Modifying title screen background color using cheat engine + anything else for forever and ever | Persona Modding | Page 2

hot cliff Aug 4, 2024, 3:13 AM

#

yup

#

there's some stuff you can do

wanton wyvern Aug 4, 2024, 3:13 AM

#

this seems very tedious

hot cliff Aug 4, 2024, 3:13 AM

#

like adding breakpoints to stop the game from running code

#

you can right click and nope out functions to figure out what they do

#

that was super handy

wanton wyvern Aug 4, 2024, 3:14 AM

#

this all hurts my head so much lol

hot cliff Aug 4, 2024, 3:14 AM

#

tell me about it

#

swine managed to find it super fast

wanton wyvern Aug 4, 2024, 3:15 AM

#

i think my inexperience with CE also isnt helping here

hot cliff Aug 4, 2024, 3:16 AM

#

there are some super good tutorials online if you wanna familarize yourself

#

but tbf they most likely won't apply here

wanton wyvern Aug 4, 2024, 3:16 AM

#

i might give it another shot later but my head thoroughly hurts rn (not literally) so I think it's best I stop for now haha

hot cliff Aug 4, 2024, 3:20 AM

#

i got no idea how to get to the draw function for the menu

#

that should have some of it

#

why tf do i not have debugging rights

#

what does that even mean

#

fyi, code starts at 00400000

#

damn i don't think the cheat engine brawler sent has debugging rights

#

im even launched as an admin

wanton wyvern Aug 4, 2024, 3:31 AM

#

does any of this look relevant?

#

there was also a debug file generated with the exe, idk if that would be helpful?

#

📎 cheatengine-i386.dbg

hot cliff Aug 4, 2024, 3:46 AM

#

yeah im stuck too

#

can't get anywhere else

#

it seems like the isFemc label is only in that function

#

doesn't seem like anywhere else in the ghidra code references that label

#

@nocturne trench any idea? am i on the right track?

#

just need to find where it renders the config menu and change it to the isFemc function, yeah?

hot cliff Aug 4, 2024, 4:05 AM

#

yeah i got no idea

#

zero progress

graceful pawn Aug 4, 2024, 7:40 AM

#

Sure thing, only problem is one of the colors must be 0 or two of them should be the same

#

Or I could try to find a code cave

#

So I don't get any restrictions

hot cliff Aug 4, 2024, 7:41 AM

#

code cave?

graceful pawn Aug 4, 2024, 7:41 AM

#

Yeah it's like a place in memory to write new code without It affecting the main code of the game

hot cliff Aug 4, 2024, 7:41 AM

#

any way that we can get closer to actual hex codes would be nice

#

it's nice how simple the PC patch is for expansion so i was hoping for something like that too

graceful pawn Aug 4, 2024, 7:43 AM

#

Yeah, only problem with psp is that the game uses sb zero, 0x0(sp)

#

And this zero is the red part of the rgb

#

Problem is, for any other number I'd need to load It in a register previously to store it

#

Like for instance

#

li v0, 0xf0
sb v0, 0x0(sp)

#

I load the red part of the hex with f0 and save It to the sp

#

Problem is there's no space to load the value

#

So yeah, that's why I'd need some extra space to make the 3 different rgbs

hot cliff Aug 4, 2024, 6:34 PM

#

so would this code work as a cheat @graceful pawn ?

graceful pawn Aug 4, 2024, 6:54 PM

#

I think I could use some space of debug strings

#

So yeah think I could do the rgb fully

#

But I've been busy today with some P3FES stuff, so will let you know when I implement the color change naothumbsup

hot cliff Aug 4, 2024, 6:56 PM

#

no worries

#

handle your biz

graceful pawn Aug 4, 2024, 8:31 PM

#

Got it!!

#

Here's the cheat

📎 ULUS10512.ini

#

Now you can change them whenever you want from this cheat since I use rgb

#

Just change the last 2 numbers of each commented color

#

We'll grab green as an example, you'll need to change the second part

#

_L 0x2025A664 0x34020031 # Green

#

Just the last two numbers are the green part 0x34020031

#

Same goes for the other colors

hot cliff Aug 4, 2024, 9:53 PM

#

oh to the rgb value?

#

sick that’s super simple

#

i wonder how i didn’t recognize that

graceful pawn Aug 4, 2024, 10:10 PM

#

Well before only two of them could be changed, but in this one I added red so It can be easily changed

#

But yeah you can now change them looking at their respective comment of the cheat taking into account #rr gg bb

hot cliff Aug 4, 2024, 10:27 PM

#

oh that's fucking sick

#

thank you so much

#

now i get it

#

you're the greatest

hot cliff Aug 5, 2024, 12:15 AM

#

still need to figure out how to change the initial loading icon and config screen

#

got nowhere last night

#

working

#

im so miffed i can't see this on my PSP Go

#

it's basically a paper weight right now until i get a screw set to reseat the battery

graceful pawn Aug 5, 2024, 7:03 AM

#

hot cliff working

Looking good!! 🔥

graceful pawn Aug 5, 2024, 7:04 AM

#

hot cliff still need to figure out how to change the initial loading icon and config scree...

True, I'll try to look for these values in the psp version

nocturne trench Aug 5, 2024, 7:15 AM

#

hot cliff still need to figure out how to change the initial loading icon and config scree...

So changing IsFemc didn't work?

hot cliff Aug 5, 2024, 7:15 AM

#

oh no we didn’t even get that far

nocturne trench Aug 5, 2024, 7:15 AM

#

oh...

hot cliff Aug 5, 2024, 7:15 AM

#

i couldn’t find what to change and where it was

#

we found the label in ghidra

#

and then the function

nocturne trench Aug 5, 2024, 7:15 AM

#

I'll check now, I'm sure it was labeled

hot cliff Aug 5, 2024, 7:15 AM

#

it was

#

we just couldn’t figure out how to trace that backwards to what could access it

#

in cheat engine

nocturne trench Aug 5, 2024, 7:17 AM

#

Oh, I didn't really intend for you to do that. I just meant literally change it from 0 to 1. to check I didn't even remember that there was a function but if you needed you could do a similar thing with it

hot cliff Aug 5, 2024, 7:18 AM

#

wait for real

#

it was that simple?

nocturne trench Aug 5, 2024, 7:19 AM

#

Pretty much

#

It was the function that you needed to change for this

#

Not sure about the loading icon though, I wasn't fast enough

hot cliff Aug 5, 2024, 7:20 AM

#

what the fuck

#

ok how did you find the function in cheat engine

nocturne trench Aug 5, 2024, 7:20 AM

#

I just went to the address

hot cliff Aug 5, 2024, 7:20 AM

#

what?

#

the address from ghidra?

nocturne trench Aug 5, 2024, 7:20 AM

#

It's labeled in ghidra, there's nothing special

hot cliff Aug 5, 2024, 7:21 AM

#

femcmad

#

i went to the address in cheat engine and it cut off the 1

#

instead of 140Dwhatever the fuck

#

it was 40Dwhatever the

nocturne trench Aug 5, 2024, 7:21 AM

#

rip

hot cliff Aug 5, 2024, 7:21 AM

#

was it really that simple

nocturne trench Aug 5, 2024, 7:22 AM

#

Yeah...

hot cliff Aug 5, 2024, 7:22 AM

#

that’s upsetting :/

nocturne trench Aug 5, 2024, 7:22 AM

#

I think it's the function for both although changing it for the loading icon is causing a crash for some reason

hot cliff Aug 5, 2024, 7:22 AM

#

assuming i get it right and it goes to the proper address

#

thats all it is?

#

go to the address? change a 0 to 1?

#

that’s like

#

i’m almost a little upset hearing that in all honesty

nocturne trench Aug 5, 2024, 7:23 AM

#

Nah, I checked and that didn't change anything, you need to change the function IsFemc to return true

hot cliff Aug 5, 2024, 7:23 AM

#

oh

nocturne trench Aug 5, 2024, 7:23 AM

#

i.e.

alloc(newmem,2048,"P3P.exe"+258920) 
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here
mov rax, 1
ret

originalcode:
sub rsp,28
lea rcx,[P3P.exe+367CFFC]

exit:
jmp returnhere

"P3P.exe"+258920:
jmp newmem
nop 6
returnhere:

hot cliff Aug 5, 2024, 7:23 AM

#

wouldn’t that make everything pink no matter if you’re playing as her or not

nocturne trench Aug 5, 2024, 7:23 AM

#

(No idea why they do it in two separate places like that, some use the global some use the function)

#

Yes

hot cliff Aug 5, 2024, 7:24 AM

#

or is that function only for ui

nocturne trench Aug 5, 2024, 7:24 AM

#

But that's just a starting point

hot cliff Aug 5, 2024, 7:24 AM

#

oh

nocturne trench Aug 5, 2024, 7:24 AM

#

You add some logic so it only does that on the title screen or something

#

But changing that function (or if you really want, looking at what's calling it and changing that) is what you need to do ultimately

graceful pawn Aug 5, 2024, 7:24 AM

#

Oh so just need to find the isFemc function for the psp version probably? Thought color might be hardcoded for the title screen

hot cliff Aug 5, 2024, 7:24 AM

#

nocturne trench But changing that function (or if you really want, looking at what's calling it ...

ok i also had that idea

nocturne trench Aug 5, 2024, 7:25 AM

#

It's the same menu code as what's used when you're in game

hot cliff Aug 5, 2024, 7:25 AM

#

how do i get that function in that spot in the hex memory viewer

nocturne trench Aug 5, 2024, 7:25 AM

#

I'd be concerned if they duped all of it just for the titlee screen lol

#

Same way you get to any, it's at 140258920

hot cliff Aug 5, 2024, 7:25 AM

#

damn

nocturne trench Aug 5, 2024, 7:25 AM

#

I've gtg for a bit but have fun naosmiley

hot cliff Aug 5, 2024, 7:25 AM

#

so you could technically add the address as a code

#

and then see what accesses it

#

by loading into a femc save and opening the config screen

graceful pawn Aug 5, 2024, 7:26 AM

#

nocturne trench I'd be concerned if they duped all of it just for the titlee screen lol

Not the first time I've seen stuff like that lmao dark

hot cliff Aug 5, 2024, 7:26 AM

#

then just figure out which one is the loading card and config menu

#

i’m hella pissed that the jump to address thing didn’t work because i literally tried that

#

i almost had it 😔

nocturne trench Aug 5, 2024, 7:27 AM

#

Actually one hint before I go, for checking you're on the title screen you could do something simple like checking the date is 0 or something like that. I think that'd always be the case on it (if not maybe something like player level)

hot cliff Aug 5, 2024, 7:27 AM

#

maybe

#

this might grow into a femc overhaul of the UI because of the massive amount of stuff that’s still blue for femc

#

the player advantage thing

#

ok project for tomorrow since it’s midnight and i need sleep

graceful pawn Aug 5, 2024, 11:37 AM

#

Seems the first loading card can be changed to pink setting the flag to the femaleMc in the psp version

#

However, it doesn't seem to make any effect on the config menu naosmiley

#

It does check it tho, which is weird, but doesn't seem to be anything with the info

#

Maybe it's a leftover for a pink menu they had in mind in the initial development

#

I'll keep investigating it tho

#

Nah doesn't look like it, seems it's the exact same function in the camp menu than the one in the title screen and yet the color is not changing hmm

#

Seems to be changing the other stuff to blue here tho, but in title screen doesnt seem to do that

graceful pawn Aug 5, 2024, 1:25 PM

#

Made some progress with the patch

#

Now loading card is pink, and also this thing here after hitting new game will be pink

#

Here is the current cheat

📎 ULUS10512.ini

wanton wyvern Aug 5, 2024, 1:55 PM

#

nocturne trench Yeah...

man that is slightly upsetting :')

graceful pawn Aug 5, 2024, 1:55 PM

#

What the hell, now the pink spinning card is crashing to me as well naosmiley

wanton wyvern Aug 5, 2024, 1:56 PM

#

femc.....

graceful pawn Aug 5, 2024, 2:19 PM

#

Sheesh think I found a fix for the crashing at the start

#

You might want to try it on pc (might be a similar function to this one), but in psp it goes to this function before the loading card (seems like an init function that sets the gender to the default mc and calls a bunch of other functions like this one)

#

Seems like just nopping the goto of that rounded path is not crashing the game anymore

#

Probably the Get_Protagonist_Gender might be the psp equivalent of isFemc, for reference

#

Will change it to have the same name

#

This'd be the code with the other name

#

This is the new cheat, will keep testing with it just in case it doesn't explode again lol

📎 ULUS10512.ini

hot cliff Aug 5, 2024, 6:14 PM

#

hmmmmmmmmmmmmmmm

#

this might be harder than i thought for PC

#

i can't seem to get it to write what functions access the isFemc function

#

ok even when force inserting the code that makes isFemc return true, it doesn't print what's accessing it

hot cliff Aug 5, 2024, 6:21 PM

#

graceful pawn This is the new cheat, will keep testing with it just in case it doesn't explode...

are you just setting the femc flag to true for everything here or setting the value for specific things to be femc?

#

how did you find those values for the second thing?

hot cliff Aug 5, 2024, 6:26 PM

#

graceful pawn This'd be the code with the other name

how tf would i find this in ghidra femcmad

hot cliff Aug 5, 2024, 6:32 PM

#

graceful pawn Probably the Get_Protagonist_Gender might be the psp equivalent of isFemc, for r...

oh wait so isFemc is basically a yes or no and if it's no it's the MC

#

damn that's interesting

wanton wyvern Aug 5, 2024, 6:33 PM

#

well I suppose that does make sense

#

kinda interesting to have that be the check though lol

hot cliff Aug 5, 2024, 6:36 PM

#

what the fuck does stepping out even do in a break poimt

hot cliff Aug 5, 2024, 6:38 PM

#

wanton wyvern kinda interesting to have *that* be the check though lol

the upsetting part is that nothing seems to be accessing that check based on my understanding

#

there’s a way to add a memory address to the window and then attach a debugger to see what is accessing / writing to it

#

and assuming i didn’t put it in the wrong spot, nothing is

#

yet it seemingly does affect things

#

either the function itself writes to other addresses, which makes the most sense, or other functions are accessing it and i’m doing it wrong

#

i have no idea how i would trace around that first thing though

graceful pawn Aug 5, 2024, 7:17 PM

#

hot cliff are you just setting the femc flag to true for everything here or setting the va...

It's for specific things, I've commented in the patch for the specific places

graceful pawn Aug 5, 2024, 7:18 PM

#

hot cliff i can't seem to get it to write what functions access the isFemc function

You need to put a breakpoint in the end of the isFemc function so when it returns you know where was it being called from

#

At least that's what I usually do to know from where a certain function has been called

graceful pawn Aug 5, 2024, 7:20 PM

#

hot cliff oh wait so isFemc is basically a yes or no and if it's no it's the MC

Yeaah it's just a flag the game turns on/off

hot cliff Aug 5, 2024, 7:20 PM

#

so add a breakpoint on the return function?

#

or the function above the return?

#

graceful pawn Aug 5, 2024, 7:20 PM

#

In the ret, and when you go to next instruction you'll find out from where it was being called

hot cliff Aug 5, 2024, 7:20 PM

#

the isFemc

graceful pawn Aug 5, 2024, 7:21 PM

#

And from there you go to ghidra and figure out what's going on

hot cliff Aug 5, 2024, 7:21 PM

#

how would i do next instrunction

#

step over?

graceful pawn Aug 5, 2024, 7:21 PM

#

I think it's step into

hot cliff Aug 5, 2024, 7:21 PM

#

or step out?

graceful pawn Aug 5, 2024, 7:22 PM

#

Think both would work for the return

hot cliff Aug 5, 2024, 7:22 PM

#

140244F80

#

damn it put me in a giant ass function

graceful pawn Aug 5, 2024, 7:23 PM

#

hot cliff damn it put me in a giant ass function

Fr??

#

But when did you check it

#

At the start of the game??

hot cliff Aug 5, 2024, 7:23 PM

#

oh at the start of the game?

#

the menu was already loaded homeslice

graceful pawn Aug 5, 2024, 7:24 PM

#

Well, you can check in many places

hot cliff Aug 5, 2024, 7:24 PM

#

when should i check it?

graceful pawn Aug 5, 2024, 7:24 PM

#

Well it depends on the fix you want to work

#

What do you wanna try to make??

hot cliff Aug 5, 2024, 7:24 PM

#

puts me right here

#

clicking select current function does a bunch of stuff

hot cliff Aug 5, 2024, 7:25 PM

#

graceful pawn What do you wanna try to make??

everything you did in the psp patch + the config menu

graceful pawn Aug 5, 2024, 7:26 PM

#

Ok you may need then the location of the current isFemc flag then

hot cliff Aug 5, 2024, 7:26 PM

#

yeah i was just there

graceful pawn Aug 5, 2024, 7:26 PM

#

You can find it in the isFemc function probably

hot cliff Aug 5, 2024, 7:26 PM

#

swine posted it

#

oh the flag

#

not the function?

graceful pawn Aug 5, 2024, 7:27 PM

#

Yeah, I mean the address the game is checking

hot cliff Aug 5, 2024, 7:27 PM

#

140258920

graceful pawn Aug 5, 2024, 7:27 PM

#

It is useful because you can check when is being written or similar stuff

hot cliff Aug 5, 2024, 7:27 PM

#

yeah i tried checking when it was being written and got nothing

#

how did you check what was being written

graceful pawn Aug 5, 2024, 7:28 PM

#

This is the address in memory of the flag??

hot cliff Aug 5, 2024, 7:28 PM

#

to the function

#

i don't know which is the flag

#

im assuming it's the first line so yeah that address

#

considering we force that line to be true and then add a return

#

which forces the UI to be pink

graceful pawn Aug 5, 2024, 7:29 PM

#

Oh so you are forcing the whole checking to be femc??

#

Ic

hot cliff Aug 5, 2024, 7:29 PM

#

nocturne trench i.e. ``` alloc(newmem,2048,"P3P.exe"+258920) label(returnhere) label(originalco...

i did this

graceful pawn Aug 5, 2024, 7:30 PM

#

Oh okay so it's the starting point

#

Gotcha gotcha

hot cliff Aug 5, 2024, 7:30 PM

#

yeah

graceful pawn Aug 5, 2024, 7:31 PM

#

But yeah, next step would be looking the specific places

hot cliff Aug 5, 2024, 7:31 PM

#

i tried that

graceful pawn Aug 5, 2024, 7:31 PM

#

how is the isFemc looking in ghidra??

#

Just to compare both versions

hot cliff Aug 5, 2024, 7:31 PM

#

gimme a second

#

graceful pawn Aug 5, 2024, 7:33 PM

#

I mean the decompilation part

hot cliff Aug 5, 2024, 7:34 PM

#

oh

graceful pawn Aug 5, 2024, 7:34 PM

#

But looks quite similar

#

I have this

hot cliff Aug 5, 2024, 7:34 PM

#

lol exactly the same

#

#

ignore the fact that i just sent a song called goon juice

#

misinput

graceful pawn Aug 5, 2024, 7:35 PM

#

hot cliff ignore the fact that i just sent a song called goon juice

Lmao

graceful pawn Aug 5, 2024, 7:35 PM

#

hot cliff

Lol how weird the decomp is

hot cliff Aug 5, 2024, 7:35 PM

#

basically the same

#

it's denuvo honey

graceful pawn Aug 5, 2024, 7:36 PM

#

Yeah, it's kinda cursed dark

hot cliff Aug 5, 2024, 7:36 PM

#

ok what's the next step

#

is anything even accessing this function

graceful pawn Aug 5, 2024, 7:36 PM

#

Okay so the idea would be to get the address this function is using

hot cliff Aug 5, 2024, 7:37 PM

#

140258920

graceful pawn Aug 5, 2024, 7:37 PM

#

To get the exact address of the femc flag

#

Like not the function but rather the address flag

hot cliff Aug 5, 2024, 7:37 PM

#

what does that look like

graceful pawn Aug 5, 2024, 7:38 PM

#

So that we can apply this "is being accesed" or "is being written"

#

And get to new functions

hot cliff Aug 5, 2024, 7:38 PM

#

oh so i was in the wrong spot

#

im nassuming the DAT_1433636cc is the flag?

graceful pawn Aug 5, 2024, 7:39 PM

#

Yep, should be the flag

hot cliff Aug 5, 2024, 7:39 PM

#

it's in two spots

#

so how would i know which one is being accessed

#

or do i just check both

graceful pawn Aug 5, 2024, 7:39 PM

#

Wdym in two spots??

hot cliff Aug 5, 2024, 7:39 PM

#

oh wait sorry

#

there's two different dats

#

and they look very similar

#

im assuming it's the top one then

#

DAT_14367cffc

graceful pawn Aug 5, 2024, 7:40 PM

#

Nah, should be the second one since it's the return value

hot cliff Aug 5, 2024, 7:40 PM

#

oh

graceful pawn Aug 5, 2024, 7:40 PM

#

So it's just 1433636cc

#

You can try to check in game how it changes when going to new game

#

And selecting the mc or femc

hot cliff Aug 5, 2024, 7:41 PM

#

oh the game just crashes

#

one second

graceful pawn Aug 5, 2024, 7:41 PM

#

Ooh, that should be the spinning card issue

#

Right??

hot cliff Aug 5, 2024, 7:42 PM

#

no it happened when i clicked new game

graceful pawn Aug 5, 2024, 7:42 PM

#

Lol

hot cliff Aug 5, 2024, 7:42 PM

#

yeah pressing new game when monitoring what accesses that address causes the game to crash

graceful pawn Aug 5, 2024, 7:43 PM

#

Kinda 💀

hot cliff Aug 5, 2024, 7:44 PM

#

fym kinda

#

yes

#

yes it does

graceful pawn Aug 5, 2024, 7:45 PM

#

Is it crashing also without the monitoring of the accesses??

hot cliff Aug 5, 2024, 7:45 PM

#

oh no it's just crashing regardless

#

the fuck

graceful pawn Aug 5, 2024, 7:45 PM

#

Yeah lol

hot cliff Aug 5, 2024, 7:45 PM

#

gimme a hot second

graceful pawn Aug 5, 2024, 7:46 PM

#

You can try to turn off the agressive fix for the pink stuff

#

And see what happens

hot cliff Aug 5, 2024, 7:46 PM

#

yeah i disabled it and cleared my cache

#

what the hell man

graceful pawn Aug 5, 2024, 7:46 PM

#

Nice

#

Well it was crashing with the pink spinning card so doesnt surprise me that much XDD

hot cliff Aug 5, 2024, 7:47 PM

#

still crashing

graceful pawn Aug 5, 2024, 7:47 PM

#

Damn

#

That is very weird

#

Without mods at all??

hot cliff Aug 5, 2024, 7:48 PM

#

oh wait it was my ESM mod

#

whoops lol

#

nothing accesses it when clicking new game

#

do i need to continue into the new game?

#

yeah nope nothing

#

yeah not sure what we were getting at there

graceful pawn Aug 5, 2024, 7:50 PM

#

Wait you gotta select one of the two mcs

hot cliff Aug 5, 2024, 7:50 PM

#

i did

#

#

#

nothing

graceful pawn Aug 5, 2024, 7:51 PM

#

How is It possible tho??

hot cliff Aug 5, 2024, 7:51 PM

#

graceful pawn Aug 5, 2024, 7:51 PM

#

Like it's being accesed and read

#

Like it's needed to print any colored stuff

hot cliff Aug 5, 2024, 7:53 PM

#

yeah neither flag are accessing anything

#

is that exactly what you did?

graceful pawn Aug 5, 2024, 7:53 PM

#

hot cliff

What is the address inspected here tho??

hot cliff Aug 5, 2024, 7:53 PM

#

140258930

#

graceful pawn Aug 5, 2024, 7:54 PM

#

Oh, but that should not work like that

hot cliff Aug 5, 2024, 7:54 PM

#

did i do something wrong haha

graceful pawn Aug 5, 2024, 7:55 PM

#

I mean you inspected the memory address not the instruction that acceses the memory address

hot cliff Aug 5, 2024, 7:55 PM

#

i thought we were trying to find that second thing by doing this

graceful pawn Aug 5, 2024, 7:55 PM

#

So you'd need to inspect 143363cc

#

Which is the address that the function is accesing

hot cliff Aug 5, 2024, 7:56 PM

#

?

#

correct?

#

still nothing

#

oh wait

#

wait a second im stupid

#

wait no i'm not

#

what am i doing wrong?

graceful pawn Aug 5, 2024, 7:59 PM

#

I wonder if theres some kind of offset between ghidra memory address and the pc memory

#

That might be the problem

hot cliff Aug 5, 2024, 7:59 PM

#

nope

#

we're on the same version

graceful pawn Aug 5, 2024, 8:00 PM

#

No, I mean having to add some kind of offset or something for the addresses

hot cliff Aug 5, 2024, 8:00 PM

#

oh lol i put the wrong address in

graceful pawn Aug 5, 2024, 8:00 PM

#

For psp I have to do that at least

hot cliff Aug 5, 2024, 8:00 PM

#

graceful pawn Aug 5, 2024, 8:00 PM

#

Oh you are right 😅

#

Lets see if this does something

hot cliff Aug 5, 2024, 8:01 PM

#

we got something already

graceful pawn Aug 5, 2024, 8:01 PM

#

Lfgo

hot cliff Aug 5, 2024, 8:01 PM

#

ok these 3 appear to be for the config menu

#

ok i kinda wanna toy around with these for now

#

so how did you manage to recolor the config menu on psp?

#

like what did you change?

graceful pawn Aug 5, 2024, 8:03 PM

#

Nicee, we have a clue now

graceful pawn Aug 5, 2024, 8:03 PM

#

hot cliff so how did you manage to recolor the config menu on psp?

I was in the process of doing that

hot cliff Aug 5, 2024, 8:03 PM

#

oh lol

graceful pawn Aug 5, 2024, 8:03 PM

#

Because It seems the config from psp/pc changes and in my version the colors seem to be hardcoded

#

But in your versión Swaine managed to get them Pink just changing the isFemc return

#

But I've located the blue backgrounds rn

hot cliff Aug 5, 2024, 8:04 PM

#

yeah id like to avoid that

graceful pawn Aug 5, 2024, 8:05 PM

#

To avoid that good thing you could find out is where the flag is being set

#

Which would involve looking the "writes" the game is doing to the isFemc flag

#

That's how I found the writes and replace them for the femc ones

hot cliff Aug 5, 2024, 8:06 PM

#

brb ima get some water

#

keep explaining

graceful pawn Aug 5, 2024, 8:06 PM

#

Think that'd be It lmao

#

Find the functions that are writing that address

hot cliff Aug 5, 2024, 8:07 PM

#

oh nothing was writing to the flag address

#

only accessing it

graceful pawn Aug 5, 2024, 8:07 PM

#

Yeah, but at the beginning of the game or in the new game screen

#

The game should do the writes

graceful pawn Aug 5, 2024, 8:08 PM

#

graceful pawn Yeah, but at the beginning of the game or in the new game screen

Like just before the spinning loading card

hot cliff Aug 5, 2024, 8:09 PM

#

no way in hell am i that fast

#

unless there’s another way to reload the game that i don’t know about

#

is there a way to hijack the call the game makes to the flag and force it to return the right value ?

graceful pawn Aug 5, 2024, 8:15 PM

#

Yeah, to the write flag function It is possible

#

That's the way I did my cheat for the psp

hot cliff Aug 5, 2024, 8:16 PM

#

ok what does that look like and how do i change it

#

is it the lea function?

#

the first function accessing the config menu looks like this

#

seems like all the functions accessing it are mov functions

#

with lea functions shortly above it

#

so i know te mov thing is setting something in ram

#

so i need to hijack what it's moving and make the value 1?

#

oh it is the lea rax

#

so the mov edx,[rax+rcx*4] is the whole loading of the color thing

#

so somehow i need to change the value it accesses to 1

broken bronzeBOT Aug 5, 2024, 8:24 PM

#

AnimatedSwine

i.e.

alloc(newmem,2048,"P3P.exe"+258920) 
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here
mov rax, 1
ret

originalcode:
sub rsp,28
lea rcx,[P3P.exe+367CFFC]

exit:
jmp returnhere

"P3P.exe"+258920:
jmp newmem
nop 6
returnhere:

Jump

[Go to message!](#1268986046612373577 message)

hot cliff Aug 5, 2024, 8:24 PM

#

for safe keeping

#

ok so i have a code injection window open

#

i need to change the rax value to 1

#

and game crash 😔

#

so not that

#

yeah im stuck :/

#

game keeps crashing every time i change anything

#

it's definitely the first window at address 150D04D74

#

bytes 8B 01

#

but how do i change the value of what's found to a 1

#

i'm getting closer

#

alloc(newmem,2048,"P3P.exe"+10D04D74) 
label(returnhere)
label(originalcode)
label(exit)

newmem: //this is allocated memory, you have read,write,execute access
//place your code here
mov eax,[1]
test edi,edi
je P3P.exe+10D04D89

originalcode:
mov eax,[rcx]
test edi,edi
je P3P.exe+10D04D89

exit:
jmp returnhere

"P3P.exe"+10D04D74:
jmp newmem
nop
returnhere:

#

this almost worked

#

lemme explain my thought process

#

#

this lea value at the top is getting the value from the flag for the gender

#

based on the address and offset

#

that movsxd does something

#

that lea does some math to handle how the value is stored

#

then the mov handles actually inserting that new value

#

so somehow i need to change that lea value to 1

#

ok maybe i don't change the starting value but the ending mov value

#

since it still needs to be operated on

#

lots and lots of crashing

#

but it only crashes when i modify the config screen, so that's progress

#

i can just tell i'm super close but i can't get it figured out femcmad

#

i need to hijack the value it passes but how

graceful pawn Aug 5, 2024, 9:01 PM

#

Is that a function that writes the isFemc flag???

hot cliff Aug 5, 2024, 9:04 PM

#

yeah it's the one that gets accessed when i open the config screen

#

i tried doing a code injection and forcing the value to be one by doing
mov rcx, 1

#

but it didn't crash

#

yet it also didn't change anything.....

#

wait i think im at the wrong address lol

#

i definitely am, one second

graceful pawn Aug 5, 2024, 9:07 PM

#

I mean, you can do that, or you can rather change the arguments of the function that writes to the isFemc flag to write the femc flag

hot cliff Aug 5, 2024, 9:07 PM

#

how would one do that

graceful pawn Aug 5, 2024, 9:07 PM

#

Don't know If I'm explaining XDD

hot cliff Aug 5, 2024, 9:07 PM

#

yeah i dunno man 😭

#

i thought changing the value it grabbed to the femc value would do it

#

i dunno if code injection is working, it seems like it's moving half the code elsewhere and not actually doing anything

graceful pawn Aug 5, 2024, 9:08 PM

#

Hahaha don't worry this stuff is hard

#

Okay so what I would do is

#

Find where is It writing to the isFemc flag

#

And change It so instead of writing the 0 flag (default MC) It writes 1 (femc)

hot cliff Aug 5, 2024, 9:09 PM

#

i feel like i was already kinda doing that

graceful pawn Aug 5, 2024, 9:09 PM

#

It won't probably be 0 or 1 but you get the idea

hot cliff Aug 5, 2024, 9:09 PM

#

so instead of changing what it grabs

#

change what it writes?

#

any of these the write function?

graceful pawn Aug 5, 2024, 9:10 PM

#

hot cliff change what it writes?

Yeah, exactly

hot cliff Aug 5, 2024, 9:10 PM

#

i have a cheat sheet of all the opcodes open but the list is so massive

#

im assuming it's the mov one right

graceful pawn Aug 5, 2024, 9:11 PM

#

I'm not very familiar with x86 unfortunately but well we can always try to understand it

hot cliff Aug 5, 2024, 9:11 PM

#

embarrassing ass typo

#

mov is when you assign a variable to a value

#

and lea is when it grabs a value from an address and assigns it to an address

#

i think

graceful pawn Aug 5, 2024, 9:12 PM

#

Yeah it's moving the content of the address into edx right??

hot cliff Aug 5, 2024, 9:12 PM

#

https://www.felixcloutier.com/x86/

#

im using this

graceful pawn Aug 5, 2024, 9:12 PM

#

Or the other way around not sure now

#

Oh thanks 😁

hot cliff Aug 5, 2024, 9:12 PM

#

yeah it's moving the value from the address into rax

#

and then edx is being assigned a value based on rax+rcx*4

#

and the rax is 0 in this case

#

so rcx is something

graceful pawn Aug 5, 2024, 9:13 PM

#

And what is the ghidra code for this??

#

Always like to take a look into ghidra first

#

To get the general idea of the function

hot cliff Aug 5, 2024, 9:13 PM

#

so true king

#

i forgot ghidra exists

graceful pawn Aug 5, 2024, 9:13 PM

#

Lmao

hot cliff Aug 5, 2024, 9:14 PM

#

im gonna lose my mind

#

it's doing a fucking bit check

#

graceful pawn Aug 5, 2024, 9:14 PM

#

That's why I like to look at the ghidra part first naosmiley

hot cliff Aug 5, 2024, 9:15 PM

#

so the value for edx is either 4103 or 4104

#

because femc is 4104 that makes her value 1.....

#

it's all making sense now femcmad

graceful pawn Aug 5, 2024, 9:15 PM

#

Ok but this is similar to my isFemc function huh

hot cliff Aug 5, 2024, 9:15 PM

#

why did i not check ghidra holy shit

graceful pawn Aug 5, 2024, 9:15 PM

#

Like It checks the flag

hot cliff Aug 5, 2024, 9:15 PM

#

god bless swine and his labeling

#

yeah

graceful pawn Aug 5, 2024, 9:15 PM

#

hot cliff why did i not check ghidra holy shit

Nsa Will be mad with you... Lol

hot cliff Aug 5, 2024, 9:15 PM

#

the NSA is gonna come to my house sit me down and properly educate me

#

ok so

graceful pawn Aug 5, 2024, 9:16 PM

#

LMAO

hot cliff Aug 5, 2024, 9:16 PM

#

it's just doing a bit check

#

that's also a little upsetting

graceful pawn Aug 5, 2024, 9:16 PM

#

Nah actually it's exactly what the psp is doing

#

So we are in the good way

hot cliff Aug 5, 2024, 9:16 PM

#

yeah we're making progress

graceful pawn Aug 5, 2024, 9:16 PM

#

Could you check the return of the function in ghidra??

hot cliff Aug 5, 2024, 9:17 PM

#

i basically just need to enable flag 4104 on the main menu

#

return?

#

like where it goes?

graceful pawn Aug 5, 2024, 9:17 PM

#

Yup

hot cliff Aug 5, 2024, 9:17 PM

#

i forget how to do that

#

one sec

graceful pawn Aug 5, 2024, 9:17 PM

#

To see where this call is coming

hot cliff Aug 5, 2024, 9:17 PM

#

how do you do that again?

#

usually i just double click something and it takes me there but there's nothing this time

graceful pawn Aug 5, 2024, 9:18 PM

#

Can you breakpoint the code when a memory address is read??

#

It should be possible

#

Or well place a breakpoint in the return

#

And make the game trigger the function

hot cliff Aug 5, 2024, 9:18 PM

#

game freezes when i add a break point in the return

graceful pawn Aug 5, 2024, 9:19 PM

#

Nice

hot cliff Aug 5, 2024, 9:19 PM

#

that's good?

graceful pawn Aug 5, 2024, 9:19 PM

#

Then you should be able to know where it's coming from

#

With the step over/into or whatever

hot cliff Aug 5, 2024, 9:19 PM

#

so then i click step into or step out?

#

i still don't know the difference

graceful pawn Aug 5, 2024, 9:20 PM

#

Into is enters to functions

#

And out/over just skips the function call

#

But for returns It doesnt matter

hot cliff Aug 5, 2024, 9:20 PM

#

oh

#

it's taking me to a different spot every time i click step into

graceful pawn Aug 5, 2024, 9:21 PM

#

Yeah you are executing the code step by step

#

So It jumped out of the return?

hot cliff Aug 5, 2024, 9:21 PM

#

yeah

#

to here one sec

#

graceful pawn Aug 5, 2024, 9:21 PM

#

Lets see how It looks in ghidra right??

hot cliff Aug 5, 2024, 9:22 PM

#

#

more bit checks

#

0x1407 is 5127 and 0x141d is 5149

graceful pawn Aug 5, 2024, 9:24 PM

#

So we just got probably femc flag is 0x1407 right??

#

Since you stepped out from the bit check

#

In psp it is 0x1007 tho

hot cliff Aug 5, 2024, 9:25 PM

#

femc flag is 4104

#

unless it's different on the main menu?

hot cliff Aug 5, 2024, 9:25 PM

#

graceful pawn In psp it is 0x1007 tho

that's the male bit flag

#

4103 is the male bit flag and 4104 is the female bit flag

graceful pawn Aug 5, 2024, 9:26 PM

#

How do you know the flags tho??

hot cliff Aug 5, 2024, 9:26 PM

#

im the one that documented them on the wiki

#

and they're everywhere in the games flowscript

graceful pawn Aug 5, 2024, 9:26 PM

#

Ic ic

wicked wagon Aug 5, 2024, 9:26 PM

#

hot cliff im the one that documented them on the wiki

??? Better update them then since they're the other way around on amicitia lol

hot cliff Aug 5, 2024, 9:26 PM

#

mostly for dialogue changes

#

oh that's fantastic

#

ill have to do that 😭

graceful pawn Aug 5, 2024, 9:27 PM

#

But it is quite weird for the game to have one flag for the male and other for female right??

#

In my case, it seems it's just handled by 1007

hot cliff Aug 5, 2024, 9:27 PM

#

well there's a bunch of flags but the main one is those two

wicked wagon Aug 5, 2024, 9:27 PM

#

Tbh from what I remember looking at the flowxfript I'm pretty sure the way it is not he eiki is correct since I remember the game checking for not 4104 to show femc dialogue and options

#

Might be wrong tho tbf I'd have to check again lol

graceful pawn Aug 5, 2024, 9:28 PM

#

If it is set to 0 it's default mc, if it is 1 it's femc. That's how it's working for me in psp

hot cliff Aug 5, 2024, 9:28 PM

#

find a friend uses 4104 to show femc social links

hot cliff Aug 5, 2024, 9:28 PM

#

graceful pawn If it is set to 0 it's default mc, if it is 1 it's femc. That's how it's working...

yeah because 4103 + 1 = 4104 = femc flag lol

#

i need to figure out where that flag is set though

graceful pawn Aug 5, 2024, 9:28 PM

#

But it's not adding the flag, it's just setting it right??

#

Or maybe I'm lost

#

Lmao

hot cliff Aug 5, 2024, 9:29 PM

#

well the code before seems to be checking if that address is 0 or 1

#

then adding that value to 4103

#

to a bit check

#

which determines which colors to show on the main menu

#

so we just need to tell the game that the value it's grabbing isn't 0 by default but 1

graceful pawn Aug 5, 2024, 9:30 PM

#

Exactly, that's why we need to find the functions that write the isFemc flag

hot cliff Aug 5, 2024, 9:30 PM

#

this code here is what handles the main menu it seems

graceful pawn Aug 5, 2024, 9:30 PM

#

To set them to female for the main menu

hot cliff Aug 5, 2024, 9:30 PM

#

yeah that's what i'm struggling with right now :/

wicked wagon Aug 5, 2024, 9:31 PM

#

wicked wagon Might be wrong tho tbf I'd have to check again lol

Yeah I just checked the flags with mod menu in a fresh new-game male and female saves i have and 4104 is on in the male save and 4103 is on in the female save so the wiki's current values are correct

hot cliff Aug 5, 2024, 9:32 PM

#

what?

#

oh wait you're right shit

#

i got it backwards

#

so the value of the flag address is 1?

#

and it needs to be 0?

wicked wagon Aug 5, 2024, 9:33 PM

#

If it's checking bitflag 4104 then that's probably the case yeah

graceful pawn Aug 5, 2024, 9:34 PM

#

This is the function I had for setting the protagonist gender

#

Which could make sense taking into account that it modifies 0x1007 and 0x1008

hot cliff Aug 5, 2024, 9:35 PM

#

so somewhere on the title screen it's doing that?

graceful pawn Aug 5, 2024, 9:35 PM

#

But the game is just looking at this one for the title screen it seems

#

Maybe for more things tho

#

There are more address references

graceful pawn Aug 5, 2024, 9:36 PM

#

hot cliff so somewhere on the title screen it's doing that?

Yeaaah that's the function you'd need to look out, the one that writes the flag

#

Maybe it's documented already in your project

hot cliff Aug 5, 2024, 9:37 PM

#

you think it's this function that's constantly counting up only on the title screen

graceful pawn Aug 5, 2024, 9:37 PM

#

Look for BitSet

#

Or something like that

hot cliff Aug 5, 2024, 9:37 PM

#

it'd be really funny if their method of hardcoding stuff was rapidly setting the value over and over

graceful pawn Aug 5, 2024, 9:37 PM

#

hot cliff it'd be really funny if their method of hardcoding stuff was rapidly setting the...

Would be kinda junky lol

hot cliff Aug 5, 2024, 9:37 PM

#

that sounds like P3P to me

#

oh lol

#

that address

#

#

it is just rapidly setting the address

graceful pawn Aug 5, 2024, 9:39 PM

#

Well not setting but accesing right?

hot cliff Aug 5, 2024, 9:39 PM

#

oh true

graceful pawn Aug 5, 2024, 9:39 PM

#

We know this one already so no problem

hot cliff Aug 5, 2024, 9:40 PM

#

can i just change the value it's grabbing from here?

#

or would that break other stuff

graceful pawn Aug 5, 2024, 9:40 PM

#

Would break a lot of stuff

hot cliff Aug 5, 2024, 9:40 PM

#

ok so not that

graceful pawn Aug 5, 2024, 9:40 PM

#

Always when changing stuff

#

Take a look at the XREF of the current function

#

Because it is the functions that call the function you are inspecting

#

So yeah, as you can see a whole lot of functions call the isFemc function

hot cliff Aug 5, 2024, 9:41 PM

#

yeah

graceful pawn Aug 5, 2024, 9:41 PM

#

So would break a lot of stuff

hot cliff Aug 5, 2024, 9:41 PM

#

way too many

#

so i just need to focus on what's calling it and change that

graceful pawn Aug 5, 2024, 9:41 PM

#

Eeexactly

hot cliff Aug 5, 2024, 9:41 PM

#

which is either of these two 5's (at least for the config menu)

#

i probably sound like an idiot baby with all these observations haha

#

both of them have lea functions that pull from that address with the flag

graceful pawn Aug 5, 2024, 9:43 PM

#

Thing is

#

Watch out this same menu is not being drawn in any other part of the game

hot cliff Aug 5, 2024, 9:43 PM

#

oh wait a second

#

the two 5s interact with each other

graceful pawn Aug 5, 2024, 9:43 PM

#

Because it'll show up as pink if you force it everywhere

hot cliff Aug 5, 2024, 9:44 PM

#

the second one is BitSet while the first is BitCheck

#

hot cliff Aug 5, 2024, 9:45 PM

#

graceful pawn Watch out this same menu is not being drawn in any other part of the game

well the flag would definitely get overwritten by the save

#

and we would be safe there

#

right?

graceful pawn Aug 5, 2024, 9:45 PM

#

We got a function match for the write flag function

hot cliff Aug 5, 2024, 9:45 PM

#

nice

graceful pawn Aug 5, 2024, 9:45 PM

#

Some naming is not right lol, will change later

hot cliff Aug 5, 2024, 9:45 PM

#

yeah your names are the games actual names

#

the names i have are the ones swine came up with

#

ok so

#

i just need to set the flag 4103?

graceful pawn Aug 5, 2024, 9:46 PM

#

hot cliff yeah your names are the games actual names

Well they are the names I came up with, because I've named the functions and stuff lol

hot cliff Aug 5, 2024, 9:46 PM

#

oh wait you're making labels too?

graceful pawn Aug 5, 2024, 9:47 PM

#

Sure, it's the best way to understand the code

#

So I can look for it in a future

hot cliff Aug 5, 2024, 9:47 PM

#

would i be able to hijack this?

#

and force is to be 1?

graceful pawn Aug 5, 2024, 9:48 PM

#

You can try as an experiment

hot cliff Aug 5, 2024, 9:48 PM

#

shit i forget if it's 1 or 0

graceful pawn Aug 5, 2024, 9:49 PM

#

0 is default mc

#

And 1 is femc

#

Or you can check both lol

hot cliff Aug 5, 2024, 9:49 PM

#

yeah

#

how does one undo a code injection btw

#

without relaunching the game lol

#

game crash 😔

graceful pawn Aug 5, 2024, 9:51 PM

#

F

#

What are you changing tho??

#

Equivalent in ghidra I mean

hot cliff Aug 5, 2024, 9:52 PM

#

replacing mov [rcx], eax with mov [4103], eax

#

oh wait a second

graceful pawn Aug 5, 2024, 9:52 PM

#

But what is it doing in the code??

#

Functionally I mean

hot cliff Aug 5, 2024, 9:53 PM

#

oh it's the bit set function

hot cliff Aug 5, 2024, 9:53 PM

#

hot cliff

what i showed here

graceful pawn Aug 5, 2024, 9:53 PM

#

hot cliff oh it's the bit set function

Yeah 😅 that's what i was getting at

hot cliff Aug 5, 2024, 9:53 PM

#

i think i might be doing it wrong

#

i think eax is the flag and rcx is the on or off value

#

this is all so confusing femcmad

#

it accesses the address here are the lea function

#

then does something to get the flag value

graceful pawn Aug 5, 2024, 9:54 PM

#

You can look it up with the breakpoints anytime

#

But why are we changing the BitSet function tho??

hot cliff Aug 5, 2024, 9:55 PM

#

aren't we trying to enable the 4103 flag for femc?

#

instead of enabling the 4104 flag for mc?

#

thus making the UI pink?

#

oh wait you're right

#

that would change everything

#

whoops

#

back to the drawing board

graceful pawn Aug 5, 2024, 9:56 PM

#

Exactly, that'd be very destructive lol

#

Probably that's why it crashed

hot cliff Aug 5, 2024, 9:56 PM

#

ok so something else then

graceful pawn Aug 5, 2024, 9:57 PM

#

You can try to make an experiment and

graceful pawn Aug 5, 2024, 9:57 PM

#

hot cliff

Try to force the femc flag here

#

Instead of calling the function, directly loading the result

hot cliff Aug 5, 2024, 9:58 PM

#

so replace the test eax, eax with mov eax, 4103?

#

or 1?

graceful pawn Aug 5, 2024, 9:58 PM

#

It's good to try this stuff to get comfortable into changing the instructions

#

You can also force the jump

#

There are different ways to go around it

hot cliff Aug 5, 2024, 10:00 PM

#

nope did nothing

graceful pawn Aug 5, 2024, 10:00 PM

#

What did you test??

hot cliff Aug 5, 2024, 10:00 PM

#

so lemme back up a bit

hot cliff Aug 5, 2024, 10:00 PM

#

hot cliff so replace the test eax, eax with mov eax, 4103?

this

#

i set an address to the flag itself, and then checked what opcodes accessed it

#

it says the value is 256

#

yeah i'm completely lost

#

what do you want me to try again?

#

i need to find something to modify to test anything and so far nothing has worked

#

opening the config menu did this

#

#

the two 3s increase when i open it

#

so does the 7

#

the 4 increases by 2 when i close it

#

and the 7 increases by 2 when i close it as well

graceful pawn Aug 5, 2024, 10:05 PM

#

hot cliff

Wanted to try and force the jump here

#

So, it's doing test eax, eax it's just setting up the bool for the branch

hot cliff Aug 5, 2024, 10:05 PM

#

force the jump here?

#

oh

#

so don't modify that

#

that was the mistake i made and probably why it crashed

graceful pawn Aug 5, 2024, 10:06 PM

#

And its doing jnz address

#

You can try to make the opposite thing like a jz (dont know if this one exists)

hot cliff Aug 5, 2024, 10:07 PM

#

in cheat engine it's jne

#

so the opposite would be je

graceful pawn Aug 5, 2024, 10:07 PM

#

Nice, you can try that to see what it does to the game

hot cliff Aug 5, 2024, 10:07 PM

#

nothing lol

#

no crash, no change

graceful pawn Aug 5, 2024, 10:08 PM

#

What about leaving and entering the menu?

hot cliff Aug 5, 2024, 10:08 PM

#

like letting the intro fmv play?

graceful pawn Aug 5, 2024, 10:08 PM

#

Nah like just leaving the config and re-entering

hot cliff Aug 5, 2024, 10:08 PM

#

still nothing

graceful pawn Aug 5, 2024, 10:09 PM

#

Then that function must not be important for the color change

hot cliff Aug 5, 2024, 10:09 PM

#

yeah i don't think so

#

it doesn't even access the flag so probably not

#

do i do more of the same with the other instructions in the access window?

#

time to go one by one through em all

#

man one of these functions is massive

#

i can't fit it all in one window

graceful pawn Aug 5, 2024, 10:14 PM

#

I'd try to look for a similar function to this one

hot cliff Aug 5, 2024, 10:14 PM

#

graceful pawn Aug 5, 2024, 10:14 PM

#

Checking the writes

graceful pawn Aug 5, 2024, 10:14 PM

#

hot cliff

That's normal lol

hot cliff Aug 5, 2024, 10:15 PM

#

graceful pawn I'd try to look for a similar function to this one

is this what you modified?

#

so far nothing seems to be accessing a function like that

#

i checked everything in the opcode accessing that 1433636CC address

#

bottom 3 are for the bit_set function

#

top one is the isFemc byte

#

don't wanna touch that

#

but it's continuously going up

graceful pawn Aug 5, 2024, 10:17 PM

#

hot cliff i checked everything in the opcode accessing that 1433636CC address

Not access but write I mean

hot cliff Aug 5, 2024, 10:17 PM

#

oh write

graceful pawn Aug 5, 2024, 10:17 PM

#

So we can write the female at the start of the game

hot cliff Aug 5, 2024, 10:17 PM

#

nothing it seems

#

started a new game and nothing writes to it

#

a lot more stuff accesses it though

#

lemme see what accesses the bit set function and see if i can find that function you have

graceful pawn Aug 5, 2024, 10:19 PM

#

Ic that's weird

hot cliff Aug 5, 2024, 10:21 PM

#

what did you do with that function when you found it?

#

the whole set gender

graceful pawn Aug 5, 2024, 10:21 PM

#

I checked where it was being called at the start of the game

#

And instead of setting the default gender I set the femc gender

hot cliff Aug 5, 2024, 10:22 PM

#

oh

#

that's simple as hell

#

now i just gotta find that function

graceful pawn Aug 5, 2024, 10:22 PM

#

That'd be the idea yeah

hot cliff Aug 5, 2024, 10:22 PM

#

ugh

#

started a new game with the bitset function being monitored and nothing

graceful pawn Aug 5, 2024, 10:23 PM

#

Maybe you can put a breakpoint in the bitset funciton before the title screen

#

because this function get called as init function so it sets the flags

hot cliff Aug 5, 2024, 10:24 PM

#

breakpoint did nothing

#

should i add another and do new game?

graceful pawn Aug 5, 2024, 10:25 PM

#

hot cliff breakpoint did nothing

in bitset??

hot cliff Aug 5, 2024, 10:25 PM

#

yeah

#

and it's bugged

#

i can't set a breakpoint

#

even after restarting cheat engine

graceful pawn Aug 5, 2024, 10:27 PM

#

For me just choosing the character is doing the bitset

hot cliff Aug 5, 2024, 10:28 PM

#

oh there we go

#

wait what

#

what is even happening in that video lol

#

i don't see anything moving on the right

graceful pawn Aug 5, 2024, 10:29 PM

#

Can even change the flag real time and the colors change as you can see

graceful pawn Aug 5, 2024, 10:29 PM

#

hot cliff i don't see anything moving on the right

Yeah, it's stopping the execution, then I have to press "Go" for it to continue the code

hot cliff Aug 5, 2024, 10:31 PM

#

ugh what the

#

i cannot get that

graceful pawn Aug 5, 2024, 10:31 PM

#

You should be able to modify the flag in real time tho

hot cliff Aug 5, 2024, 10:32 PM

#

that is not happening for me whatsoever haha

#

i am so confused

#

gimme a second i need to restart my computer

#

cheat engine is bugged and won't let me add a breakpoint where i want

graceful pawn Aug 5, 2024, 10:32 PM

#

Lol all right

hot cliff Aug 5, 2024, 10:33 PM

#

so when did you add a break point?

#

and how did you get there?

#

we’re starting at the top of the bit set function right? adding a break point there?

#

computers back up

#

ok i got no idea where to add the break point

#

adding it near the top doesn't stop the flag from changing when i move characters

#

adding the break point anywhere doesn't stop anything

#

the little arrow icons keep changing so the flag is still being set clearly

#

yeah im lost

#

no idea what to do

#

but i'm 🤏 this close

hot cliff Aug 5, 2024, 10:49 PM

#

graceful pawn Can even change the flag real time and the colors change as you can see

how come the address at the top and bottom don't line up?

graceful pawn Aug 5, 2024, 10:50 PM

#

Aaaah down view is memory view

#

Where you can change values on the go

hot cliff Aug 5, 2024, 10:50 PM

#

yeah but shouldn't they be in the same spot?

graceful pawn Aug 5, 2024, 10:50 PM

#

And top view is the instructions/code view

hot cliff Aug 5, 2024, 10:50 PM

#

how'd you know it would be there when the code you're modifying is in a different spot?

#

or where the breakpoint is i guess

#

im still confused on that step, can't find where to put the breakpoint to make an actual difference

#

the colors of the dialogue boxes change no matter where i put the breakpoint

graceful pawn Aug 5, 2024, 10:51 PM

#

I mean I add a breakpoint on the code but I can still modify the memory anytime

hot cliff Aug 5, 2024, 10:51 PM

#

so it doesn't matter where the breakpoint is?

hot cliff Aug 5, 2024, 10:52 PM

#

graceful pawn I'd try to look for a similar function to this one

can we get back to finding where this is haha

#

i don't really know what i'm supposed to get from this screen and breakpoint

graceful pawn Aug 5, 2024, 10:54 PM

#

graceful pawn For me just choosing the character is doing the bitset

I mean, we got matching functions, so if you can add a breakpoint on the bitset and do what I do in this video, it should stop the execution

hot cliff Aug 5, 2024, 10:55 PM

#

ok but where did you put the break point

#

i already added several breakpoints and none stopped the execution

graceful pawn Aug 5, 2024, 10:55 PM

#

Oh that

#

I just added it to the return

#

In mips jr is jump return which is the return

hot cliff Aug 5, 2024, 10:56 PM

#

oh so not ret

#

at the bottom

#

but something else

#

jna, je?

graceful pawn Aug 5, 2024, 10:57 PM

#

Well there are two returns on the function you are right

hot cliff Aug 5, 2024, 10:57 PM

#

no, just one

graceful pawn Aug 5, 2024, 10:57 PM

#

Well, depends how the code compiled

#

But if there's one that's better

#

Just place it there

hot cliff Aug 5, 2024, 10:58 PM

#

i did

#

and nothing happened

#

nothing stopped

#

and the flags kept changing

#

ghidra says there are two returns

#

but i'm only seeing one when i click select current function

graceful pawn Aug 5, 2024, 10:58 PM

#

Can you click the two returns to see where the asm takes you?

hot cliff Aug 5, 2024, 10:59 PM

#

in ghidra?

graceful pawn Aug 5, 2024, 10:59 PM

#

Yeah

hot cliff Aug 5, 2024, 10:59 PM

#

nowhere

#

they do nothing when clicked or double clicked

graceful pawn Aug 5, 2024, 10:59 PM

#

I can do this and it will select me the approximation of the assembly code of what im selecting

hot cliff Aug 5, 2024, 11:00 PM

#

oh you mean that

#

i can see them yeah lol

#

adding a break point to the second return also does nothing

#

no stopping, flags clearly change based on the dialogue colors

graceful pawn Aug 5, 2024, 11:01 PM

#

That's so weird 🤔

#

Well I gotta rest now, it's a bit late here

hot cliff Aug 5, 2024, 11:02 PM

#

no worries

#

ill keep poking and prodding

graceful pawn Aug 5, 2024, 11:02 PM

#

Hope you dig some stuff of the code hee_approves

hot cliff Aug 5, 2024, 11:02 PM

#

hopefully swine will know something

hot cliff Aug 5, 2024, 11:12 PM

#

graceful pawn I'd try to look for a similar function to this one

gonna be such a pain to find this considering this is the decompiled function

#

150d04d00

#

14025dda0

#

ok so it seems like that function you listed just doesn't exist at all for me

#

i double clicked the bitset xref on the right there

#

which listed every time the function was used

#

including two named functions

#

oh nevermind there are much more wtf

novel crane Aug 5, 2024, 11:25 PM

#

thunk functions be like

hot cliff Aug 5, 2024, 11:35 PM

#

im legit going through each function one by one

#

ugh

#

that took ages

#

and i didn't even find it :/

hot cliff Aug 6, 2024, 12:05 AM

#

this is the closest one

#

ok i don't think the function ivan shows even exists

#

ive checked every reference for BitSet and nothing

#

ive been at this for 6 hours straight

#

i am so damn close but i need a break

#

ill wait for swine to get on because i'm stumped

#

i need to find where the game sets the protags gender at the start of the game and change it from the male MC to the female MC

#

that's what teolicht did in the PSP version

#

that way it'll get overwritten when the save is loaded

hot cliff Aug 6, 2024, 12:38 AM

#

ok what the fuck is a sig scan

#

why do people keep using that term when google has no idea what that is

#

search program text?

#

say that?

nocturne trench Aug 6, 2024, 2:24 AM

#

https://reloaded-project.github.io/Reloaded-II/CheatSheet/SignatureScanning/

#

It's not exactly a common thing, it's pretty niche knowledge

#

Only really applicable to modding modern games so I'm not surprised you had trouble finding information

#

(I've not read everything, just the last few messages)

hot cliff Aug 6, 2024, 2:25 AM

#

yeah i still couldn't gleam much from the page

#

plus i don't think i can really search for what's shown there since it's the decompilation window

nocturne trench Aug 6, 2024, 2:26 AM

#

What's the actual problem?

hot cliff Aug 6, 2024, 2:26 AM

#

graceful pawn I'd try to look for a similar function to this one

need to find this function somewhere

#

as it handles setting the gender at the beginning of the game

nocturne trench Aug 6, 2024, 2:26 AM

#

Oh

hot cliff Aug 6, 2024, 2:26 AM

#

by default it's male

#

just need to make the default female

#

apparently

#

according to ivan

#

i had a bunch of other ideas but they didn't seem to work

#

and this is technically the highest up the chain it can go without breaking a bunch of stuff

nocturne trench Aug 6, 2024, 2:27 AM

#

It'd probably be easiest to just set a breakpoint on that bit to see what writes to it

hot cliff Aug 6, 2024, 2:28 AM

#

a breakpoint on the isFemc flag?

#

the byte?

nocturne trench Aug 6, 2024, 2:28 AM

#

Yeah

#

Break on write specifically

hot cliff Aug 6, 2024, 2:29 AM

#

break on write to this?

#

or to the flag

nocturne trench Aug 6, 2024, 2:30 AM

#

The flag

hot cliff Aug 6, 2024, 2:30 AM

#

so 1433636cc

nocturne trench Aug 6, 2024, 2:30 AM

#

Yeah

hot cliff Aug 6, 2024, 2:30 AM

#

how does one do a break on write in cheat engine haha

nocturne trench Aug 6, 2024, 2:31 AM

#

Right click the byte in the memory window, the option should come up

#

Either that or use "Find what writes to", it should accomplish the same thing on this case

hot cliff Aug 6, 2024, 2:33 AM

#

oh wow that did it for once

#

pressed new game and it froze

#

ok so step out? i think?

nocturne trench Aug 6, 2024, 2:33 AM

#

Yeah

hot cliff Aug 6, 2024, 2:34 AM

#

oh it's just a call

#

#

imagine i find the function right here

#

no

#

it just leads to a thunk function call

nocturne trench Aug 6, 2024, 2:35 AM

#

Oh wait, you didn't need to step out

hot cliff Aug 6, 2024, 2:35 AM

#

oh

nocturne trench Aug 6, 2024, 2:35 AM

#

What you broke on should be the function you need

#

(Probably)

#

Wasn't thinking

hot cliff Aug 6, 2024, 2:36 AM

#

oh

#

lol no worries

#

oh it force moved me

#

weird

#

that's normal?

nocturne trench Aug 6, 2024, 2:38 AM

#

Force move?

hot cliff Aug 6, 2024, 2:38 AM

#

yeah like i'm no longer at the address i put the breakpoint at

#

nocturne trench Aug 6, 2024, 2:38 AM

#

That's the address that wrote to that flag

hot cliff Aug 6, 2024, 2:39 AM

#

oh

nocturne trench Aug 6, 2024, 2:39 AM

#

Open that up in Ghidra and have a look at the function

#

Hopefully it looks similar to what you were looking for

hot cliff Aug 6, 2024, 2:39 AM

#

doesn't seem like there's any bitset here

nocturne trench Aug 6, 2024, 2:40 AM

#

I think that's zeroing out a bunch of them at once

#

You could add a hook and just change the flag you want after it finishes running

hot cliff Aug 6, 2024, 2:41 AM

#

would that change the main menu config screen though?

#

it only broke after i clicked new game

nocturne trench Aug 6, 2024, 2:41 AM

#

Then no

#

Oh, I see what you mean. It's probably set in some other function

hot cliff Aug 6, 2024, 2:42 AM

#

yeah

#

i need to change the default gender assigned in the main menu

#

which should hopefully change the loading icon card too

nocturne trench Aug 6, 2024, 2:42 AM

#

Well good luck, I've gtg back to work

hot cliff Aug 6, 2024, 2:42 AM

#

😔

#

well let's hope this can carry me the rest of the way there

#

i got it to break on the config screen

#

ok so that break took me to the bitset function

#

weird

#

like actually part of the bitset function

#

oh so the function i need is bitset haha i get it now

#

incredible

#

ok so break on something else besides the config screen it seems

#

not many options

#

i need to figure out how to reload the game while it's open so i can get where it's set when the game launches

#

well hey that's something

#

ok well keeping the flag value at 640 is what makes it render pink

#

but everything is kotone when you load a male save

#

i think i might need to make this into a dll

#

seems like loading a save doesn't actually undo the flag

#

i guess i could say to disable the mod when playing as MC considering why would you be playing as MC with this mod enabled

#

but the game crashes with my current expatch

#

it gets in game but dies on the card :/

#

📎 omegaultracheat.expatch

#

is makesig.py just busted or something

#

no it works you just need to start of function

#

what doesn't work are my changes?

#

is this incorrect?

📎 omegaultracheat.expatch

#

its whats on the tin so

#

nevermind i guess something happened because it crashes again

#

it's crashing just before the card shows up so it's something to do with that

#

just in case

📎 omegaultracheat.expatch

#

im stumped

#

this issue is known but was never told how to fix it

hot cliff Aug 6, 2024, 3:35 AM

#

graceful pawn This'd be the code with the other name

ok now i need to find this function :/

#

did a check for how many functions reference isFemc and it's 696

#

ugh this shit sucks man

#

i wish there was a way to force the game to start from the beginning like on PSP

#

while keeping the game open

#

i think it's time to stop

#

i kinda wasted my entire day on this and got basically nowhere

#

so ill pick this up later after a break or something

#

idk man im just tired of getting nothing done

#

the cheat doesn't work because i need to nope out the path in the message i replied to, zero clue on how to find that exact function when there's between 235-696 references to isFemc

#

that is assuming isFemc is the same function we're both referring too

#

considering we're both crashing in the same way i assume so

hot cliff Aug 6, 2024, 7:15 AM

#

ok i feel better now

#

binge watched the last 5 episodes of gravity falls

#

crazy that you can upload anything on the internet to evade copyright by mirroring the video

#

like we really have not advanced copyright detection to get past that, wild

#

gonna take one last stab at it then im sleeping

#

can't be up too late or else i sleep walk and i've been doing some stupid shit when i do

#

gonna try to rubber duck this by explaining the situation out loud

#

ok that is helping

#

the 696 one is IsFemc as a value itself

#

but the 235 is the function itself

#

considering there's a (); that means it's a function

#

so i just need to crawl through 235 references

#

and find which one matches this string

#

time to turn on some wendigoon

graceful pawn Aug 6, 2024, 7:36 AM

#

hot cliff well hey that's something

Uuuuh good job, you found the flag!!

hot cliff Aug 6, 2024, 7:36 AM

#

yeah it was staring at me in the face

#

the DAT_1433636CC was literally an address

#

for male it was 256

#

for femc it's 640????????

#

so adding it as an address in cheat engine, force a value of 640

#

bing bang boom, pink config screen

#

problem though

#

loading a male save makes you kotone

#

like everything

#

and of course making it into an expatch causes the game to crash just before the loading card

#

so now i need to figure out what you figured out

graceful pawn Aug 6, 2024, 7:38 AM

#

Yup, seems like it

#

So you made a patch for that address to stay in femc right??

hot cliff Aug 6, 2024, 7:38 AM

#

yup

graceful pawn Aug 6, 2024, 7:38 AM

#

Ic ic

hot cliff Aug 6, 2024, 7:38 AM

#

hot cliff just in case

this

graceful pawn Aug 6, 2024, 7:39 AM

#

Well at least you can now toy with that address, like I did with mine, looking which part of the programs write to It

hot cliff Aug 6, 2024, 7:39 AM

#

yeah that's the problem

#

i have no idea how to figure out what writes to the loading card

graceful pawn Aug 6, 2024, 7:39 AM

#

Like placing a breakpoint when writing to that address

hot cliff Aug 6, 2024, 7:40 AM

#

like

#

i need to launch the game, add cheat engine to the game, add the debugger, and add a break point, all before it progresses into the intro?

#

no idea how to freeze the game

#

you're lucky you're working with the psp version and can easily reload the game from the start

graceful pawn Aug 6, 2024, 7:40 AM

#

Yeah wonder how to do that in pc

hot cliff Aug 6, 2024, 7:41 AM

#

but there's no easy way to get back to the beginning besides restarting the entire game

graceful pawn Aug 6, 2024, 7:41 AM

#

Yeah in psp I just hit restart and boom

hot cliff Aug 6, 2024, 7:41 AM

#

yeah.... 😔

#

lucky

#

2024 and i'm working on PC mods while others are working on hardware mods

#

what a world we live in

graceful pawn Aug 6, 2024, 7:41 AM

#

Unless we can find a function that gets executed at the start

#

Well no

#

Because there's no time to set the debugger

#

Damn

#Modifying title screen background color using cheat engine + anything else for forever and ever