socram8888 / tonyhax

PS1 savegame exploit
Do What The F*ck You Want To Public License
436 stars 25 forks source link

Vandal Hearts II #112

Closed Demetto closed 1 year ago

Demetto commented 2 years ago

tonyhax version: 1.4.3 Game name: Vandal Hearts II Game code: SLUS-00940 Executable hash: not sure, sorry Triggered at: after the konami logo Is the console chipped?: yes Is it an original disc or a burned copy?: burned

tonyhax 1.4.3 works to bypass the software terminated screen with every other game i've tried except this one

socram8888 commented 1 year ago

This one is unlikely I can patch it using the current approach.

Just for personal reference: ap_failed at 800E6920, ap_check at 800E5D24, and the extra check that's screwing the AP patch is a call to CdGetDiskType at 80042928, which returns 1 and should return 2.

alex-free commented 1 year ago

This one is unlikely I can patch it using the current approach.

Just for personal reference: ap_failed at 800E6920, ap_check at 800E5D24, and the extra check that's screwing the AP patch is a call to CdGetDiskType at 80042928, which returns 1 and should return 2.

https://github.com/alex-free/tonyhax/blob/8749ce4c7e1af4de3bc5d6196a84a6ddf202fa05/loader/patcher.c#L1018 bypasses this using the entirely different 'aprip' method (that also works on Japanese consoles unlike the current one). http://alex-free.github.io/aprip#how-it-works

Keep in mind that I am currently only bypassing the check that fails on stock consoles and not the one that is also sent which would fail on non-stealth modchip consoles. Both could be bypassed via the aprip method but it would take more space up in the loader then I'd like...

You could also patch the BIN file of vandal harts II with aprip and it would completely bypass all checks, the one that affects stock consoles and the one that affects only non-stealth modchips.

Your current bypass fails on stock Japanese consoles because after ReadTOC is sent the disc is de-autheticated and unable to be read due to the lack of unlockability for Japanese consoles. Hope this helps...

socram8888 commented 1 year ago

I really don't want to resort to patching on a per-game basis. I already tried that for pre-v1.4 and it was a pain in the ass for games with dynamically loaded code. The current approach also leaves the original code unmodified, so self-checking games (like the infamous Spyro 3) work fine. It also handles perfectly both unmodded consoles and dumb modchips.

I've left those commentaries because I might, at some point, consider an hybrid approach with the current generic patches but also on a per-game patch if the former is not enough.

alex-free commented 1 year ago

I really don't want to resort to patching on a per-game basis. I already tried that for pre-v1.4 and it was a pain in the ass for games with dynamically loaded code. The current approach also leaves the original code unmodified, so self-checking games (like the infamous Spyro 3) work fine. It also handles perfectly both unmodded consoles and dumb modchips.

I've left those commentaries because I might, at some point, consider an hybrid approach with the current generic patches but also on a per-game patch if the former is not enough.

Yea I've read the old source code and how that used to work. I have to do bypasses this way for Japanese consoles since your method doesn't work on them. The aprip method can work for non-stealth modchipped consoles. I just don't implement the GameShark codes for the non-stealth modchip bypasses because it requires 2 more gameshark codes per game vs just the one.

Like I said though, Vandal Hearts II will work just fine in tonyhax OG or Tonyhax International even with a non-stealth modchip IF you patch the bin file before burning it with https://alex-free.github.io/aprip so at least this person can play the game.

socram8888 commented 1 year ago

Considering it's burned I'd recommend that he just plays the European version, which also has English.

Not closing this since it's technically not fixed, but it's unlikely I'll patch this, unless I am incredibly bored.

alex-free commented 1 year ago

Considering it's burned I'd recommend that he just plays the European version, which also has English.

Not closing this since it's technically not fixed, but it's unlikely I'll patch this, unless I am incredibly bored.

If he has a Japanese or American console the European version would be in black and white because of the video mode switch.

The only option with a non-stealth modchip is to patch the bin file directly. You could fire up dosbox and use some ancient patches from back in the day (if they exist), or just use aprip in bin Patcher mode.

If the non Stealth modchip is removed from the console then it would work with my tonyhax international fork as expected. Also the case for stock consoles.

Like I said I could make it work for non-stealth mod-chips in the loader itself by adding the other 2 codes aprip genereated in gameshark code creator mode but the added size to the loader doesn't make sense in the long term.

LMS737 commented 1 year ago

I also think that the per game basis might not be a scalable approach. Everytime something might not work and then you have to add another and another to the list. How many cases will there be?

Whereas now his current method also works with non stealth. Many people still have old dumb chips on the PS1 and PS2 is often not stealth.

It seems a lot of issues of AP have been closed. So maybe in the end he can consider a hybrid for small edge cases like this if the majority does work properly without extra intervention.

I do wonder about the success rate and how many exactly are not working.

socram8888 commented 1 year ago

So it happens I was incredibly bored today. Fixed in d83a9159d2b49da28a297d7789affd9b9183dc11.

socram8888 commented 1 year ago

FTR it could be that the underlying issue behind this game not booting in the first place could be some shenanigans similar to those seen in DDR games (issues #121 and #133, all made by Konami) - there's a call to PsyQ's CdGetDiscType function right after the generic Sony antipiracy module.

This function internally performs a disc read to sector 16 in data mode (2048 byte per sector) and checks that it starts with "CD001", and based on that it returns one value or the other.

The ad-hoc patch in this case is staying either way, since even with a properly burned copy the game would be unplayable in an European console.

Demetto commented 1 year ago

Thanks for fixing it, I will burn a new copy of TonyHax and try it out!