Modifying title screen background color using cheat engine + anything else for forever and ever

[hot cliff]

exactly

and man it's so hard to find steam features

"refresh game steam"
"oh you mean Re:Fresh on steam right?"

NO

anyways i'm listening to some video about lovecraft while going through each reference to the IsFemc function

im gonna be mad if IsFemc isn't GET_PROTAG_GENDER

[nocturne trench]

There are a few ways you could do it. I normally am just quick enough, the game takes a little bit to actually start (you can do stuff while it's not actually open, when it's just the reloaded consult) so imo it's not hard to do if you're ready.
If that's not working though you can start a process with cheat engine (or any debugger really) and it'll immediately break

[hot cliff]

oh wait you're right

[graceful pawn]

It's probably not

[hot cliff]

if you click the reloaded window while it's loading and cause it to pause it freezes the game lol

i forgot about that

[nocturne trench]

You could also add a thread.sleep in your mod's constructor to just make it take longer

[graceful pawn]

lfgo

[hot cliff]

how do i do that last thing haha

[nocturne trench]

The button you press to attach to the game has a button for creating a new process in the window where you'd normally select the exe

[hot cliff]

ok the stalling of the reloaded window only manages to freeze the main menu being loaded

[nocturne trench]

It's a little plus or something I think

[hot cliff]

right

[nocturne trench]

Or maybe a folder icon

[hot cliff]

i do not see that

oh the folder?

[nocturne trench]

Maybe

I'm just going off my memory

I'm not at home

Send a screenshot of the window if you can't find it

[nocturne trench]

Press the looking glass thing (top left) that you'd normally use to attach to the game

It's in that window that pops up

[hot cliff]

under processes?

[nocturne trench]

Ah you press file

Then the option is somewhere in that menu

[hot cliff]

that's the worst looking button ever

wow

so create process?

oh and then i just open P3P.exe?

[nocturne trench]

Yeah

Yeah

[hot cliff]

damn

it didn't immediately break :/

[nocturne trench]

😕

It should...

[graceful pawn]

Where did you place the break??

[hot cliff]

is it the reloaded part?

is reloaded doing something

i didn't place a break

[graceful pawn]

Oh you mean It didnt stop

[hot cliff]

but it clearly did seeing as the memory viewer shows the break controls

[graceful pawn]

Gotcha gotcha

[nocturne trench]

You don't place any, it won't execute. It'll just be in a debugger on the first instruction of the program

Yeah that's right

[hot cliff]

oh for real?

[nocturne trench]

Then place the break point or whatever where you wanted it and run

[hot cliff]

ohhhh

ok

weird it kept going

[nocturne trench]

Then whatever code you were putting it on didn't get run

You've got the wrong thing...

[graceful pawn]

Where did you breakpoint??

[hot cliff]

it literally puts me there when i add the process so i got no idea

[hot cliff]

right here

[graceful pawn]

But what function is that one??

[hot cliff]

this?

i have no idea what i'm looking at

it's a seemignly named function though

so it clearly has a purpose

[graceful pawn]

Oh that's the entry nice

[hot cliff]

which a named reference

i love when i send a screenshot utterly confused and y'all are like "oh that you're on the right track"

somehow this makes sense to y'all

[graceful pawn]

The entry you can tell it's like the first first function the program runs

[hot cliff]

oh then why does it not break then wtf

[graceful pawn]

Lmao

[hot cliff]

i blame reloaded

how do i remove the thing that still launches the reloaded window when opening through steam?

[graceful pawn]

Yeah that's weird, It should stop

Unless you placed the break inside the if or smth It could not run

But It should

[hot cliff]

it was not reloadeds fault :/

good to know

still doesn't stop

do i need to record a video of what i'm doing

[nocturne trench]

I don't see the problem, it did break at the start at it was meant to. You just never put a breakpoint yourself on whatever function you need from the sound of things

[hot cliff]

ok gimme a second ima record a video

[graceful pawn]

Oh so It did break then??

[nocturne trench]

That's what that screenshot is

It's in the debugger at the entry

[hot cliff]

you're kidding me

the break point stops everything but the loading icon card

until i click on the game, then it advances and stops again on the next thing to load

[nocturne trench]

So the breakpoint does work, you've just got the wrong thing?

[hot cliff]

somehow it's not the first thing the game loads

i guess

[nocturne trench]

I'm pretty sure init and init_free are the first things loaded

I take it this isn't in them?

[hot cliff]

menu still frozen, only advances a little bit when clicked

i actually don't know if those files are in there one second

[nocturne trench]

Oh wait

The game is advancing without you clicking run?

[hot cliff]

yeah

[nocturne trench]

Oh that shouldn't happen

[hot cliff]

when i click onto the game it advances slightly

fantastic

[nocturne trench]

Disable reloaded asi loader whatever

[hot cliff]

cursed? or am i dumb?

i did i deleted it

[nocturne trench]

Then that makes no sense to me

[hot cliff]

i could empty my tash can

[nocturne trench]

Nothing should happen until you press run

It being on the reloaded process is the only thing I can think of that'd cause that

[hot cliff]

ok i know what's happening

breakpoint isn't working

it's just pausing when i tab out

[nocturne trench]

Yeah

[hot cliff]

because persona essentials disables that 😔

[nocturne trench]

Are you sure you don't have multiple instances of the game open or something

Cheat engine has got something in a break point

[hot cliff]

it's somehow in my background processes

[nocturne trench]

I think that's the one that's broken

[hot cliff]

oh that's just a part of cheat engine

went away when i closed cheat engine

[nocturne trench]

Maybe the window hasn't even been created yet

[hot cliff]

yeah it's definitely a part of cheat engine

closed down cheat engine, went away, opened it back up and readded the exe, it's back again

[nocturne trench]

It's not a part of cheat engine, cheat engine is just attached to it

[hot cliff]

well it's definitely the window having not been created yet

because i'm pretty sure cheat engine is supposed to launch the game

oh wait does that mean the breakpoint is working working and thus not creating the window?

[nocturne trench]

Yes

You need to let it run for it to actually finish launching

Presumably when you press run the game will appear

[hot cliff]

yup

ok so

that entry thing is the first first first thing that runs

[nocturne trench]

Yes

[graceful pawn]

Oh that'd make total sense

[hot cliff]

yeah

i just don't really know how to branch out from that

would anything be accessing that address or writing to it?

from what i saw in ghidra it doesn't seem like anything meaningful is stored there

[nocturne trench]

It's the beginning of everything

Everything the exe does starts from there

[hot cliff]

right

like i sorta understand the significance

but the only way i really know how to jump from one address to another is the what accesses / writes to this address in cheat engine

do i just click the LAB_15C333054 and see where it goes

and keep jumping till i find what i need in ghidra?

[nocturne trench]

What are you actually trying to do?

[hot cliff]

stop it from crashing when the card is loaded

otherwise the config menu is pink and everything else is good

[nocturne trench]

Starting from main might eventually get you where you want but that would take an eternity to go through everything is does

I remember seeing some error message when it crashed for me. Do you get that?

[hot cliff]

do i get the error?

like a crash log?

or "do you understand" haha

[nocturne trench]

No like an error in the console

Does one get printed?

I have a mod that adds back some error logging to the game, I'm not sure if that's what caused it

[hot cliff]

it appears so

[nocturne trench]

Ah ok

[hot cliff]

as the reloaded log ends before any files are loaded

[nocturne trench]

Well maybe that error is useful, very possibly not

Well I think the next thing to do would be to look at a crash dump to see why it's crashing

[hot cliff]

man i hate doing that

watch it be something dumb about writing to too long of an address

where are dumps stored again? it's not crashdat yeah?

[nocturne trench]

Yeah it should be

[graceful pawn]

For the psp at least the error log for the Pink first spinning card was not very useful unfortunately

[nocturne trench]

It's in the game's folder

[hot cliff]

got it

god bless everything search

ok so that's the last time the game crashed

and you open in visual studio yeah?

[nocturne trench]

Yeah

[hot cliff]

that was my second guess

protected memory apparently

[nocturne trench]

(At least that's what I use, ik there's others but I've never bothered learning)

Fun

[hot cliff]

does that mean i'm boned?

how do you get around protected memory?

[nocturne trench]

It probably means something is 0 that shouldn't be

[graceful pawn]

Same error as PSP actually

[nocturne trench]

I doubt it's actually a memory protection error

[hot cliff]

something is 00 that shouldn't be?

[nocturne trench]

Far more likely that it's just reading from the wrong address

[hot cliff]

is it the instructions i had to nope out due to a mismatch in byte size?

[graceful pawn]

It Will take you to a draw function if you go to the pc when crashed

Well in my case I had the pc but here doesnt look like it's showing up

[nocturne trench]

You can see where it broke

[hot cliff]

oh how do i do that lol

[nocturne trench]

In vs you need to press run with native (or mixed both seem to work)

Then wait an eternity while it loads a bunch of stuff

[hot cliff]

oh hey there's an address

exception unhandled at

0x00000001403DBF16

[nocturne trench]

Well have a look at that in Ghidra

Hopefully it's something obvious

[hot cliff]

genuinely not a clue

[nocturne trench]

Yeah that location 308 definitely isn't an address

[hot cliff]

it says sprKey?

[nocturne trench]

Could you send a screenshot

[graceful pawn]

A draw function right??? Same as psp

[nocturne trench]

Tbh I don't really remember much about the spr structure

I never got deep enough to fix the crash with spr emulator 😦

Looks like a sprite is messed up or something

[graceful pawn]

I was able to fix It in psp which could work on pc looking it's the same error

[nocturne trench]

Maybe it didn't finish loading or something like that

[nocturne trench]

How'd you fix it?

[hot cliff]

by noping out a reference to a path i'm pretty sure

this i think

[graceful pawn]

Yeah, should be ablo to find It placing a breakpoint at the acceses of the femc flag at the init functions

[hot cliff]

init functions as in plural

how does one find the other ones besides entry lol

please tell me they're all next to each other

[nocturne trench]

That's not really how functions work

[hot cliff]

a man can dream

[nocturne trench]

It's all up to the compiler where they go.

It'll put them wherever it wants, sometimes related functions may end up next to each other but you should consider it luck more than anything. The location of code isn't something you should count on

[hot cliff]

there's gotta be a different way to fix it

[nocturne trench]

(Obviously it's not literally random, the compiler has some logic that decides where things go but that's black magic. May as well think of it as random)

[nocturne trench]

What do you see if you look at the function that called that?

[hot cliff]

the function that called that address?

[nocturne trench]

Yeah

Vs should show you a call stack

[hot cliff]

yeah?

[nocturne trench]

Somewhere in the bottom right I think

[hot cliff]

i see it

it just has the same address i got from the unhandled exception error

1403DBF16

[nocturne trench]

There should be multiple addresses...

[hot cliff]

oh lol

[nocturne trench]

Yeah the address below that is what called it

And so on

Try looking at them in Ghidra and see if there's anything interesting

[hot cliff]

nothing here i don't think

seems like a whole lotta nothing

[nocturne trench]

I think you need to do further out

Looks like that's probably just some function that draws sprites

[graceful pawn]

I mean some of the functions that gets executed at the start

[hot cliff]

all of the addresses related to P3P.exe

[graceful pawn]

But knowing there is a isFemc here which in my case have a Bit check, you should be able to put a breakpoint in Bitcheck

That while it's stopped in the entry

Then run the program and find out where it is doing some kind of BitCheck

Problem is if the program runs BitCheck for something else at the start that is not the isFemc flag

But you can try

[hot cliff]

adding a break point to the return in bitcheck did nothing to stop the game

so i'm assuming what you said is correct

[graceful pawn]

Nothing??

[hot cliff]

oh wait there we go

now it froze

[graceful pawn]

Lfgo

[hot cliff]

ok so launch the game normally and tab out asap

don't launch through cheat engine itself

it didn't jump anywhere though

is that normal?

[graceful pawn]

Wdym jump??

[hot cliff]

usually when it breaks and stops it jumps to where it was being accessed from, no?

[graceful pawn]

All right, it's in the return right??

[hot cliff]

yeah

should it go somewhere else lol

[graceful pawn]

Yeah, lets check where this call is coming from

[hot cliff]

ok still no jump

but i got it to add a break point before the card loads

do i add a what accesses this memory address check now lol

[graceful pawn]

I would check how It looks in ghidra for now

[hot cliff]

the exact same

because i knew where to add the break point at

this is the bit check function

[graceful pawn]

Great, I would look into the return of the assembly code

Like to know which bit we are checking or the function that checks the bit

[hot cliff]

oh how would one do that

[graceful pawn]

Stepping in the return of where it stops

Just like yesterday

[hot cliff]

back to the same spot as before

with the test eax, eax

[graceful pawn]

Yeah but might not be same function

Lets check the Code in ghidra

[hot cliff]

it appears to be the exact same function from yesterday

[graceful pawn]

This is the just after the entry right??

[hot cliff]

what?

i have no idea if it's after the entry 😭

i just added a break point to the bit check function

did a few jumps

same spot

same function :/

[graceful pawn]

I mean

You alt tab just when opening the game so It doesnt go on

Then you place the breakpoint on the bitcheck

[hot cliff]

which i did?

[graceful pawn]

Okay that's what you did in this case then

[hot cliff]

yeah lol

[graceful pawn]

Okay okay thought you might be somewhere else

[hot cliff]

no yeah i did a bunch of jumps, got to the same test eax, eax thing

went into ghidra

traced that function back

[graceful pawn]

Wdym a bunch of jumps??

[hot cliff]

sorry

step intos*

[graceful pawn]

Oh ic ic

[hot cliff]

yeah

it appears to be the same function from before

so the bit check in the beginning is returning the value here

for some reason

which seems to be comparing the value of a bunch of stuff

[graceful pawn]

How many functions call this function??

[hot cliff]

how would i get that number

[graceful pawn]

Like the xrefs

[hot cliff]

13

[graceful pawn]

Not many apparently

[hot cliff]

is that a good or a bad thing lmao

[graceful pawn]

Good because it's a function not called by a bunch of stuff

So might be close to something

[hot cliff]

oh so i just gotta check each one

[graceful pawn]

Nah nah no need lol

I just thought you force the defaultmc value here

And see if that fixes the crash

[hot cliff]

nah i force it at this top address

14010f600

right here

replace the MOVZX with mov EAX, 640

[graceful pawn]

And that crashes the game correct??

[hot cliff]

yeah

but also colors the config screen pink

[hot cliff]

where?

i don't see a place where it checks the gender bit flag

[graceful pawn]

Okay then, what if we place a breakpoint at the ret of this function and see when It is being called at the start???

[hot cliff]

or where it accesses that address

sure ill try that

[graceful pawn]

Since it's the one causing the issue

Lets test that

Maybe we get to same function for pc

[hot cliff]

ok that froze the game

[graceful pawn]

That's a good sign

[hot cliff]

that also accesses the same test eax, eax address

i guess it all comes back to that

[graceful pawn]

Same exact address??

[hot cliff]

the return returns the value there

oh wait no

different address

[graceful pawn]

You sure it's same one??

[hot cliff]

same structure

14010F39B

[graceful pawn]

Nice good sign

[graceful pawn]

At the end of the day it's making a book with the test so most likely the same structure Will be done when this function shows up

[graceful pawn]

Uuuh this is looking similar to my function!!!

[hot cliff]

this actually looks pretty close

yeah that's what i'm saying haha

not exactly the same but like

almost there?

[graceful pawn]

Lets force the default MC path here

How does the jump looks like??

Like the branch after the test eax

[hot cliff]

so double click the lab thing?

[graceful pawn]

Oh wait Its in the ghidra view, I'm blind lmao

[graceful pawn]

It would be the jump here

[hot cliff]

yeah the JNZ?

i clicked that

[graceful pawn]

What we are gonna do to try to fix it is nop the jnz from here

So that in never jumps

Forcing the mc path

[hot cliff]

ok done

unpause the game?

[graceful pawn]

Is the pink patch on??

[hot cliff]

oh no whoops

[graceful pawn]

Let's check it with the pink patch

But remember nopping the instruction again, the 14010f39d

[hot cliff]

damn it crashes anyways

not even paused

[graceful pawn]

Didnt paused??

[hot cliff]

yeah when you tab out it pauses

crashed anyways

yeah no i can't get the game to freeze with the mod enabled

[graceful pawn]

Maybe it's crashing too fast??

[hot cliff]

yeah

and im spam clicking to tab out

nothing

i think i should go to bed

it's 2:20 AM

do you own P3P PC?

[graceful pawn]

Unfortunately no 😭

[hot cliff]

damn

sad times

[graceful pawn]

Yup

[hot cliff]

i would love to keep going at this but i am exhausted and i'm starting to act stupid

[graceful pawn]

Can only try to help through chat lol

[hot cliff]

but lemme get the gist of what to do when i get up

i need to nope out a path to force the femc

not do what i did and force the isFemc byte to always be the femc value of 640

[graceful pawn]

Well to force the default mc path but just in this function

[hot cliff]

yeah

too bad there's probably a million functions with test eax, eax that are super close to what we need

[graceful pawn]

Well yeah, but not so many at the start of the game, which is what we looking for

[hot cliff]

yeah

[graceful pawn]

And this one is looking sus

So maybe we are in the good way

[hot cliff]

guess i can't launch with reloaded if i wanna be able to freeze at the start

no matter what i guess it has persona essentials enabled

[graceful pawn]

Maybe you can patch it directly??

[hot cliff]

even with all my mods disabled

[graceful pawn]

Like the nop

Include it in the patch

[hot cliff]

like with an inaba exe patch?

[graceful pawn]

Yeah right??

[hot cliff]

project for the morning

[graceful pawn]

Yeaah, lets see what this does

Gn!!

[hot cliff]

i will say the function isn't exactly the same

it's very close but the math should be the same regardless of language

[graceful pawn]

Yeah, but could be decompilation shenanigans

[hot cliff]

so it's not the same function

@nocturne trench don't tell me that the math could change with assembly languages 😭

math is math

[graceful pawn]

lemme check the function

[hot cliff]

what we're looking for for reference

ok i'm looking at this closer and it's stupidly close

[graceful pawn]

Could very well change

[graceful pawn]

Yeah right??

[hot cliff]

like look at that very bottom part

basically the same

[graceful pawn]

Uuuuh we are on the same page

You can name the tags if you want

Just like mines if you wanna keep the info in the code

[hot cliff]

there's no two returns though

but god are they close

this is kinda pissing me off because now i'm interested but man am i tired

[graceful pawn]

But there are two gotos that go to a return in here

[hot cliff]

that's true

maybe the math does change from assembly languages

fuck man

ok 30 more minutes is all i'm giving this

[graceful pawn]

Yeah we are so close, it's tilting lmao

[hot cliff]

2 minutes while i get water and a drink

[graceful pawn]

Nicee

[nocturne trench]

What math are you referring to?

[graceful pawn]

Guess he is refering to the pointer references

But yeah from psp to pc they will 100% change

[nocturne trench]

Ah right

If the structs changed then yeah

[hot cliff]

back

[graceful pawn]

Could be possible in some manner

[hot cliff]

ok so this should be the same function then yeah

so what did you end up doing to it?

you noped out what again?

the path to the crashing thing?

so this?

[graceful pawn]

I nopped the circled path, most precisely the if (iVar3 != 0) goto FEMC_CRASHING_PATH

[hot cliff]

i wonder why it's == 0 now

that's the confusing part

[graceful pawn]

So not this watch out

[hot cliff]

not that?

[graceful pawn]

Nope, thats from later

I'm nopping just after the isFemc function right??

[hot cliff]

so that?

gonna be honest i don't think our IsFemc functions are the same

[graceful pawn]

Yup, that if (iVar1 ==0 from the top)

[hot cliff]

ok

so

this hurts my head just a little

one second

i need to make a sigscan of this address for the cheat

figure out how it looks by doing exactly that in cheat engine

and then copy the code + the offset as a patch to inaba exe patch

ez

i think

[graceful pawn]

Don't know how it works for pc

But I will trust

XDDD

[hot cliff]

uh

i don't think my pattern includes my address for the part i need to nope out

am i crazy or is it just not there

oh that's cool it got cut off

ugh

how go i get the full thing

or like from my current position

trying to do from cursor position spits out this error

whoops

forgot to send the photo haha

[nocturne trench]

Oh right, some function changed name in ghidra 11 or something like that

I forgot, you need to fix the makesig script

Replace yours with this, it should work then

[hot cliff]

sounds easy enough

oh

thank you

ok let's hope this does it

awesome

no more lengthy signatures

takes much longer >.>

[graceful pawn]

Is it patching now??

[hot cliff]

i think that's correct?

i'm a little worried about the pattern being less

oh that's why

so 7 byte replacement for a 8 byte pattern?

that feels wrong?

[graceful pawn]

Wait what it is being nopped here??

In ghidra for reference

[hot cliff]

the lab you told me to nope out

[graceful pawn]

But that's the tag, I meant the jump to that tag

[hot cliff]

oh

[graceful pawn]

This I meant

[hot cliff]

so the 74 12 just below it?

wait what?

highlight the correct part lol

so nope out which part?

this?

or this?

[graceful pawn]

Like, select the part I rounded in the code

[hot cliff]

or the JNZ

[graceful pawn]

The jnz iirc

But you can select it in the ghidra code and it will show up in the assembly

[hot cliff]

yeah i gotchu

ok i think i got it

lemme test in game

OH MY

IT

IT WORKS

[graceful pawn]

LFGOOOO

[hot cliff]

I SAW THE PINK CARD

OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOH

dude im geeking

and i made it in the time limit

god damn

this is crazy

[graceful pawn]

We cookin rn hahaha

[hot cliff]

ok i gotta get a screenshot of the pink card

im so happy oml

[graceful pawn]

Hehehe you can rest easy now 😉

[hot cliff]

yup

thank you all for sticking with this

i need to take a break from all of this before i tackle the other stuff like player advantage and analyze UI

[graceful pawn]

Only thing is you should not force the pink in all the stuff but rather write the femc flag

Because rn it's probably forcing pink everywhere

But we fixed this which is so nice 👍

[hot cliff]

yeah ill have to figure that out

i could just tell people not to enable when playing as MC

since the only issue it seems is that it makes you kotone when loading a male save

[graceful pawn]

Would be a more radical solution

But it's up to you

There are not so many places that write the gender in the title screen tbh

In my psp where just 3 or 4, it's commented in there

[graceful pawn]

Getting something here

[graceful pawn]

Seems it's all static addresses for these colors, they are all set in the binary

So guess I gotta find the femc colors in there to find the reference to femc ones

Looks offseting the blue colors to 0x64 seems to do the trick, blue and pink colors seem to be separated like that

[graceful pawn]

Got the whole menu to pink!! You can see it's not affecting default mc at the end of the video

This is the new cheat for this

[hot cliff]

oh

that ain't supposed to happen

how would i trace back the color of this

searching for the hex code does nothing

[graceful pawn]

You can look for Garu string in the memory and place a breakpoint when read

That should lead you to the function that draws that menu

[graceful pawn]

Lol that's weird

[hot cliff]

there's actually a function called BtlMenuRenderTitle that i put a break point in

seemingly stopped the loading of the UI

i did step into a few times and it took me to this

don't think this is what i need

[graceful pawn]

Nah it's just executing functions in memory

[hot cliff]

otherwise the function looks like this

[graceful pawn]

Yeah same stuff, it's too general

You should look for the specific one

[hot cliff]

should i check the xrefs?

there's only 4

[graceful pawn]

Nah, that'd take you to more general stuff

By the way when the XREF has an address and (*) it means it is a memory reference to that function

The other ones are functions that call the functions you are inspecting

It has the name of the function and the line that calls the function you are in

[hot cliff]

ok im in a new encounter, i need to look for the skill and add a break point to see what's caling it?

1400c0c10

[graceful pawn]

Well, good luck with this I'm gonna sleep rn 💤

[graceful pawn]

That could be a way to find it

[hot cliff]

just keeps taking me to the checkfordebugger part

[graceful pawn]

Like having these strings on screen give us an advantage

Because we know the menu is printing that, which lead us close to the other coloring/drawing

[hot cliff]

right

i'm getting nowhere with this bash stuff 😔

should i look for the MAX HP and MAX SP values too?

yeah no adding a break point before the skill name isn't doing anything

it's probably pulling from somewhere else

only 3 references to cowardly maya in the games memory

adding a break point before each one does nothing to stop the game

[hot cliff]

ugh

no idea what happened

but P3P (even vanilla with no mods) now crashes when i load tartarus

ok i guess it's just one save

how do i pull saves down from the cloud

[hot cliff]

https://discord.com/channels/746211612981198989/1270544081310978139

welp i can't do any testing until i solve this

so that's fun

[graceful pawn]

Found the colors for the yes/no of aoa

[graceful pawn]

Did you save with some mod or something?? So weird

[hot cliff]

nope just loaded the save

it made me kotone

then i tried to load tartarus

perma broke after that

[graceful pawn]

That's weird, not very sure what could cause it

Because if you didn't save or anything it shouldnt be affecting the save

[graceful pawn]

Well here's current cheat with this

[hot cliff]

damn you're finding much more than me

forgot about that one even existing

i wanna figure out how to fix that kotone overwriting the male save thing

so i can keep this mod enabled because it's sick

[hot cliff]

do you have examples of the functions that do so?

they all rely on BitSet right? so i should check references to that in ghidra?

or is it bitcheck?

[graceful pawn]

Yeaaah it's BitSet

You should be able to find most of them just placing a breakpoint at the return and looking where it's coming from

In PSP there were these:

_L 0x20004A04 0x34040001 # Set femc flag just before loading card shows up
_L 0x20199588 0x00000000 # Nop branch to avoid crash at the start
_L 0x2001D86C 0x34040001 # Set femc flag just before loading card shrinks down
_L 0x202594C4 0x34040001 # Set femc flag just after hitting "New Game"
_L 0x2025A1A0 0x34040001 # Set femc flag just after hitting "Load Game"

So these are the cases you can look for, most likely there won't be more than in the psp

[hot cliff]

oh right i can do that

[graceful pawn]

The first ones maybe are more tricky since they set it just when launching the game before the card

[hot cliff]

ok lemme reinstall cheat engine

[graceful pawn]

Although the second one is when the card is gonna disappear that it shrinks down

[graceful pawn]

Did you uninstall it??

[hot cliff]

yeah i was frustrated because my save broke haha

[graceful pawn]

But you can't uninstall peak...

[hot cliff]

damn getting it to freeze before the card loads is so hard

it's so fast

damn you fast PC

[graceful pawn]

We need a slower pc lol

Well can't help you very much, it's quite late here

Hope you find the stuff

[hot cliff]

damn it didn't freeze

are you sure we add a break point at the return?

can you show me which return you put it on?

or where you add the break point?

oh right you just said you can't

haha sorry

yeah no the game ain't freezing no matter where i put the breakpoint in BitSet

i feel like i don't understand how breakpoints work 😔

it never freezes like y'all says it should

yeah no it doesn't freeze

yeah im hella confused

i can't get it to freeze like it should

if it doesn't freeze i can't step out / step into

am i doing something wrong?

like am i too slow? is it not accessing bitSet?

ok it's definitely BitSet

there's 151 xrefs

ugh this shit sucks

so i can't get it to freeze

should i try to go through all 151 xrefs?

lol i was on the 1.1 exe since i reinstalled the game

got it to break

150D04D99

current address

ok for some reason it seems to continue past the loading card for the BitSet

but it still freezes

so the card isn't handled by BitSet

do i just keep clicking StepInto until i find what i need?

ok so not step into

it just leads me to the bitset function

ok breaking on the first bit set does nothing 😔

unless im just stupid

i can't get it to take me anywhere meaningful

and it seems to happen after the card loads which isn't right

so there's gotta be something happening before the return right?

am i just breaking in the wrong spot?

i click process > load file whatever it's called

the game insta breaks

[hot cliff]

so i add a breakpoint at the return of bitset here

then click run

the game loads the card, then stops after the card disappears

so clearly the card is something else

how would i get to where it's grabbing a value with BitSet?

i can't figure out the step into / step over / step out

ok i think i get it now

i need to let it run through each BitSet until i find what i need at the beginning of the game

because it's stopped at the first use of BitSet and i can't continue through each

so i need to click run, step into, copy the current address and go into ghidra and see what's there

oh i went through all the BitSets

and i got nothing from em

this is a dead end i think 😔

ima definitely need swine up in this because i'm pretty sure i did everything right

lemme summarize

i opened the process via the exe in cheat engine which insta breaks, added a break point to 150D04D99 which doesn't break before the card loads but after it disappears

then i went through each BitSet reference by clicking Step Into, if it lead nowhere i clicked Run which took me to the next BitSet reference

none of them had anything meaningful

i'm just confused as to why the card was able to load while there was a breakpoint at BitSet, it might mean it's being handled by something else, but what?

[graceful pawn]

Don't tell me you want through all the BitSets

That's nuts

Like maybe because of compilation It wasnt strictly calling BitSet

But thing is the game is setting the flag

So you could try BitSet

But if that didnt work you could try to add a breakpoint when the femc flag is written

Which is the behaviour we are looking for

[hot cliff]

well i only went through all the bitsets called at the beginning of the game

i definitely didn't go through every BitSet

for some reason, despite adding a breakpoint to bitset, the game continues past the loading of the card and only stops once it disappears

so there's something else that handles the card i assume

otherwise i was completely stumped and got basically nowhere @graceful pawn

[graceful pawn]

You could try this then, maybe It is handled by another function that does the write in pc case

[hot cliff]

what is the femc flag again?

the byte? or the bool?

is it the IsFemc thing?

or is it the DAT?

DAT_1433636cc

oh yeah there we go

we did talk about it

[graceful pawn]

Yeaah the DAT isFemc function uses I mean

[hot cliff]

weird

adding a break point to the DAT address did nothing

hell it's even 00

a bunch of stuff does access that address though

about 6

[graceful pawn]

You should add a breakpoint but when that address is written

Written I meant XDD

[hot cliff]

i did do that and nothing stopped

i can try again

[graceful pawn]

Something has to write to that address tho

[graceful pawn]

If nothing writes to it then how is the default mc address set to the mc??

[hot cliff]

alright ill try that

i forget that break on write and hardware break points are different

[graceful pawn]

Yeah, that's important, keep an eye on that

[hot cliff]

oh sweet that did it

150D27003

[graceful pawn]

How does it look in ghidra??

[hot cliff]

like nothing

took me to the same function i was looking at before

[graceful pawn]

What about skipping this write and going for the next write it does?

[hot cliff]

so press run?

[graceful pawn]

Yup

[hot cliff]

150502003

[graceful pawn]

How is it looking??

[hot cliff]

like more nothing

the card in game loaded btw

so it's gotta be the one before this

[graceful pawn]

Did this show up when the card was about to shrink??

[hot cliff]

nah it looks like it was still spinning

is the shrinking part what i'm looking for?

[graceful pawn]

I mean if you press run again it instantly shrinking?

[graceful pawn]

Yeah, we looking for the first part and then the shrinking

[hot cliff]

if i press run again it insta stops and takes me somewhere else

[graceful pawn]

Let's see where is it taking us

[graceful pawn]

This looks like setting default values for all the flags zeroing stuff

[hot cliff]

probably

[graceful pawn]

Interesting, so this is writing to the isFemcFlag

[hot cliff]

yeah?

does it seem familiar?

[graceful pawn]

Let me take a look

What about going to the ret to see where is this function call from??

Also what are the XREFS of this function??

[hot cliff]

2 xrefs

140259282

[graceful pawn]

That's interesting, might be a function only called at the start then

[graceful pawn]

Looks like a function initializing lots of stuff to me

Have a similar one in psp

[hot cliff]

return goes to this

1514114A5

back to the init function

[graceful pawn]

By the way, is there some way to get the ghidra project??

[hot cliff]

oh yeah

just get 11.0 and download this

[graceful pawn]

Would be cool to take a look into it while we investigate

[hot cliff]

download this

[graceful pawn]

Thanks!!

[hot cliff]

np

lemme know if you find anything haha

[graceful pawn]

All right, will be setting it up

But yeah that way I might find some similar functions hopefully

And comment the stuff we find

Ok so what is the isFemc flag address again??

Was it 1433636cc??

[hot cliff]

yeah i think so

youc an also search for the IsFemc label itself

[graceful pawn]

left it named like this then

[graceful pawn]

True 😅

Okay so interesting stuff

We can see the only function that writes directly into it is this one you found

So we can say it forces default mc value

Since there's one real reference to this function we could safely set the femc flag here

Okay so lets analyze this

First it's doing an AND with the current value of isFemc with 0xffffff7f

[hot cliff]

right

and that value is either 256 or 640

640 for femc

im assuming it's doing some math to get to 4104 / 4103?

[graceful pawn]

0xffffff7f is 11111111 11111111 11111111 01111111 in binary

So it's leaving the other values as they are and setting that one into 0

Which might be the flag we are looking for to set into 1 right?

[hot cliff]

yeah when the game starts up the byte at that address is 00 00

but when the game progresses it becomes 00 01

[graceful pawn]

that 01 might then be the OR with 0x100 right?

[hot cliff]

i believe so

[graceful pawn]

Okay so to do this we might set that bit into a 1

[hot cliff]

wait where are we looking at?

which address are you at?

[graceful pawn]

We looking into this operation here 14025927c

This one

[hot cliff]

oh right ok

you think that's the set protag gender?

alright

so what, we need to change the value it grabs to something else?

[graceful pawn]

That's what it looks like right??

[hot cliff]

yeah

[graceful pawn]

The other is setting a 1 so most likely be the other byte you talked about

[hot cliff]

right

[graceful pawn]

Okay so what we must do is an or to set that bit

[hot cliff]

ok that makes sense

[graceful pawn]

With 0x80 since it is 00000000 00000000 00000000 10000000

[hot cliff]

so i need to change the mov to set the value?

oh wait

replace the 0x100 with 0x80?

[graceful pawn]

Nooo, we gotta replace the and operation

[hot cliff]

ohhhhh

[graceful pawn]

So we gotta load the 0x80 instead of 0xffffff7f

[hot cliff]

oh

[graceful pawn]

And do the or instead of the and

[hot cliff]

that part appears to be be the BTR part just above

[graceful pawn]

Looks like it right??

Then probably it's just changing to BTS 0x7??

Dont know these instructions but looking at the other one would make sense

Will look the instruction set

x86 is so convoluted lol, in mips there are not so many instructions

[hot cliff]

so i would change the function at that address to bts eax, 07?

ok that did nothing

but no crash

[graceful pawn]

Hmm, how is the isFemc address looking??

Oh hold on think we didnt do the stuff lol

[hot cliff]

not much

oh sorry lol

jumped the gun there haha

[graceful pawn]

We didnt look the rest of the assembly hahaha

[hot cliff]

oh lol

[graceful pawn]

Okay so should be or eax, 0x80 I guess??

[hot cliff]

at 140259260?

[graceful pawn]

Oh no hold on

[hot cliff]

ok lol

[graceful pawn]

These are the other bit operations in the upper part

So it must be doing it with btr and bts but how...

Okay so it should be the bts eax, 0x7 it seems

How does it look in memory when applied tho??

[hot cliff]

at what address

i can apply it real quick

[graceful pawn]

Like the isFemc address just when we apply the OR

[hot cliff]

yeah

[graceful pawn]

Just to see what value it is

[hot cliff]

at 140259274?

[graceful pawn]

Well just after doing that yeah

[hot cliff]

nothing really changes

should i click run?

[graceful pawn]

Not run yet but step into

To see what it does to the value

[hot cliff]

15C333025

just the entry function

[graceful pawn]

Nah I meant seeing how the femc address changed

[hot cliff]

oh

you said step into

[graceful pawn]

When the bts was done

[hot cliff]

oh so click run then

[graceful pawn]

No because run will skip the whole thing

Step into is next instruction no??

[hot cliff]

yeah but it just took me to entry so i didn't get to see what it did to the value

[graceful pawn]

Weird, then the step into might not be the thing

Don't know cheat engine naming of stuff 😅

[graceful pawn]

Then its step in right??

Or over

Doesnt really matter then

[hot cliff]

i think it's step over

15C333025

[graceful pawn]

But there's no function so shouldnt apply

[hot cliff]

yeah

step over also takes me to the entry function

[graceful pawn]

But how is it jumping the rest of the code??

I dont get that

I meant a single click into step into

[hot cliff]

yeah i know

[graceful pawn]

And it's taking you there??

[graceful pawn]

What the hell 😅

Let it run and see if it goes to that function again then

[hot cliff]

did i mention i launched the game via cheat engine so it insta breaks

should i add a break point?

[graceful pawn]

Yeah you could do that as well

[hot cliff]

ok it stopped after the card loaded

step into?

[graceful pawn]

After it loaded??

[hot cliff]

took a few step intos

[graceful pawn]

Wasnt this before it was showing up?

[hot cliff]

1514114A5

took me there

[graceful pawn]

Okay so maybe this is being done when it shrinks then??

[hot cliff]

probably

[graceful pawn]

Do you notice it turning pink when it shrinks??

[hot cliff]

lemme see

ill have to click run again

[graceful pawn]

Yup

[hot cliff]

nope

stays blue

also blue

[graceful pawn]

Hmmm, maybe this function is not that useful then

[hot cliff]

.

[graceful pawn]

Or we are setting the value wrong

But dont think so

[hot cliff]

i think it might be the second thing

[graceful pawn]

Well there is something we can do to check

Just after setting the value with bts

[hot cliff]

this is just changing to bts from btr, right?

[graceful pawn]

We can place a breakpoint in isFemc to see where it is goinf

[hot cliff]

we're looking at the same isFemc right?

[graceful pawn]

Yeah, should be

[hot cliff]

1433636cc?

breakpoint?

hardware breakpoint or break on write?

or break on access?

[graceful pawn]

A hardware breakpoint

[hot cliff]

alright

and modify the code at the same time?

[graceful pawn]

Yeah, to see how the isFemc flag looks

[hot cliff]

ok double done

run?

[graceful pawn]

Where are you now, on the bts??

[hot cliff]

yeah

[graceful pawn]

Okay so run yeah

[hot cliff]

loaded past the card

didn't turn pink when shrunk

yeah everything loaded fine, no stopping

[graceful pawn]

Hmmm, how does it know the card color??

Well we can also watch at the reads of the isFemc flag then

[hot cliff]

alright

and no breakpoint?

just let it play out?

or break on access?

oh that was fast

[graceful pawn]

break on access yeah, just after the bts

[hot cliff]

break on access stopped before the card loaded

1433636CD

literally nothing

[graceful pawn]

Well we knew this one already

[hot cliff]

somehow quite literally nothing

150D27003

more nothing

150502003

this one stopped after the card loaded

eh?

run one more time?

[graceful pawn]

Hold a minute, I'm checking stuff with ghidra, it's quite slow with a project this big lol

[hot cliff]

no worries lol

[graceful pawn]

But spoiler alert

[graceful pawn]

This might not be nothing lol

[hot cliff]

how so

[graceful pawn]

Wrong decompilation, we know instructions are there because the game does execute them

And this is looking interesting

It's making bitsets into our isFemc flag

[hot cliff]

oh?????????

that's interesting

[graceful pawn]

True

Only thing I wanna know is where this function starts

[hot cliff]

ok how do i give you that info

[graceful pawn]

Looking at ghidra we could infer that this is the start of the function

Given the references to this address

[hot cliff]

right

i can also go into cheat engine and click selcet current function

[graceful pawn]

I had an idea

Do you see that btr EAX, 0x7 right??

What if we change it into bts...