nitepr info(pointers, dma, dmahunter)
CREDITS:SANiK
The Address
1) Addresses on the PSP are actually 0x08800000 and on
2) A cheat might have an address of 0x00005000, but that's not the real address, that's the "SHORTCUT ADDRESS"
3) The REAL address is 0x08805000 (Add 0x08800000 + 0x00005000)
4) So when the game uses the address, it uses the REAL ADDRESS to access it, and NOT the SHORTCUT ADDRESS 0x00005000
5) Remember the word "SHORTCUT ADDRESS"
Pointers
1) Pointers have 2 parts
2) Part 1 is the ADDRESS of the pointer itself
3) Part 2 is the VALUE inside the pointer (which is actually an address)
4) So let's say we go to address 0x08805000, and the number inside there is 0x08806000
7) This means that there is a pointer at 0x08805000 that points to 0x08806000
Pointer Offsets
1) From the above example we had a pointer at 0x08805000 that points to 0x08806000
2) BUT, let's say the player's health is at 0x08807000
3) We play the game, and then the pointer at at 0x08805000 NOW points to 0x08806500
4) We then notice that the player's health is no longer at 0x08807000 but instead at 0x08807500
5) This mean that the player's health is RELATIVELY DEPENDENT on the address that the pointer points to
6) We notice that to get the address of the player's health, we do:
address of player's health=address that the pointer points to+0x1000
7) 0x1000 can be said to be the "RELATIVE OFFSET"
nitePR format
1) nitePR's DMA codes are in this format:
0xFFFFFFFF 0x___1____
0x____2___ 0x____3___
2) In 0x___1____ is the "SHORTCUT ADDRESS" of the POINTER
3) 0x____2___ is the "RELATIVE OFFSET" that gets added to the ADDRESS POINTED TO BY THE POINTER
4) 0x____3___ is the VALUE that gets STORED at the POINTED ADDRESS
dmaHunter
1) Find a cheat by searching for it, write down the "SHORTCUT ADDRESS"
2) Dump RAM in slot 1
3) MAKE the game change the pointers (be it by restarting the game or joining a different map)
4) Find the cheat AGAIN by searching for it, write down the "SHORTCUT ADDRESS"
5) Dump RAM in slot 2
6) Quit
7) Connect the PSP to the USB
8) Run DMA hunter
9) DMA hunter asks you for two RAM dumps
10) Select the RAM dumps in the proper order, order matters
11) So select RAM DUMP #1 first, and enter the "SHORTCUT ADDRESS" you got in step #1
12) Then select RAM DUMP #2, and enter the "SHORTCUT ADDRESS" you got in step #4
13) dmaHunter will now cross reference the two dumps to find all the values that changed by the same amount
14) If successful, dmaHunter should say (hopefully):
Quote:
--Found, address "SHORTCUT ADDRESS", value changed from "REAL ADDRESS A" to "REAL ADDRESS B"
15) "SHORTCUT ADDRESS" is the ADDRESS OF THE POINTER
16) You now need to compute the "RELATIVE OFFSET"
17) The "RELATIVE OFFSET" can be gotten by first converting either "REAL ADDRESS A" or "REAL ADDRESS B" into "SHORTCUT ADDRESS" form
18) To do this, we pick either REAL ADDRESS A or B, and then subtract 0x08800000 to get the "converted SHORTCUT ADDRESS" , that's it
19) Finally, the OFFSET can be calculated by:
"RELATIVE OFFSET"="SHORTCUT ADDRESS you got in step #1"-"SHORTCUT ADDRESS A which you converted"
or
"RELATIVE OFFSET"="SHORTCUT ADDRESS you got in step #4"-"SHORTCUT ADDRESS B which you converted"
20) Both equations should give you the same "RELATIVE OFFSET"
link to DMA hunter:
download here!
