OneRice07 / GoHANmem

Cheat plugin on PSVita
The Unlicense
82 stars 12 forks source link

Issue #1

Open Rezasdemon opened 7 years ago

Rezasdemon commented 7 years ago

Bug when setting memory in search tab.

When searching value when result is found and addresses are in right side when you use lock mode it doesnt seem to set the memory to the value stored on the inject value. Also it seems to affect the code list cause it changes the other menu setting also and if any codes were being locked previously its seemingly impossible to stop them from being locked at that value even if disable lock then re enable lock without executing the code with activation prior to turning off lock. When using modify it works but lock mode seems very buggy also the saved codes seem to conflict. Please add to the list a feature to enable and disable certain ones then on your main lock loop just execute ones enabled the code is a bit buggy if you are ok could you upload the source here and ill make edits for you Class code { Int enable =0 ; Enum type ={ float, int , double, hex, bytearr}; Int address =0; Int value=0 ; } When you load codelist.txt just load into memory objectarr then on your lock loop For(int i =0 ; i < objectarr.len ; i++) { Code co = objectarr [i]; If(objectarr [i].enabled==0){ Setmemory (co.address, co.value,co.type); } } Good job by the way this is certainly the best memory editor for the vita. If possible id like to work with you.

Rezasdemon commented 7 years ago

Sorry for the readability

Rezasdemon commented 7 years ago

https://goo.gl/photos/TaGeT4oErJ5mDUkV8 List shows 0x0000 bit if i screw with it it fixes to the real address also The address it searched seems to be outside the range of the parameters specified by memory alloc 7 of the app something is really bugged

Rezasdemon commented 7 years ago

Im not sure but could be an issue due to the english translate im not sure how this fole was translated whether the person had source or just hex edited if they hex edited its possible they broke something as im doing to my games using this lol

OneRice07 commented 7 years ago

@Rezasdemon

Thank you very much for using GoHANmem and submitting issue.

I'm going to redesign the interface when i'm free later. Thanks for your advice and encouragement.I will try to fix some bug in the next version, and be prepared to join English and Japanese language with help from my friends. Function add, fuzzy search, pointer, float.

As u know, i am not a programmer and sometimes I am busy at work.My program code is not professional, I am afraid that others do not understand my code, so there is no open source.

Thank you very much for your willingness to work with me, but my poor CET4 level of English may not be able to communicate happily, and I think you are more professional than me.

Thank you very much!

Rezasdemon commented 7 years ago

Im no professional its all from personal experience with some client reverse engineering on mmo games for private servers and also have made many c# tools i have coded in android ndk and adk i also took 5 years japanese so i can read some chinese and about 1k japanese characters but I am decent with c++ c# and alot others. I did a little messing around in x86 instruction set but i have no idea how the vita works nor how its sdk environment thats why i was hoping to look at some code i can learn from and i looked at rinnes cheat thing and its not nearly as comprehensive as yours is its very well done i think it has all the necessary components in it to be 100% perfect just needs some refactoring but man you are great. If you dont know much programing i really applaud you cause i wouldnt even know where to start for this im sure theres like little to no documentation on direct memory access for vita just sitting around on the web so you my good sir are a visionary. I really hope you will reconsider making it open source or at leaast cutin me in on it i dont mind using translators i frequently speak with people from japan and china i use skype so it translates automatically but anyways keep up the good work no worries on rushing just take your time and enjoy it most of all

Rezasdemon commented 7 years ago

When it works tho it works well is it possible some games are using too much memory and crowd the plugin out ? Maybe plug isnt being allocated 100%? But in dragon warrior monsters they have lower memory usage and in this screen shot i show the object array containing the items its struc is Array items = array[14]: Class items { short id short quantity } might be some of their code but in memory they dont do any weird randomizing etc so everything is static in same place just as an idea cause i noticed some games have a randomizer in memory somehow it seems maybe we can find pointers by searching hex values direcly and addresses we know so for example

Maybe you could make a search array return the results into a an array object holder Class searchres { Searchresult results [ ]; } Class searchresult { Int address; Int value; } Then in menus make it look at current search results by using a option to select which index in the search array results uses. So when searching the first time it saves to array 0 then if you need new search without losing old results you just set the option to 1 then new search which makes a new array entry this would be very helpful for games with random addresses or pointers cause you can

Search 1: Find hp Search 2: Search the address of found for hp Ingame find new area Search 1: clear old results search new Then refind hp which is stored at new address Search 2: continued from last hp address since u want to find the pointer. Search new hp address Once u have pointer you need a way to calculate the offset of the pointer address by the base of the games memory then should work for dynamically allocated games like ragnarok.

I have a really big question for you tho. I noticed in your app gohan you make use of checksum rehashing how did you figure that out ? Was it similar to the ps3 resigning? Cause i have looked all over the web for information on recalculating chesums from unknown hashing functions of games and it seems almost impossible unless u have source and the original hash function maybe im not right because i have no clue how it works but i was wondering if maybe you could tell me how you recrated the checksum so i could add ragnarok to the list the game has died and lost alot of its features they updated it and made it use heavy online features then quit the online features. The game save is easier to modify than memory but the checksum error causes invalid savedata

Rezasdemon commented 7 years ago

https://goo.gl/photos/VRPYpW4QnCZwYQyV9 Img referenced above from dragon warrior monsters builder game it works perfect. Only issue in this game is menu hotkey causes main thread to lock up and not fully render the menu might be cause the game has a quick menu and map on start /select and pressing them causes the game to make calls to sony library which might excute on seperate thread then your program loads and locks the thread from communicaring with the other I find its easy to fix when it locks just hit ps button and it unloads your plugin for a second and when you re Enter it fixes by pressin x to close the menu Sorry for writing so much I know its hard to understand due to language barrier thank you so much for this new toy u really gave me something to have fun with. Great job.works great when it works ;) For a beta this is professional man. Great work.

Rezasdemon commented 7 years ago

Oops the search array struc is actually like this I meant. Not real code just shitty pseudo code but gets the idea across.

Class searchres {
Searchresult results [ ];
}
Class searchresult {
Int address;
Int value;
}

Searchres Searches = new searchres [ 10 ] ;

Searchres showres ( int res ) {  
Return Searches [ res ] ;
}

Main ( ) {
Currentresults = showres (menu.optionresults);
//Display the output list by referencing the array like
For ( int i = 0  ;  i < currentresults.results.len ; i++ )
 {
Output = Currentresults.results[i].address + ":" currentresults.results [i].value;
 }
}

Theres a bit more u can do but im sure this would help alot with finding pointers in games with dma (dynamic memory allocation) but the thing is you would need to also implement adding code for inputing a pointer type address It needs to allow parameters like Int ptraddress Int ptrvalue Int ptroffset So when setting address in memory its like this


Int data = 0xFF;
WriteProcessMemory(hProcess,(LPVOID)ptrvalue+ptroffset, &data, sizeof <int>, NULL);

//Instead of 

WriteProcessMemory(hProcess,(LPVOID)ptraddress, &data, sizeof <int>, NULL) ;

A base framework concept


Bool runonce= true ;
Char* titleid = "XXXX00000"
Char* pathtocheats = "ux0:/plugins/cheats/";
Char* filename ;
Class codelist {
Bool activated = false;
LoadedCode codes[];
}

//byte array keeps the current system and allows larger 
//arrays than 4 for string search maybe someone could 
//write a translation code that patches active memory lol 
Enumeration codetype {hex, ptr , byte array, int,float ,double};

Class LoadedCode{
bool active= false; //set to true from render function when menu selects on from code list

Int addr;

Codetype type =codetype.int;
Int ptroffset // only used for type ptr

Object val {return readmem (this.addr); }; set {writemem (this.addr)};} // value of address needs cast

/*onset code switch on enum type and if ptr then use ptr val instead of val on games that allocate multiple sections of memory ie ragnarok with 27 allocations for example  the 8th allocation of memory is at a different base address every time so more likely the first memory allocation has a reference to the base address so using the base address and saving the offset from the base of allocation when searching pointer address*/
Object ptrval { get {return readmem ((int)this.val+this.ptroffset); }; set {writemem ((int)this.val+this.ptroffset, value)};} ;
/*need to be fixed to support ptr of different type for example float ptr its not hard I am just writing this all from my head on a mobile phone in chrome so its hard to do from this id need to use an ide to fix this to be little more dynamic*/
}
Main (){
If(runonce){
//init 
titleid =sce function call ;
filename = pathtocheats + titleid + ".txt";
If (file.exists (filename)== true)
Load (filename);  /*sceio i think would be needed to populate structure codelist in load func.*/

runonce = !runonce;
} 

If (Hotkeycheck () ==true) // hotkey detection method
render (); // handle menu options and display here

If(codelist.activated)
Setcodes (); // handle active code list loaded from memory

}
Void setcodes(){
for(int i =0 ; i <codelist.codes.len;i++)
LoadedCode tempcode= codelist.codes [i];
If (tempcode.active== true){
 Switch (tempcode.type)
{
Case codetype.int:
Writemem (tempcode.addr,tempcode.val,4);//write mem need to be changed to accept byte arrays then in this switch depending on type you convert what ever type all to byte arrays then writemem needs to be setup to take byte arrays
Break;
}
}
}

thats windows c++ so that api isnt correct, but I dont know the sce functions so i cant make refernce I've never even seen vita code lol I really hope you can understand me if possible is there another method of communication we can use? I dont like this all being public haha. sorry for spamming you im just really excited on the vita scene right now. So much fun man so much fun playing with this stuff and figuring out what we can and cant do its like the sky is the limit ultimately just gotta figure it out I might make my own cheat tool if I cant join anyone's project, after I take care of some life problems though. I'd really like to join you, but I understand your concerns. I wrote this all from my phone but its just a rough idea of the framework i think if i make my own project ill likely use this idea as my base. Just gotta make it a little more dynamic before further implementation.

Rezasdemon commented 7 years ago

Ah just make a bool in class loadedcode add bool useptr; then remove ptr from enum codetype Then when writing memory do if (tempcode.useptr) Writemem(tempcode.val+tempcode.ptroffset,bytes,bytes.len); Else Writemem (tempcode.addr,bytes,bytes.len);

This fixes the type issue and makes it easy to edit values of any type regardless if stored at pointer or not.

Rezasdemon commented 7 years ago

Ok So I have recently started making my own tool but I am having issues finding the memory allocation blocks how did you find the allocations ? when you use your tool what does the select button do to detect the memory allocation address ranges?

as for my tool Its broken down to

Main - handles controls input and threading. ui - handles display of menus memory - handles reading and writting to memory database - handles cheat database functions, loading,saving, adding , removing, etc threads - stolen from rincheat and tweaked slightly to fit my array

really would appreciation your help though all i need is how to detect memory heap size, base addresses

OneRice07 commented 7 years ago

@Rezasdemon <psp2\kernel\sysmem.h>

sceKernelFindMemBlockByAddr() sceKernelGetMemBlockBase() sceKernelGetMemBlockInfoByAddr()

typedef struct SceKernelMemBlockInfo { SceSize size; void *mappedBase; SceSize mappedSize; int memoryType; SceUInt32 access; SceKernelMemBlockType type; } SceKernelMemBlockInfo;

OneRice07 commented 7 years ago

more in file psp2 kernel sysmem.h

Rezasdemon commented 7 years ago

https://psp2sdk.github.io/sysmem_8h.html yes but for example this method only returns one heap allocation where the recent variable was created not where other threads memory for the app are your tool uses those functions and magically finds all the heap allocations but this method only returns one. ``

int scanHeap(uint64_t val, int val_size){ uint8_t* dummy = (uint8t)malloc(1); if (dummy != NULL){ SceUID heapmemblock = sceKernelFindMemBlockByAddr(dummy, 0); void heap_addr; if (sceKernelGetMemBlockBase(heap_memblock, &heap_addr) >= 0){ SceKernelMemBlockInfo heap_info; heap_info.size = sizeof(SceKernelMemBlockInfo); if (sceKernelGetMemBlockInfoByAddr(heap_addr, &heap_info) >= 0){ uint32_t matches = 1; scanMemory(&matches, heap_info.mappedBase, heap_info.mappedSize, val, val_size); free(dummy); return matches-1; } } free(dummy); } return 0; } ``

Rezasdemon commented 7 years ago
Rezasdemon commented 7 years ago

maybe the code can give you some ideas

OneRice07 commented 7 years ago

@Rezasdemon TKS, I'll release GoHANmem v2.00 soon....maybe this week

OneRice07 commented 7 years ago

@Rezasdemon what's "RAM Mode" "MMC Mode" mean?

I don't understand~~

It's searched all range of memory in GoHANmem

Rezasdemon commented 7 years ago

When i write my memory scan class i will use a file stream if games memory is too big to store the results in ram got the idea from rincheat you can see his implementation in his memory.c file

Rezasdemon commented 7 years ago

Basically is if game takes up too much ram and no room for results list then i use file stream to save memory scan results to a temp.bin file it stores addresses and their value then i can peek thru the file stream buffer and have alot of addresses using only little memory for buffer