..:: PCSX2 Forums ::..

Anyone besides Bositman got a widescreen hack for Silent Hill 4 in either PAL or NTSC format? Unfortunately I cannot use his/her hack and finding the proper memory address with Widescreen Helper myself is incredibly overwhelming and random and I do not own the Japanese version in order to use synce's J-version.

Any help would be greatly appreciated.

(06-18-2012, 08:49 PM)miseru99 Wrote: [ -> ]I wish it would be just that, then at least I could easily write a patcher for it;P. The result is same, but actually the reason is slightly different.
Full story - the adress storing value which game reads to apply proportions is always same, but the game engine patches it constantly(and unfortunately faster than 1ms - if it was slower then no problem;], couse it could still be patched normally) to default value. It's changed by instructions passed by GS which memory changes by each run or any other thing which restarts GS(like loading a savestate in pcsx2). That also cannot be easily found as it doesn't have any good pattern or rather same pattern constantly repeats itself all the time and only register values change and basically I do find that code by checking for an register which points to the widescreen adress.

I generally know that at least fair amount of the most interesting patches/cheats for PS2 games are using code caves in EE memory to put own assembly code there to do something normally impossible in the game, soo maybe it could still be patched somehow. The problem is such assembly code needs to be activated somehow, jumped to from going through original code and after doing itself continuing with the old code. Meaning it must start from some known adress at first and GS memory is probably impossible, or at least my experience lacks a way to do that such way;3. Maybe someone who has more experience in true "hacking" ps2 could do it, surely not me, I only tried few times things like that for PC games, which in generally are harder to cheat, but at least doing stuff like that feels easier there with pointers which I guess cannot be used here;3.

I tried to trace from where the initial default value was taken from, but it leads me to too many opcodes at completely unknown(for me) area of pcsx2 memory, I only can guess it's IOP which means the value probably originates from disc, which ultimately leads to another guess that the game iso could be patched instead of patching the memory;3(and here's a chance to make it "easily" working even at ps2), but trying to search through whole iso in hex editor lead to soo many 0.75 floats, that finding the correct one will surely not be made by me;3. Maybe some code in IOP do points to that somehow, maybe it's easy way to find it using some ps2 debugger or something like that, but I completely lack any experience with it and don't feel like gaining it couse it rather seem like a labor work and not something interesting;]. Feel free to try it yourself. If it really could be found there, it would be as easy as rewriting one byte there to set default value to 16:9/10.

Sorry if most of that post is hard to understand, I just feel that the more info I pass over here, at least something of it could be used by someone for this or similar project;3. I see loads of people patching games with by simply changing values, but we can also put our own code and do other silly stuff with some knowledge, guess it's worth mentioning.

You were doing just fine to explain it, trust me Took me a while for someone like me to digest, but it was a good read. Just one more question... which SVN that you used when testing Rogue Galaxy? Because on your screenshot I saw the shadow underneath your character's feet. Mine runs just fine, but in hardware mode there is no shadow. My SVN is 5226 ... a bit outdated but at least very stable.

(06-18-2012, 08:49 PM)miseru99 Wrote: [ -> ]That also cannot be easily found as it doesn't have any good pattern or rather same pattern constantly repeats itself all the time and only register values change and basically I do find that code by checking for an register which points to the widescreen adress.

I guess i found a way to solve that problem ;-)

I own the PAL version of the game, so any values or addresses may vary from your NTSC version

So what we wanna do is find the responsible 3XXXXXX address and break the instruction (->nop) to stop the game from writing permanent 0,75 float into the widescreen-2XXXXXXX address.

You can find the 3XXXXXXX address by searching for a pattern in an array of bytes. The trick is to look for a "wider" range of bytes using the addresses after the 3XXXXXXX address we were looking for and adding these values for a search pattern.

[attachment=38468][attachment=38469]

As you can see in the screenshots the bytes of the the three addresses have almost the same value . Some bytes vary because of the Opcode in the second address : pcsx2.exe+5EBA80. This value is not static because pcsx2.exe gets a different memory address everytime its started.

I rebooted the game about 10 times and built the following pattern for my search (array of bytes/HEX) to identity this address:

89 11 8B 0D 80 BA ?? ?? 83 C1 34

It looks like there are more addresses using the same sequence of Opcode because in my tests i get 2 or sometimes 4 results in my search when testing different levels of the game. The good news is, the address we are looking for is always the first one in the result, but breaking the instructions of the other addresses dont seem to have an impact (we dont break anything in the game, we just stop the game from writing permanent 0,75 into another address).

I was surprised that this method works, but to prove my theory i used another game : Tekken5 (PAL Version)
I remember when i was on the hunt for the fov addresses i found a dynamic 3xxxxxxx address which is responsible for the global camera zoom value. So i loaded the game, found the address and wrote down the value of bytes for the camera address and some addresses after it. Rebooted the game and repeated that step about 5 times.
In the end i had the following search value (array of bytes/HEX) to find the camera zoom address :

00 00 80 3F F3 0F 10 2D ?? B9 ?? ?? F3 0F 10 35 58 B9
Only one result in my search ;-)

Just for the record : By using this method we are able to identfy any dynamic 3xxxxxxx addresses we want to.There is no need to find pointers or references to the 2xxxxxxx addresses.

I have also written lua scripts for using this method and patch the game. One script uses assemble aobscan, the other one uses lua memscan. I'm testing both of them, but i prefer lua memscan because you can set the range of a scan, aob always scans the whole memory and is also very cpu demanding.

To make the patches work continuous, we have to use a loop or timer to repeat the searches and break instructions. This would solve the problem when using save-states.

Attached you will find my scripts (not yet finished, but they should work for testing - just change the values if they vary from your NTSC Version).

@strider3871 I'm currently using custom modded GSdx, basically applied the cutie patch which was posted somewhere in the forum to a GSdx I had underhand(r5206), including hackfixes not taken from it to official SVN(as only those from GSstate were used, and most "hackfixes" of the "cutie" version are applied in other parts of the code - through they're still work by crc ~ not breaking other games, soo not sure why they weren't taken as well, maybe to avoid trashing the code;P or somebody who applied the patch to official svn didn't even checked the code for other crc fixes), but excluding interface change(as I was lazy and didn't had any reason to add it considering similar stuff already existed in new GSdx which I prefer;]). Don't remember through if this game was fixed by cutie version, just worked well with r5206 or both lols. ~_~
Edit: fail me, I checked it now and I guess the shadows appear in any version as long as you set skipdraw to 1, I just didn't notice that I had it set couse it's in submenu now;P.



@ElHecht Ok, i see you didn't read the code window of my original post about this game. xD Couse I practically wrote same thing you share now;].

I really want to find the correct value, not just nop all, couse it can and possibly will make the game unstable, if you really menaged to get an aob there to limit search to few results, I guess I'm gonna try correcting mine too;P, but those giving little results were randomly failing me, soo I used a crappy, but sure one, I find 100% correct adress by checking registers on breakpoints I make on each of the scan result, soo even finding 100 results will not cause instability as I nop just 1 opcode, it only is fairy slow around 10 checks per s. And I also don't get how to use debugging functions of ce lua good enough to clear all debuggers correctly, and close it after patching in my patcher now;].

But I guess it doesn't matter much, I'll jut make the next version based on x86 assembly it should allow me to check registers easily and fast as long as I code it correctly without breakpoints and other bad things like that.


==================edit to reply to edit;3===============
Pointers are useless here, I were finding registers;3, but I guess short aob works too, the aob I used sucked really as I pretty much assumed all the numbers around are variables having to search for opcode pattern, meaning few times longer aob, still fairy common pattern, but nothing's lost at least I finally learnt how to use breakpoints in lua, it was the only thing I still never used there;3 through I guess I'm not gonna learn how to clean them properly@_@ *sight*. Now I made a version working mostly in assembly, but somehow it's not soo well, probably I just messed the code and seeing your new pattern actually lead to correct adress as first I'm gonna dump it for now.

Anyway thanks for finding the short aob actually does work for it;]. Seeing your new one, I'll just make slight difference to what I found and it should fit all game versions without loosing it's usefullness. Now I'll be lazy and blindly assume all game versions are also having same default WS value as ntsc-u;3 which should be easy to find, instead of wasting an hour or two to fix my assembly code to find registers, just gonna eat something and then make an activate&forget patcher which will keep it at WS even when reloading game often automatically;], maybe with data stored in external file soo it doesn't have to search any unknown WS adress every time. Or as an manual input in case it would fail, at least gonna see if CE can finally return the path of the trainer;P or still returns useless temp dir.


BTW just one thing;P. I'll repeat it once again GS memory has range of 0x30000000-0x303fffff, not sure if setting it higher will really affect the speed of aob scan, but there's absolutely no reason to set it any higher.;P

=====Update=====
I said, so I did, Rogue Galaxy WS patcher v0.5. Should work with all versions, but it's obviously untested.

Ive used pcsx2 quite a bit and ive run into a problem. I just recently found this widescreen thread i cant figure out how to use it. I have an iso of ffx int i cant figure out how to apply the patch.

Put the file in your cheats folder, check enable patches in PCSX2, run the game

Another difficult game to find the address of aspect ratio is dark cloud 2 or dark chronicle regionwise, I only can find the address of the camera zoom, Im at work now whem arrive to my home will post the address, it seems that level 5 use a different way to control the aspect ratio in his games. I will apreciate any help in this game.

-------------------------EDIT---------------------------
The address for the zoom camera in dark cloud is 20380FB8.

Thats the thing... i put the file in the cheats folder. ive tried 2 different patches (asmodeon, 99skulls) to get widescreen on the game but i cant. i try one, then the other. Ive clicked enable cheats from system. The console recongizes the cheat but no change happens

(06-19-2012, 09:09 PM)exudos194 Wrote: [ -> ]Thats the thing... i put the file in the cheats folder. ive tried 2 different patches (asmodeon, 99skulls) to get widescreen on the game but i cant. i try one, then the other. Ive clicked enable cheats from system. The console recongizes the cheat but no change happens

When you start the game, in the log screen says if the pnach cheat was load?