailed guide here. Thanks, and enjoy!

As you all know, I�ve been working on libdi (or the DVD Access library) for a while now. We had some problems getting it out to release because of the difficulties we encountered while writing the second part of this topic. The DVDX installer instead will install a small, hidden, channel on your Wii that allows you to read DVD's on an unmodified system. It is not an installer for a patched IOS. You may however need one, depending on your system.

Usage of this package is fairly simple. Run the installer.dol found in the package, follow the on screen instructions, and you�re done.

Once you�ve done that, you can enjoy the splendor of mplayer. That what started out as a simple proof of concept has rapidly turned into a full-featured media player, under the nourishing hands of dhewg. The main aim of the mplayer project was to get DVDVideo going, but it also supports reading video files off the SD card. (Experimental).

A patch for Wii64, the N64 emulator for the Wii, will also be available shortly. This patch will allow you to read games off a DVD.

Download links:

DVDX installer (end users)
libdi (developers)
mplayer

If you have a modchip, you also need patchmii, in addition to the DVDX stub installer.

patchmii_core

Note that libdi itself is meant for developers, as it is embedded into applications that use it. libdi requires the DVDX stub. End-users will only need the installer, which can be downloaded separately here.

Please note that DVD+R (as opposed to DVD-R) discs will need to have their BookType set to DVD-ROM to work properly in Normal mode (if you have no modchip). PatchMii mode does not have this requirement, but requires a modchip.

DVD video playback enabled via homebrew! (Wii)

dlevere@yahoo.com — Wed, 13 Aug 2008 13:42:56 -0400

Homebrewer Erant has created a program that allows the Wii to read DVD's. It comes bundled with a media player program that lets you play DVD movies as well as view video files stored on an SD card, without any hardware modifications. You still need to be able to run homebrew on your Wii, but that's done easily enough.

The commenter's in the announcement post seem to be having mixed success with the program, with results ranging from, at best "Excellent! Works like a charm." to "It doesn't seem to play DVD's on my Wii," to the worst possible outcome, "watching Hackers (1995) right now."

As a sort of proof of concept of the new DVD-reading capability for uses other than video, a patch will soon be available for Nintendo 64 emulator Wii64 to allow ROM's to be read from DVD's.

The homebrew community is doing amazing things with the Wii. Have you read about the app that lets you play games from other regions? What about getting Goldeneye to run on Wii? Or you could just use homebrew to get your cheat on.

GBATemp's Nintendo DS homebrew bounty

dlevere@yahoo.com — Tue, 12 Aug 2008 05:07:20 -0400

GBATemp is offering a generous monthly bounty for the best Nintendo DS homebrew: $200, plus donations (currently up to $200), plus $50 from Dev-fr.org for the runner-up. This move will hopefully bolster an already thriving homebrew community.

Some DS homebrew: a fairly comprehensive list on Wikipedia, a dated list of 30 great homebrew apps, a guide to emulators on the DS.

If you want to purchase a DS flash cart, browse this forum for advice. (Scroll down past all the subforums.)

GBATemp is one of the best resources for DS homebrew. Unfortunately, there's a lot of piracy talk, even though ROM links are explicitly forbidden.

Cheat Engine Basics Tutorial (PC)

dlevere@yahoo.com — Tue, 12 Aug 2008 04:17:23 -0400

By Nereid666
Advanced Cheater

Yo! I noticed that many people ask for help in CE tutorial. So I decided to explain it here. I will not explain only to pass it but to learn some basics. Do not use password just to pass step you can't do, that's useless. You won't learn and gain anything...
If someone will make topic "Help on 3rd step of tutorial!!" or anything like that, direct him to this one, unless mine is not explained clearly/he do not understand what I wrote.

If you will see that something is not right or something is not clearly explained, PM me and I will edit it.

This tutorial contains 7 steps. You can jump to anyone you want when you will enter password in 1st step window in right bottom corner. Ok, here we go:

FIRST OF ALL, open Cheat Engine. If it will ask you to open tutorial, click yes. If u already clicked no, go to cheat engine folder and find it there. Once you opened tutorial, we can start...

(Texts wrote in "code", with darker background are default step descriptions, below them there is mine)

Step1 - Introduction

Code:

Welcome to the Cheat Engine Tutorial. (v2.5)

This tutorial will try to explain the basics of cheating on games, and getting you more familiar with Cheat Engine.

First open Cheat Engine if it hasn't been opened yet.
Then click on the 'open process' icon. (top left icon, with the computer on it)

When the process window is open find this tutorial. The process name is probably 'tutorial.exe' unless you renamed
me.
Select it, and click ok. Just ignore all the other buttons right now, but experiment with them later if you feel like it.

When everything went right, the process window should be gone now and at the top of CE the process name is
shown.

Now, click NEXT to continue to the next step. (Or fill in the password to proceed to that particular step you want)

First open Cheat Engine and Tutorial. Now, click the button with computer icon on it (It's in top left corner). New window will pop up. Here, you can choose process that you want cheat with. Find Tutorial.exe process, click on it and click Ok button, or just double click on this process. If you done everything right, process name you chose(Tutorial.exe) should be written in top of Cheat Engine window. If it does, click next.

Step 2 - Exact Value scanning (Password: 090453)

Code:

Now that you have opened the tutorial with Cheat Engine lets get on with the next step.

You see at the bottom of this window the text Health: xxx
Each time you click 'Hit me' your health gets decreased.

To get to the next step you have to find this value and change it to 1000

To find the value there are different ways, but I'll tell you about the easiest, 'Exact Value':
First make sure value type is set to at least 2 bytes or 4 bytes, 1 byte will also work, but you'll run into a
(easy to fix) problem when you've found the address and want to change it. The 8-byte may perhaps works if the
bytes
after the address are 0, but I wouldn't take the bet.
Single, double, and the other scans just dont work, because they store the value in a different way.

When the value type is set correctly, make sure the scantype is set to 'Exact Value'
Then fill in the number your health is in the value box. And click 'First Scan'
After a while (if you have a extremly slow pc) the scan is done and the results are shown in the list on the
left(if
the number of addresses it found are less than the number below that list)

If you find more than 1 address and you dont know for sure wich address it is, click 'Hit me', fill in the new
health
value into the value box, and click 'Next Scan'
repeat this untill you're sure you've found it. (that includes that there's only 1 address in the list.....)

Now double click the address in the list on the left. This makes the address pop-up in the list at the bottom,
showing you the current value.
Double click the value, (or select it and press enter), and change the value to 1000.

If everything went ok the next button should become enabled, and you're ready for the next step.

Note:
If you did anything wrong while scanning, click "New Scan" and repeat the scanning again.
Also, try playing around with the value and click 'hit me'

In this step you have to find health value and change it to 1000.You will learn here how use Exact Value Scanning and for what is it. Let's say that you play some game, and with each hit we lose some HP (health). Now force enemy to hit you (click "Hit me" button below your health). As you can see, your health decreased. Now go to Cheat Engine, in Scan Type choose Exact Value, in Value Type choose 4 Bytes, type number of your health in window above Scan Type and click First Scan (If you already have scanned before, cause you were curious or you wanted to click this button, you will have New Scan instead of First Scan. Click it and then do what I just said). Below computer icon (this one in top left corner) you can see "Found:". It shows you how many addresses with value matching to one you wrote were found. If there are too many ("too many" are when addresses are not displayed in window below "found:", in CE v5.3 there is probably no limit for displayed addresses...), click New Scan and get hurt once again (by clicking on "Hit me" in tutorial window). Type in CE new HP value and click First Scan. Do it until some addresses will be displayed in window below "found:". Of course there are more ways to find correct value, but this tutorial heading is "Exact Value Scanning", so we will use only this option.

Ok when you have displayed few addresses, go to tutorial (Leave CE as it is, with these addresses in the list) and click "Hit me". Go to CE, look on found addresses list and find decreased value (previously every address was equal to number of health before this hit. So when previously your health were 96, look for value smaller than this one, but at once it have to be equal to new health number). Example: I had 96HP, and after that hit I lost 5, so now I have 91. So I have to look for 91 value, while almost every other will be 96. So our will differ from others, which makes it easy to find.

Once we found it, click on it and press red arrow pointing to left/down, or just double click on it. It will show in window on bottom of CE. There you can see 5 labels: Freeze (If it's ticked, value of address in same line will be froze/stopped, it will not be able to change), Description (as it says, you can add it by yourself), Address (shows address), Value Type (Shows type of value stored in address in same line), Value (shows value stored in address in same line). Our objective is to change HP value to 1000, so double click on value. New window will open with current amount of value. Change it to 1000 and click OK. If everything went ok, you should be able to click Next in tutorial window to go to next step. If you can't that means that you changed value to wrong one, or you changed wrong value(you have wrong address).

So if you made something wrong here's one more time everything what above, but in shorter version:

1. In tutorial click hit me
2. In cheat engine write number of your health and click first scan
3. If you got too many addresses, press new scan, then hit me and write new amount of HP. Repeat it until you will find only few addresses (about 20-30 or less).
4. If you found enough few, go to tutorial and click hit me
5. Go to cheat engine, look on list of addresses on left and look there for address equal to new amount of HP (it's easy to find it cause it differs from others)
6. If you found it, double click on it. It will move to window on bottom
7. Now double click its value (It is in vertical line under Value label). New window will show
8. Write here 1000 and click OK
9. Go to tutorial and click Next

Step 3 Unknown Initial Value (Password: 419482)

Code:

Ok, seeing that you've figured out how to find a value using exact value let's move on to the next step.

In the previous test we knew the initial value so we could do a exact value, but now we have a status bar where
we don't know the starting value.
We only know that the value is between 0 and 500. And each time you click 'hit me' you lose some health. The
amount you lose each time is shown above the status bar.

Again there are several different ways to find the value. (like doing a decreased value by... scan), but I'll only
explain the easiest. "Unknown initial value", and decreased value.
Because you don't know the value it is right now, a exact value wont do any good, so choose as scan type
'Unknown initial value', again, the value type is 4-bytes. (most windows apps use 4-bytes)
click first scan and wait till it's done.

When it is done click 'hit me'. You'll lose some of your health. (the amount you lost shows for a few seconds and
then disappears, but you don't need that)
Now go to Cheat Engine, and choose 'Decreased Value' and click 'Next Scan'
When that scan is done, click hit me again, and repeat the above till you only find a few.

We know the value is between 0 and 500, so pick the one that is most likely the address we need, and add it to
the list.
Now change the health to 5000, to proceed to the next step.

Ok here you have to find value stored in bar and change it to 5000. Same as previous, but here we do not have exact value, but bar! What could be stored in it ? One thing is sure, value from 0 to 500. It would take way too long to search for every value using exact value scan type. So here we have to look for "Unknown Initial Value". In Scan Type choose it and click first scan. It should find a lot of addresses(it finds ALL addresses that store 4 bytes values, unless you choose other value type). So to reduce this amount a little, we have two options:

1. Easier (for beginners): After first scan click "Hit me" in tutorial, go to cheat engine and, change Scan Type to Decreased value (you know why, cause we will look for decreased values, and one of them is our health) and click Next Scan. It should find few addresses. Our address is 0 - 500, so look for similar one. If you found more than one, and you aren't sure which one is it, you can click "Hit me" and check which one decreased, or click "Hit me" and scan for Decreased Value once more. Your choice.

2. Faster (You have to remember decreased value if you want to use this one) - After first scan click "Hit me" in tutorial, go to cheat engine and, change Scan Type to Decreased value by and write here amount of lost HP(if you clicked "Hit me" more times, you have to sum up every decreased amount ) and click Next Scan (example: I clicked Hit me and I lost 5hp, so I write 5). It should find only 1, at least ONLY few values.

Ok now we have value stored in bar, change it to 5000 (if you got to this step by yourself, I assume that you can do it). After that, click Next in tutorial window to go to 4th step.

Step 4: Floating Points (Password: 890124)

Code:

In the previous tutorial we used bytes to scan, but some games store information in so called 'floating point' notations.
(probably to prevent simple memory scanners from finding it the easy way)
a floating point is a value with some digits behind the point. (like 5.12 or 11321.1)

Below you see your health and ammo. Both are stored as Floating point notations, but health is stored as a float and
ammo is stored as a double.
Click on hit me to lose some health, and on shoot to decrease your ammo with 0.5

You have to set BOTH values to 5000 or higher to proceed.

Exact value scan will work fine here, but you may want to experiment with other types too.

Hint: It is recommended to disable "Fast Scan" for type float.

Here we have to find value for HP and ammo and change them to 5000 or higher. Do it same as previous, but instead of 4 bytes Value Type look for Float (if you scan for HP) or Double (if you scan for ammo). If you need explanation, here it is:

Change Value Type to Float, Scan Type to Exact Value and look for . Use exact value with floats and doubles ONLY if value you look for do not have numbers behind dot (91.56). If it has, use some other options like Value Between and write here you know what. If somehow you don't know, here is example (I have 56.81321384321964 HP, so I will write in Value Between 56 and 57, or 56.8 and 56.9 for more precise scanning). Of course you can use others if you want.

Once you found HP value, double click on it to add it to bottom list (let's call this list Cheat List). Now do the same but change scan type to Double and look for ammo (you can use Values Between too if you want).
If you will find both addresses, change their values to 5000 or higher, go to tutorial and click Next.

Step : Code Finder (Password: 888899)

Code:

Sometimes the location something is stored at changes when you restart the game, or even while you're playing.. In
that case you can use 2 things to still make a table that
works.
In this step I'll try to descibe how to use the Code Finder function.

The value down here will be at a different location each time you start the tutorial, so a normal entry in the address
list wouldn't work.
First try to find the address. (you've got to this point so I assume you know how to)
When you've found the address, right-click the address in Cheat Engine and choose "Find out what writes to this
address". A window will pop up with an empty list.
Then click on the Change value button in this tutorial, and go back to Cheat Engine. If evrything went right there
should be an address with assembler code there now.
Click it and choose the replace option to replace it with code that does nothing. That will also add the code address
to the code list in the advanced options window. (Wich gets saved if you save your table)

Click on stop, so the game will start running normal again, and close to close the window.
Now, click on Change value, and if everything went right the Next button should become clickable.

Note: When you're freezing the address with a high enough speed it may happen that next becomes visible anyhow

Ok scan for value that is in tutorial. If you got this far by yourself, you have to be able to find it. Once you found correct one, add it to Cheat List. Now right click on it and choose "Find out what writes to this address". Confirmation window will pop up, click YES. Now you can see empty window with some unclickable buttons. Ok go to tutorial and click Change Value. Return to blank window. Some strange line of letters will appear in it. Click on it once and then press Replace (button to the right). Choose any name you want, you won't need it now and click OK. Click Stop and then Close to return to Cheat Engine main window. Ok I'm explaining what you just did:

You replaced code that was responsible for changing value with nothing, so now Change Value button in tutorial window will NOT work. Want to see? Go ahead to tutorial and click Change value. See? Once you did it, Next button should be available. Click it to proceed to 6th step.

Step 6: Pointers (Password: 098712)

Code:

In the previous step I explained how to use the Code finder to handle changing locations. But that method alone
makes it difficult to find the address to set the values you want.
Thats why there are pointers:

At the bottom you'll find 2 buttons. One will change the value, and the other changes the value AND the location of
the value.
For this step you dont really need to know assembler, but it helps a lot if you do.

First find the address of the value. When you've found it use the function to find out what writes to that address.
Change the value again, and a item will show in the list. Double click that item. (or select and click on more info) and
a new window will open with detailed information on what happened when the instruction ran.
If the assembler instruction doesnt have anything between a '<' and '>' then use another item in the list.
If it does it will say what it think will be the value of the pointer you need.
Go back to the main cheat engine window (you can keep this extra info window open if you want, but if you close it,
remember what is between the ) and do a 4 byte scan in hexadecimal for the value the extra info told you.
When done scanning it may return 1 or a few hundred addresses. Most of the time the address you need will be the
smallest one. Now click on manually add and select the pointer checkbox.

The window will change and allows you to type in the address of a pointer and a offset.
Fill in as address the address you just found.
If the assembler instruction has a calculation (e.g: ) at the end then type the value in that's at the end. else
leave it 0. If it was a more complicated instruction look at the calculation.

example of a more complicated instruction:
eax=4C and edx=00801234.
In this case EDX would be the value the pointer has, and EAX*2+00000310 the offset, so the offset you'd fill in
would be 2*4C+00000310=3A8. (this is all in hex, use cal.exe from windows in scientific mode to calculate)

Back to the tutorial, click OK and the address will be added, If all went right the address will show P->xxxxxxx, with
xxxxxxx being the address of the value you found. If thats not right, you've done something wrong.
Now, change the value using the pointer you added in 5000 and freeze it. Then click Change pointer, and if all went
right the next button will become visible.

extra:
In this tutorial the value is actually pointed to by a pointer to a pointer, but to finish this tutorial only 1 pointer will be
needed. To find the pointer to this pointer, just search for what changes the value of the pointer.
If you know assembler, you may see something like
mov eax,
mov eax,
Dont be confused by this. just use the value the extra info window tells you. ebp-4 points to the stack which
contained the pointer to this pointer, but the stack location does change all the time, so dont search for ebp, search
for the value of eax

Pointers are wonderful. They posses great power. They are very useful. Like I said, VERY useful. Pointer is like arrow/line/finger that points specific addresses value. It will point it always, even if value will change its location. Most games now uses values changing addresses, so pointers are really important.

First, scan for value shown on the bottom of tutorial window. If you will find it, find out what writes to it, go to tutorial and change value. Now return to window that appeared after clicking "find out what writes to this address". There should be some code. Click on it and select "More information" or just double click it. See code with red arrows on its left? If it points to code that's between , look what is written under "The value of the pointer needed to find this address is probably" and Remember it. Now go to CE main window, and tick "Hex" box near window where you write value that you want to scan for. If you ticked it, in window next to this box should appear 00000000. Change it with remembered value and click First Scan. It should find one/few addresses. Now, look at left and down. You will see "Add address manually" button. Press it. New window should pop up. In it, tick "Pointer" box. After this, window should get longer. In Address of pointer write address (Address, no value! Address is this one on left, under "Address" label)which you found when you were scanning for hex value. In Offset (hex) write 0 (yea, just zero). Click OK. In bottom window you should see new address, like P->xxxxxxxx, and next to it its value. If value is ??, you made something wrong. Here is shorter version for this, if you failed:

1. Find value (this one in tutorial window)
2. Find out what writes to it
3. Change value and double click on just shown code in "Find out what" window
4. Remember what is written under The value of the pointer needed to find this address is probably
5. In Cheat engine tick "Hex" box (it's under New Scan/First Scan)
6. Write remembered code and scan for it
7. If it found 1 address, remember it. If it found few, correct one is probably this one at the top. NOTE. Remember Address, no value! This is important!
8. Click "Add address manually" button
9. Tick "Pointer" box
10. In Address of pointer write remembered address
11. In Offset (Hex) leave 0
12. Click Ok
13. in bottom window look on new address (it should be P->xxxxxxxx)
14. If its value is ??, repeat step from 1-14

Go to tutorial window and click Change Pointer. Now you have 3 seconds to change our pointer (address with P->xxxxxxxx) to 5000. Don't worry if you missed. Just once more click Change Pointer and once more try to change it in time. If you will, click Next.

Step 7: Code Injection: (Password: 013370)

Code:

Code injection is a technique where one injects a piece of code into the target process, and then reroute the
execution of code to go through your own written code

In this tutorial you'll have a health value and a button that will decrease your health with 1 each time you click it.
Your task is to use code injection to increase the value of your health with 2 every time it is clicked

Start with finding the address and then find what writes to it.
then when you've found the code that decreases it browse to that address in the disassembler, and open the auto
assembler window (ctrl+a)
There click on template and then code injection, and give it the address that decreases health (If it isn't already filled
in correctly)
That'll generate a basic auto assembler injection framework you can use for your code.

Notice the alloc, that'll allocate a block of memory for your code cave, in the past, in the pre windows 2000 systems,
people had to find code caves in the memory(regions of memory unused by the game), but that's luckily a thing f
the past since windows 2000, and will these days cause errors when trying to be used, due to SP2 of XP and the NX
bit of new CPU's

Also notice the line newmem: and originalcode: and the text "Place your code here"
As you guessed it, write your code here that will increase the health with 2.
a usefull assembnler instruction in this case is the "ADD instruction"
here are a few examples:
"ADD <00901234>,9" to increase the address at 00901234 with 9
"ADD ,9" to increase the address pointed to by ESP+4 with 9
In this case, you'll have to use the same thing between the brackets as the original code has that decreases your
health

Notice:
It is recommended to delete the line that decreases your health from the original code section, else you'll have to
increase your health with 3 (you increase with 3, the original code decreases with 1, so the end result is increase
with 2), which might become confusing. But it's all up to you and your programming.

Notice 2:
In some games the original code can exist out of multiple instructions, and sometimes, not always, it might happen
that a code at another place jumps into your jump instruction end will then cause unknown behavior. If that
happens, you should usually look near that instruction and see the jumps and fix it, or perhaps even choose to use a
different address to do the code injection from. As long as you're able to figure out the address to change from inside
your injected code.

Ok now you are in 7th step, you can't call yourself n00b anymore (If you got here by yourself). So, code injection, as it says, is when you inject code/piece of code into the process. Like in this tutorial, we have HP and it decrease by 1 every time you click "Hit me". We have to inject our code to change Hit me button operation. It has to increase (yea, increase, never heard about Hit me increasing health) HP by 2 every time we will click it. So let�s do it.
Find that value and find out what writes to that address. Then decrease HP (by clicking Hit me). In "find out what" window some code will appear. It's responsible for HP decrement by 1. Click it and then press "Show Disassembler". Big window with 3 sub windows will appear. At the top of upper left window you will see code that decrease HP by 1. Click it to see its comment (Comment is shown between top and bottom window, in this narrow bar).
It should be "Decrement by 1". Ok that was unnecessary. Now go to tools -> Auto Assemble, or just click Ctrl + A. White window will pop up, in which click Template -> Code Injection. Write here address of health decrement(It should be already filled in with correct code. To ensure, write there address with "Decrement by 1" comment). Some assembler strings will appear. It's . Whatever it is, I call it template. Now, you see "// Place your code here" under "newmem" (every phrase in assembler started with "//" is comment and they are not entertain when compiling/writing code). According to tutorial, you have to write your code there, but there are 3 options(I have no idea what assembler rules are or whatever, so I have no idea if there is any difference between these options. If someone know and there IS difference, PM me and i will eventually change it).

Important!: Remember, that "Your code" is this one wrote in Memory Viewer after second dash in line where is your address(this address with "Decrement by 1" comment). We call it "your code" but really it's just code that we want to cheat/change/inject into it code.

By the way: I gathered some info about few assembler instructions by myself, for now I haven't asked anyone if it's true, but I will write it here:
- "inc" instruction increases addresses value by 1 (I can't set it to increase more, I don't even know if it's possible)
- "dec" instruction decreases addresses value by 1 (See: what is above in brackets)
- "add" instruction adds to addresses value, value that is after the code, after coma.

Ok back to tutorial. 3 options: (Remember that is our code, I hope you know what our code is, if you do not, once more read starting with Important!)

1. Like it's in tutorial, write your code (with format) in place of "// Place your code here" comment, and at the beginning of this code place "add" (with space between "add" and code). Now, after this code, write ",3"("coma three", no spaces. In total it should look like this: "add" ,3 ). Do you know why 3 (we want to increase value by 2, not 3!)? Because few lines under newmem there is orginalcode, which decrease this value by 1. Our code increase by 3, so in total (decrease by 1 and increase by 3) these codes increase value by 2.

2. If you don't want that orginalcode to decrease our value (so we could write 2 after code under newmem, not 3), delete "orginalcode:" and "label(orgianlcode)"(this label is in third line from top). Now, change value after your code (under newmem) from 3 to 2, because there is no orginalcode now, which was decreasing our value by 1. I hope you understand.

2. I made some mistake in third option, i will edit it in minute...

Now if you done one of written options, click "Write Code" button at the bottom of Auto Assemble window. If it shows some error, unfortunately you have to repeat. If it shows confirmation window, click OK. Now every time you will click Hit me in tutorial window, your HP should increase by 2. If they does, that�s mean that you made everything correct and Next button will be clickable. Click it to go to last step in Cheat Engine 5.3.

If they doesn't... well... repeating it would be boring and useless, so i created 3 ready codes for every option:

1. Version according to tutorial:
Code:
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)

00455D7F:
jmp newmem
nop
returnhere:

newmem:
add ,3

originalcode:
dec

exit:
jmp returnhere

2. Version without orginalcode:
Code:
alloc(newmem,2048)
label(returnhere)
label(exit)

00455D7F:
jmp newmem
nop
returnhere:

newmem:
add ,2

exit:
jmp returnhere

3. Version with no use of newmem, just changing orginal code:
Code:
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)

00455D7F:
jmp newmem
nop
returnhere:

newmem:

originalcode:
add ,2

exit:
jmp returnhere

For me every option worked, if you will have some error or something in any option, tell me.

�

That's all...
_________________
HERE MY HACKING CAREER ENDS! FAREWELL, GUYS!
Special THANKS for Glest, for getting me through this pleasant hacking experience and DarkByte for making CE, and every other guy that helped... I wasn't hacker, but script kiddie wasn't bad too Wink THX

A Guide to Number Systems

dlevere@yahoo.com — Sat, 9 Aug 2008 01:42:44 -0400

Study Guide on understanding Decimal, Hex and Binary Number Systems. The broad objectives covered in this course are:

* Binary-Hex Introduction
* Binary Numbers and Internet
* Converting Decimal to Binary
* Converting Binary to Decimal
* Decimal-Binary Similarities
* Hex Tutorial Introduction
* Convert Hex to decimal
* Hexadecimal Numbering System
* Decimal to Hex conversion introduction
* How to convert Dec to Hex
* How to convert Hex to Dec
* IP Addresses in Hexadecimal Notation

A Guide to Number Systems

Playstation Programming without official tools

dlevere@yahoo.com — Sat, 9 Aug 2008 01:42:06 -0400

Private PlayStation programming by C/C++

NOT YAROZE

Game Boy programming

dlevere@yahoo.com — Mon, 4 Aug 2008 07:31:53 -0400

A small text on Game Boy programming.

Developing On the PS3 Under Fedora

dlevere@yahoo.com — Sun, 3 Aug 2008 01:13:17 -0400

An anonymous reader writes to point out the first in a series of articles from a while back about using the Playstation 3 as a development environment under Fedora. Here are the second and third parts of the series.

ProjectV by Lazy Bastard

dlevere@yahoo.com — Fri, 1 Aug 2008 08:03:28 -0400

This is it: Project Vocab. It was started originally a while back, but was postponed due to my extreme laziness. It's simply a list of words and terms of the VG hacking scene that any hacker or long-time member should know.

Other than that, the only thing you should know is that it is by no means finished, will remain open-ended indefinitely, and will be updated each time I think of or am reminded of another word or term that should be included. Please e-mail me or one of the GSHI admins if you think of something that should be covered.

-Lazy Bastard

Wii homebrew made dead simple

dlevere@yahoo.com — Wed, 30 Jul 2008 08:14:59 -0400

If you've been too scared to try Wii homebrew in the past, you'll be interested in this latest project, which is sort of...meta-homebrew.

The Wii Pack Generator holds your hand through the process of downloading homebrew, making it as simple as clicking on some check buttons and unzipping a file.

The Wii Pack Generator allows you to choose the programs you'd like to install from a list, and then generates a self-extracting archive containing the Twilight Hack file, the Homebrew Channel installer, and the programs of your choice. All you have to do is extract it onto an SD card!

The most complicated part of this whole thing is figuring out who the participants are. This is a project of wiibrew.com, not the well-known wiibrew.org that runs the Wii homebrew wiki.

ELF Mutilator v1.0 by Viper187 (PS2)

dlevere@yahoo.com — Tue, 29 Jul 2008 08:34:55 -0400

ELF Mutilator v1.0

Get it while it's hot.

I got tired of not being able to save in PS2Dis, and I decided it was time to learn enough Win32 API to write one of these in C. It supports PS2, PS1, and N64 disassembly. Check out the read me for more info.

-Viper187

Xploder Cheatsaves for Grand Theft Auto 4 (PS3)

dlevere@yahoo.com — Mon, 28 Jul 2008 03:32:30 -0400

Newly released in the UK at Amazon UK:

Access great cheatsaves for GTA 4, Xploder blows your games wide open! Have access to new weapons, loads of money and missions unlocked, Xploder cheatsaves gets you ahead of the game!

Also includes cheatsaves for Gran Turismo 5 - Prologue, Call of Duty 4, Assassins Creed and many more!

BONUS: Take control of your PS3 and PSP media with Xploder HD Movie Player & Media Manager, the complete media management tool for your PS3 and PSP movies, music and photos.

MOVIES - Includes PS3 HD Movie Converter. Convert movie files into AVC (.MP4) for playback on PS3 & PSP; Non copy-protected DVDs (VOB), MKV, Xvid, DivX, MPEG 1, M1P, MPEG 2, TS, M2P, WMV, ASF, MP4 and AVI formats. Multiple video output selection allows optimum settings for both PSP and PS3, with PSP files automatically renamed in line with the PSP file format structure.

MUSIC - Transfer music from your existing iTunes database. Convert your CDs to MP3 with auto completion of artist, track and album details via the online database. Attach album artwork to your MP3 music files. Simply drag-and-drop MP3, AAC and WMA files to your memory card or USB device for playback on PS3 and PSP.

IMAGES - Manage your photo and image gallery for viewing on PS3 and PSP. Preview thumbnail images from within the Xploder software and simply copy them across to your portable memory device for viewing on the PS3 or PSP.

SAVES - Download PS3 cheatsaves for latest and greatest games including assassins creed, Heavenly Sword, Call of Duty 4 and many more!

Extracting the Elf from the Game (PS2)

dlevere@yahoo.com — Sat, 26 Jul 2008 06:16:21 -0400

You need three (3) things...

1. The Game
2. DVD drive on your computer
3. WinRaR (better compression, and saves space on PC)

What is an elf file?
It's the file we use to make codes.

What does an .elf file look like?
SLES_###.##
SLUS_###.##
SCES_###.##
SCUS_###.##
SCPS_###.##
SLPS_###.##
PBPX_###.##
.elf
.ntgui

Extracting the Elf from the Game

How to convert from/to CodeBreaker 7.0+ (PS2)

dlevere@yahoo.com — Wed, 23 Jul 2008 06:01:39 -0400

This FAQ was made to show you how to convert between CodeBreaker v7.0+ to Action Replay MAX, and vice versa.

FAQ written by: Wayne

How to convert from/to CodeBreaker 7.0+

Fixed, Pre-Built, Win32 PS2 SDK Released

dlevere@yahoo.com — Mon, 21 Jul 2008 08:38:57 -0400

Some great news for any folks considering PS2 Development:

News from Lazy Bastard, GSHI

I've been working on reviving Win32 homebrew PS2 development, by tackling its most irritating problem: that there currently isn't a working Win32 development environment available. As such, the only way to program with the (PS2Dev.org) PS2SDK has been via Linux, either actually installed, or from within a virtual environment.

Hence, starting from a base of Lukasz Bruun's tutorial on installing the PS2SDK in MinGW, and with help from several people in the PS2Dev scene (who I will mention below), I've fixed, built, further fixed, and slightly revamped the MinGW environment and current PS2SDK, for use right out of the box (or the archive, in this case). Copied and pasted from the readme.txt I threw together:

This is the fully compiled PS2SDK, using msys and MinGW (fixed), including gsKit (fixed) and the SDL port (for further graphics support), SDL Mixer (for better sound/music support) and ps2-packer-lite-0.4.4-win32 (for packing and unpacking, and in alignment with some sources floating around the 'net). Essentially, we have a fully-built, standard PS2SDK, and additional functionality through gsKit, SDL, SDL-Mixer, and PS2-Packer Lite.

This package is current, as of July 19, 2008 (and will probably remain current for some time, given the rate of updates to PS2SDK).

To install, simply extract the mingw and msys directories into C:\, and run msys.bat, under c:\msys\1.0\. If you like, make a shortcut to msys.bat, and throw it on your desktop or Start menu, for quicker access. If you'll be checking things out via SVN (which you probably will, at some point), install Subversion by running svn-1.4.5-setup.exe.

To test your environment, change directory up to 1.0 (type "cd .." without quotes), then cd down to local/ps2dev/ps2sdk/samples (type "cd local/ps2dev/ps2sdk/samples"), choose a sample and cd into its directory (for example, type "cd cube"), then type "make". If you get the message "No targets specified and no makefile found", there's likely a subdirectory that contains the source you're looking to compile (as there is in several of the samples). Simply type "ls" to list the directory's contents, choose a subdirectory, type "cd subdirectory" (replacing subdirectory with whatever it's really called, of course), then try typing "make" again. If you compile something, then later want to compile it again (perhaps you modified it, or modified your environment), simply type "make clean", then type "make".

A little later, I'll provide a collection of compilable source, by many authors, which you can simply extract into your c:/msys/1.0/home directory, cd into after starting msys, and compile.

Thanks go out to:

Lukasz Bruun, for doing 99% of the work (this environment is based on his MinGW PS2SDK tutorial, with several modifications and fixes), and also for giving me a few nudges in the right direction involving gsKit, SDL, and romfs (the latter of which is still a work-in-progress).

ps2devman, for providing some Cygwin files for gsKit - as MinGW couldn't properly build gsKit without them, and PS2SDK will no longer build in Cygwin, thus I had no direct way of getting the files myself - and for providing help with fixing gsKit, and helping to update some source code of his to compile with the current PS2SDK (the more compilable source, the better :) ).

ptek, for providing several Cygwin files and some good info for the attempted romfs fix, which is still being worked on.

Oobles, for PS2Dev.org.

Many people, for PS2SDK.

And everyone else in the PS2 development scene :)

- Lazy Bastard, of GSHI.org

Download can be found here.

World's First Custom Firmware For Wii Released

dlevere@yahoo.com — Fri, 18 Jul 2008 04:52:54 -0400

As with any Firmware for any console, they could brick your console, use extreme caution, and if in doubt, leave well enough alone.

Waninkoko has released the world's first custom firmware for the Nintendo Wii, which is installed using the Twilight Hack; among its features is the ability to allow writable DVD's to be read in emulators.

From the read me:

Quote:

The Custom Firmware installs as IOS249, and it does not modify any other IOS, so it is secure to install, and has been made to be used ONLY with homebrew software. This is a custom IOS, an IOS modified to add some new features not available in the official IOS.

World's First Custom Firmware For Wii Released

Hypermode - A guide to hacking speed mods (PS2)

dlevere@yahoo.com — Wed, 16 Jul 2008 10:19:46 -0400

Hypermode by Nach Brenner, iN tHE mIND, Codemasters-Project, Crash Test Dummies

What is a Speed Modifer?
A speed modifier alters processing speed of your PS2 Unit. Some
Speed Mods alters the speed of the actual game you are playing.

What is the purpose of these codes?
Nothing really. If stuff people do in there spare time, and its really
help for the games that load so slowly. Lets give them a Boost!

This is not a complete guide! this is just to give you the general idea
of what to look for when trying to make this codes.

Here is a tip when looking for a Speed Mod, Load the elf, and invoke analyzer
in PS2DIS or if you use IDA Pro let it load completely or until it lets you
exploder the file, just do a search for 3f800000 (0000803f)
Yes there will be alot of 3f800000, but this narrows it down since
3f800000 equals the default speed of the game.

-=- Values -=-
1xxxxxxx ????????
00004000 Super Speed
00004080 Turbo Speed
00004100 Ultra Speed
00003F80 Normal Speed (Default)

2xxxxxxx ????????
3E400000 Mega Slow Motion
3E800000 Super Slow Motion
3F000000 Slow Motion
3f800000 Normal Speed (Default)
40000000 Hyper Mode
41000000 Mega Hyper Mode
40800000 Super Hyper Mode

-=- Patterns =-=
This is the most difficult, but this is the most widely used method in finding
the codeunless you ahve a trainer or dumper. First thing you want to do is
know what pattern to look for, common sense is look for the default
speed 3f800000. So you are going to look for the pattern 0000803f as a
hex stringer

For Future Reference cause i know some people will not get it
3f800000 = 0000803f

NOTE: that this is the hardest method of them all!

=-= Labels/ Symbols -=-
Game games will have a label so well covered up you could be looking at it
and not even think to use it. Some games could just flat out say game Speed
like Trigger Man whose label is gameSpeed

gameSpeed
0027761c 3f800000 lui zero, $0000

Hyper Mode :)
2027761C 40000000

Slow Motion
2027761C 3F000000

One thing about Triggerman is that it's very well labeled, and you can many
address that will give you the same effect. Here are some examples

Dive always Slomo
00279a54 00000000 nop
20279a54 00000001

Throw always Slomo
00279a58 00000000 nop
20279a58 00000001

Slow Motion
00279b3c 00000000 nop
20279b3c 00000001
* All TriggerMan codes made by GMO

Some Games will take more looking into and test, especially RPGs
I'll take Xenosaga as an example
wee start out looking through the elf for symols such as gameSpeed
since i didn't find any reconize symbols i'll try the default speed
value and we come across some labels such as rate.0 and rate.1
lets test them out. I see a lower value in there also, but we don't
want no slow ass shit in the code!

rate.0
00364910 3f800000 .word $3f800000
00364918 3f000000 .word $3f000000

Hyper Mode
20364910 40000000
20364918 40000000
Testing... Works!

=-=Disabling Sub-Routines-=-
this was introduced by Nach Brenner of Xploderfreax
there are three (3) Main Routines that are almost guaranteed to work
sceMcSync
sceGsSyncV
InvalidDCache | SyncDCache

Disabling Routine
1. Load the Elf - File in PS2DIS or IDA Pro
2. Jump to Label sceGsSyncV, sceMcSync, and InvalidDCache | SyncDCache
3. Disable It with

03e00008 jr ra
00000000 nop
or
03e00008 jr ra
24020001 addiu v0, zero, $0001

Example: Akira Psycho Ball NTSC-J
sceGsSyncV
0013c600 27bdffe0 addiu sp, sp, $ffe0
0013c604 ffb00000 sd s0, $0000(sp)

Faster Loading
2013c600 03E00008
2013c604 00000000

Example: GTA San Andreas NTSC
00548918 27bdffe0 addiu sp, sp, $ffe0
0054891c ffb00000 sd s0, $0000 (sp)

20548918 03e00008
2054891C 00000000
Result... Froze at Blue logo Screen

20548918 03e00008
2054891C 24020001
Result... blue rockstar icon
SAN ANDREAS IS A BAD EXAMPLE!!!!
but wait, we don't stop there!

Disable InvalidDCache | SyncDCache
2053C1D8 03E00008
2053C1DC 00000000
Testing... Works!

Faster Loading (final)
2053C1D8 03E00008
2053C1DC 00000000

GTA San Andreas PAL
Faster Loading :P
2053c2d8 03e00008
2053c2dC 00000000

-=- Disabling Vsync =-=
You are going to disable vSync under sceGsSyncV
This will not work on all game, but in many case it does get
the job done.ou need to test them game by game, it works wonders
on Wrestling games!

Example: Triggerman NTSC
sceGsSyncV
001ff8f0 27bdffe0 addiu sp, sp, $ffe0
001ff8f4 ffb00000 sd s0, $0000(sp)
001ff8f8 ffbf0010 sd ra, $0010(sp)
001ff8fc 0c07fb48 jal $001fed20 sceGsGetGParam
001ff900 00000000 nop
001ff904 0040802d daddu s0, v0, zero
001ff908 8e020008 lw v0, $0008(s0)
001ff90c 14400010 bne v0, zero, $001ff950
001ff910 00000000 nop
001ff914 0c0889ec jal $002227b0 VSync

Disable Vsync
201ff914 00000000

Example: Aliens Vs. Predator Extinction
sceGsSyncV
002aa268 27bdffe0 addiu sp, sp, $ffe0
002aa26c ffb00000 sd s0, $0000(sp)
002aa270 ffbf0010 sd ra, $0010(sp)
002aa274 0c0aa5ca jal $002a9728 sceGsGetGParam
002aa278 00000000 nop
002aa27c 0040802d daddu s0, v0, zero
002aa280 8e020008 lw v0, $0008(s0)
002aa284 14400010 bne v0, zero, $002aa2c8
002aa288 00000000 nop
002aa28c 0c0ad0ac jal $002b42b0 VSync

Disable VSync
202aa28c 00000000

=-=Credit-=-
Nach Brenner, iN tHE mIND..., Team CMP, and
Crash Test Dummies (CTD)

Nintendo DS Development Tutorial

dlevere@yahoo.com — Mon, 14 Jul 2008 05:42:18 -0400

The purpose of this tutorial is to teach you how to create your own demos, video games, applications, etc. for the Nintendo DS.

PC TRAINERS

dlevere@yahoo.com — Fri, 11 Jul 2008 12:45:31 -0400

Silent Hill 2
Silent Hill 3
Silent Hill 4
Resident Evil 3
Metal Gear Solid 2 SUBSTANCE
Final Fantasy VII

Factory 2 by Bushing (Wii)

dlevere@yahoo.com — Tue, 8 Jul 2008 12:28:46 -0400

Note: this is a continuation of http://hackmii.com/2008/06/factory/

Last week, I bought two brand-new Wiis (the first new ones I�ve ever owned!) and dumped their NAND Flash filesystems before powering them on for the first time. I was able to recover some interesting info (although nothing earth-shattering).

The two Wiis:

LU5757004xx (id 0�047854xx): This unit was purchased Jun 27th from a major �big box� electronics retailer (Best Buy) here in California. The PCB has a datecode of �1208?, meaning the 12th week of 2008 � I bought it in the 26th week, so it�s taking them 14 weeks to get the units from the factory to the store shelf, which seems rather slow to me. (Wiis are still very hard to find here; all stores sell out of Wiis on the same day they receive the shipment.) The drive PCB has a datecode of �1008?, and is presumably a D2C2.

LU3477336xx (id 0�046d2b5a): This unit was purchased July 1st from a specialty game retailer (GameStop). The PCB has a datecode of 0808, as does the drive PCB � so it�s taking them even longer to ship units to the smaller retailers. I�m guessing that these two consoles came from different factories (hence LU5x vs LU3x).

Both devices contained new silicon revs � �Broadway B� and �Hollywood AA�. The LU3x Wii uses a strange, foil-shielded DI cable that I have never seen before.

Some photos:

Looking at the contents of the NAND flash, boot1 is unchanged on both units. This is great news � Nintendo has now shipped 28+ million vulnerable copies of boot1! boot2 has been changed slightly � both units have boot2 version 3, where all of the Wiis I had seen previously had boot2 version 2. (Version 1 was never publicly released, as far as I can tell � it might be used at the factory.) There are two changes between versions 2 and 3:

*ELF loader at the beginning of boot2 was expanded, and now has some added code which pokes at some DRAM or PLL registers before starting boot2

*The internal build date inside boot2 was changed from �0�090106? to �0�041707?. (Interesting that they�re using an American date format here � maybe this is BroadOn?)

This is a very minor change, so I�m not surprised that Nintendo has not decided to push this update to existing Wiis in the field. It might be a change to accommodate the new Hollywood rev (of unknown purpose), or might fix some yield problem identified in the factory.

Before we dig into the file systems, I�d like to draw your attention to /sys/uid.sys. Whenever a new title is run for the first time on your Wii, a new UID is generated for that title and stored in this file. This means that this file also serves as a record of all of the titles that have ever been run on a given Wii, and gives the order of installation:

Code:

$ xxd -g4 -c12 sys/uid.sys
0000000: 00000001 00000002 00001000  ............
000000c: 00000001 00000004 00001001  ............
0000018: 00000001 00000009 00001002  ............
0000024: 00010000 3132334a 00001003  ....123J....
0000030: 00010000 0000dead 00001004  ............
000003c: 00000001 00000100 00001005  ............
0000048: 00000001 00000101 00001006  ............
0000054: 00010000 3132314a 00001007  ....121J....
0000060: 00000001 00000015 00001008  ............
000006c: 00010000 30303032 00001009  ....0002....
0000078: 00000001 0000000b 0000100a  ............
0000084: 00000001 0000000c 0000100b  ............
0000090: 00000001 0000000d 0000100c  ............
000009c: 00000001 0000000e 0000100d  ............
00000a8: 00000001 0000000f 0000100e  ............
00000b4: 00000001 00000011 0000100f  ............
00000c0: 00000001 00000014 00001010  ............
00000cc: 00000001 00000016 00001011  ............
00000d8: 00000001 0000001c 00001012  ............
00000e4: 00000001 0000001e 00001013  ............
00000f0: 00000001 0000001f 00001014  ............
00000fc: 00000001 00000021 00001015  .......!....
0000108: 00000001 00000022 00001016  ......."....
0000114: 00000001 00000023 00001017  .......#....
0000120: 00010002 48414341 00001018  ....HACA....
000012c: 00010002 48414141 00001019  ....HAAA....
0000138: 00010002 48415941 0000101a  ....HAYA....
0000144: 00010002 48414641 0000101b  ....HAFA....
0000150: 00010002 48414645 0000101c  ....HAFE....
000015c: 00010002 48414241 0000101d  ....HABA....
0000168: 00010002 48414741 0000101e  ....HAGA....
0000174: 00010002 48414745 0000101f  ....HAGE....
0000180: 00010008 48414b45 00001020  ....HAKE...
000018c: 00010008 48414c45 00001021  ....HALE...!
0000198: 00010000 31323245 00001022 ....122E..."

The first column is the offset within the file. The second and third columns specify the Title ID, and the fourth is the sequential UID assigned by IOS to files generated by that title.

All of the Title ID's that begin with �00010000? are discs � 123J, �0000dead�, 121J, 0002, and 122E. I�m going to venture to guess that 1-2 (System Menu), 1-4 (IOS4) and 1-9 (IOS9) are all pre-installed in the NAND FS by an unknown mechanism. The system menu installed is probably the stripped-down, text-only DevKit menu � more on this later. These could also be installed by 123J, but I don�t know how that would work. 1-2 must be installed before any disc may be booted, and 1-2 must have at least IOS9 to function.

Next, a disc containing 123J is inserted; this disc may also contain �0000dead� as a second partition. That is a highly odd title ID � perhaps the filesystem that was on the Wii until this point was unencrypted, and this �dead� disk �killed� the NAND FS by encrypting it with the per-console key? All we can really do is speculate.

Next, a disc containing 121J is inserted; it may install 1-100 (BC) and 1-101 (MIOS). At this point, a test of the GameCube emulation mode might be conducted.

Next, a disc containing an update partition with 1-15 (IOS21) and �0002? is inserted. (BTW, all of these discs will auto-boot because they have �0' or �1' as the first byte of their Title ID � this makes them much easier to use in a factory setting.) 0002 seems to conduct most of the burnin / testing that we saw in my earlier post; it probably runs using IOS21.

Finally, a disc called �122E� is inserted. Note that this is the first disc that is specific to NTSC/US (hence the �E� ending) � it contains an update partition with all of the remaining versions of IOS (11, 12, 13, 14, 15, 17, 20, 22, 28, 30, 31, 33, 34, 35 � note the lack of 36 and 37, and this is the old, vulnerable version of IOS30). It also contains the default set of channels � many of which are specific to NTSC/US � and installs the NTSC/US system menu (in this case, 3.2U). 122E itself probably performs the final cleanup � deleting diagnostic programs, etc � before the Wii is packaged and shipped to the retailer.

Here, the differential analysis of the 16 different file system �superblocks� will prove useful. If we look at the history of the file system, we see:

rename /tmp/launch.sys to /sys/launch.sys. (Contents are 0001000030303032, so the system is preparing to boot �0002?.

delete /tmp (this is the first action taken by boot2 when it mounts the NAND file system)

create an empty /tmp

nothing (?)

delete /sys/launch.sys

create entry for /tmp/space.sys (this seems to be an empty placeholder file that is created whenever launch.sys is deleted, to ensure there will be space for launch.sys to be recreated later even if the file system fills up)

expand space.sys from 0 bytes to 0xe0 bytes

rename /tmp/space.sys to /sys/space.sys

delete /meta/00010000 (and its contents, which are 30303032/title.met), which had only the text �DataChk� and the Title-ID 00010000-�0002? inside of it)

create an empty /tmp/30303032.tik

delete the empty /tmp/30303032.tik

delete /ticket/00010000/30303032.tik, which was the real ticket for �0002?

delete the empty /ticket/00010000 directory

delete the directory /title/00010000/30303032, including its contents content/title.tmd, content/00000000.app, content/00000001.app and an empty data directory)

append the line �CHECK_NAND_DATA=OK,Ver.3.1.144? to /shared2/test/testlog.txt.

You may find the final file system listing here. It may be interesting to note that /shared2/test/testlog.txt has a UID of 1007, meaning that it was created by 121J, not 0002. Hmm.

Distilling that list a bit, we get the following sequence of events: 00010000-�0002? is launched. It deletes itself from NAND, including its ticket and contents � apparently this wasn�t actually a disc at all, but a channel in NAND (very odd). Then, it adds the CHECK_NAND_DATA line to the end of the test log.

Fortunately, our ability to rewind the filesystem back a few steps means we can see what the NAND contents of 0002 were. Here is the output of the �strings� command on its main DOL. This program seems to be the one that runs all of the tests; I�m guessing that it reads an �all.ini� file (parts of which we saw here) from SD card, as well as most or all of the test executables.

Although we don�t have filesystem data for these, just by scraping through the unused clusters in the filesystem I was able to find these files (for which I just made up names, based on the contents of the files):

nandtest.dol (231776 bytes)

wtester4.dol (957760 bytes)

ndevboot.bin (284112 bytes)
In theory I should be able to run these files, but I haven�t had any luck doing so (they just hang) and I haven�t had time to figure out why.

Lastly, I should point out that every time you insert a disc into the Wii, the system menu reads the banner for the disc (to display in the Disc Channel) and also caches the main DOL of the disc into /title/00000001/00000002/data/cache.dat. The last disc inserted into this Wii was 122E, so we have the DOL file from that disc in cache.dat � strings output is here. (Upon further examination, it looks like this program may install 00010000-�0002? from a DataChk.wad on the DVD filesystem, and then execute it � this would change the above sequence of events somewhat.)

Comparing the two Wiis to each other revealed the only significant differences as being in /title/00000001/00000002/data/settings.txt; more on this another day.

The Secrets of Professional GameShark Hacking

dlevere@yahoo.com — Sun, 6 Jul 2008 08:24:46 -0400

A rather large document, describing hacking techniques for various systems. Unfortunately, the images that were in this got lost for a couple of reasons.

The Secrets of Professional GameShark Hacking

NDS Cheat Tool (Project DipStar)

dlevere@yahoo.com — Sat, 5 Jul 2008 04:27:14 -0400

By Imaha486

Hi, them.
Because DATEL didn't make ProActionReplay, I made.
Name is .. Project-DipStar-

http://hp.vector.co.jp/authors/VA018359/nds/dipstar_v251.zip

It applied MKDS-Patch.
It reads cheat-code which was stored in the SRAM.
(MAX 126 codes / 4 pages)

To use, PassMe(or PassKey) and FlashCart are necessary.
PassMe, PassKey, PassKey2 or MAGICKEY/MK2 is good! :)
But, EZ-PASS, SUPERPASS or PassMe2 is bad..

Moreover, the FlashCart which doesn't use a loader is necessary.
EZ-FLASH or USBLine is good!
M3, G6, SuperCard, GBALink,etc... is bad..

Of course, it is possible to do parameter search, too.

Don't you, too, challenge?

Team R4 to brick a DS with fake R4 card

dlevere@yahoo.com — Fri, 4 Jul 2008 13:08:30 -0400

In a surprising move, the team behind the R4 Nintendo DS entertainment, development, and backup unit are planning on bricking your Nintendo DS or Nintendo DS Lite - that is, if you're using a cloned product. Knowingly or not, the R4 Team plans on releasing a firmware that will wipe your Nintendo DS's on-board BIOS to smithereens.

In a move to fight other factories from replicating their flashcart without permission, the R4 Team will release a new firmware to combat the situation. Cloning happens a lot in the scene, as factories either steal the design, or the unit is reproduced using cheap parts. Most cloning is done by a few companies, including Divineo, and in that companies instance, the clones are promoted on sites Divineo owns, such as Maxconsole.com.

Important point:

Quote:

1. After 15 September, Team R4 will do something for the fake card, original program(firmware) with Fake R4 may damage your DS machine (brick), original R4 will have no problem with this program.

2. Make sure you have buy a original R4 (see photo above), if you brick your DS with fake R4, please go ask the selling shop and Team R4 will not admitted this liability.

So now we have all been warned. Team R4 does not want any of us to purchase the fake versions from elsewhere.

PSP SLIM 3.60 M33 Custom Firmware Guide

dlevere@yahoo.com — Fri, 4 Jul 2008 08:07:16 -0400

PSP SLIM 3.60 M33 Custom Firmware Guide

CycloDS Firmware 1.41 released (DS)

dlevere@yahoo.com — Thu, 3 Jul 2008 04:12:42 -0400

Team Cyclops has released Firmware 1.41 for the CycloDS Evolution. The firmware now has an optimized cheat code engine and also has a number of fixes for certain issues that were found in previous versions.

Here's a quick look at the firmware change log as taken from the official release post on the Team Cyclops forums:

*Fixed "My Pokemon Ranch" Wii connectivity
*Optimized and fixed cheat code engine
*Increased the number of allowed fragments, which should reduce the "file system too fragmented" error
*Game compatibility fixes (2385 in game menu for some games)
*Added some advanced options to the XML configuration
*Miscellaneous other improvements

Remember to go over the documentation included with the firmware for full instructions on how to install it, and to avoid any problems.

Download: CycloDS Firmware 1.41

The great Wii Hacker Bushing speaks

dlevere@yahoo.com — Wed, 2 Jul 2008 04:07:06 -0400

Bushing Update

The great Wii Hacker speaks

It�s been a few days, so I�m just going to post some brief notes on what I�ve been working on lately.

Twilight Hack: Marcan did a great job of putting together a nice new release that works with System Menu 3.3: Twilight Hack v0.1beta1. It seems to work well; we have some initial reports that some SD cards don�t work with it, giving a �error -1 reading boot.elf�. I�ve found at least two different problems that can cause that, so expect a small update soon � in the mean time, reformatting the card often fixes it.

Updates: No new updates, as seen on Marcan�s Wiimpersonator. I would not expect this to last; Nintendo will probably release a fixed version of their anti-TP hack code which will not be nearly so easy to defeat. For those of you who updated to 3.3, take that as a warning and just don�t update next time. We�re working on a long-term solution.

Korean Wii: We believe that the new Korean Wiis have a new common key, and we won�t be able to use our tweezer attack to recover it. I�d like to take a look at one and see what other avenues of attack there may be. If anyone knows how I can buy one of these and get it shipped to the US, please let me know.

Forum: I must confess to the fact that I didn�t even know there was a Wiibrew Forum until recently, but the admins there have put a lot of work into spiffing the place up recently. I think we can turn this into a good resource to take the place of some of the discussion that doesn�t really belong on a wiki, so please drop by and bring your quality questions with you.

UnbrickMii / Factory � both of these have updates which deserve their own article. Stay tuned.

Instruction Manual for R4 Action Replay Cheat v1.01 (DS)

dlevere@yahoo.com — Tue, 1 Jul 2008 07:58:27 -0400

Starts from the v1.08 official version, the R4 supports Action Replay DS functions, and simultaneously supports the official Action Replay database and the user database. The R4 Action Replay Cheat can be used for the creation and editing of a user's database, and supports either manual input or XML file import.

Instruction Manual for R4 Action Replay Cheat v1.01

Pstros NDS version 0.7.1 - R5 build

dlevere@yahoo.com — Mon, 30 Jun 2008 07:58:15 -0400

While the DS has its own collection of good titles, admittedly some of us will want to sample some of the games on other handhelds.

That said, we're letting you know of the release of Pstros NDS 0.7.1 - R5 Build, which will enable you to run java programs and games originally meant to run on mobile phones.

The developer explains that this homebrew emulator was created by using a DS port of the Sun's KVM java machine, and an altered version of the Pstros MIDP library. Here are some of the changes that were implemented since Pstros NDS' intial release:

version 0.7.1 - R5 build
added HttpConnection class to satisfy dependencies of some applications
implemented drawing of the ellipses (note: draw/fillArc is not fully functional yet)

version 0.7.0 - R4 build
Nokia UI api partially implemented: drawPixels and getPixels implemented for the 4444,444,8888 and 888 pixel formats with the full manipulation support (mirroring and rotation).
bug fixes (JBenchamrkPro works now)

version 0.6.0 - initial R3 build
fixed the CLDC implementation (timer, memory size, system properties)
added support for reading of the PNG images (code taken from the PhoneMe project)

implemented native functions for rendering the basic graphics primitives on the screen (lines, rectangles, triangles, images)

added support for accepting the JAD files in the application browser

ported the core part of the Pstros MIDP library to use CLDC java machine instead of the fully featured j2se java machine.

Further details on Pstros are available in the file bundle readme. You may also want to visit the author's release site (via the source link below) if you're interested in reading an in-depth explanation of how the emulator works.

Download: Pstros 0.7.1 - R5 build

Dark Alex Releases 4.01 M33 Firmware For PSP

dlevere@yahoo.com — Sun, 29 Jun 2008 17:47:02 -0400

Dark Alex, the PSP hacker from Spain, and his Team M33 have released a new version of the custom firmware for the PSP, which now supports the very latest official firmware from Sony. Benefits for the end user include the ability to play the many hundreds of games, demos, applications and emulators written by the homebrew community for the PSP.