Grrrr, that sort of thing happened to me a couple time too so I stopped loaning games out.
Some info about Playstation assembly.
The PS1 uses a MIPS processor with 32 registers for most of the work. If you don't know, a register is just a "slot" in a CPU where a number is stored. Most operations that a CPU does will add,subtract,move a number between registers or load/store a number from a register to RAM.
The PS1 has 2,048,000 bytes (2MB) RAM and memory location are 32 bits long usually with an "80" added as the first byte. So 0x8000f800 would be 0xf800 in RAM.
The Playstation exe is loaded verbatim into RAM starting at 0xf800.
HERE is a reference that covers most of the MIPS op codes you will see in the debugger.
That page may seem a bit intimidating if you're just starting out, but you don't really have to understand it to get started.
Just to avoid confusion, I'll mention that the 32 registers have two different naming conventions. The first numbers them in order 1-31, but the second divides them into numbered categories based on what the counter is used for.
r0 zero
r1 at
r2 v0
r3 v1
r4 a0
r5 a1
r6 a2
r7 a3
r8 t0
r9 t1
r10 t2
r11 t3
r12 t4
r13 t5
r14 t6
r15 t7
r16 s0
r17 s1
r18 s2
r19 s3
r20 s4
r21 s5
r22 s6
r23 s7
r24 t8
r25 t9
r26 k0
r27 k1
r28 gp
r29 sp
r30 s8
r31 raYou shouldn't need this info, but
HERE is a link to some technical info on how the registers are used.
Some other helpful things,MIPS op codes list the destination register first, followed by the values that will be used in the computation:
For example "addiu r2, r3,0x10" (an add command) will write to r2 the sum of r3+0x10.
An "Immediate" is just a number that is provided in the current op code (as opposed to read from a register). It is abbreviated as "i" in the op tag.
In the example above, addiu means Add Immediate Unsigned and 0x10 is the "Immediate" value.
Hex numbers are set up like an old car odometer, meaning they "roll over" when they reach their max. So subtraction is usually carried out as an ADD operation. If you see an op code like "addiu r3, r3, 0xffff" It is actually subtracting 1 from the number in r3. "addiu r3, r3, 0xfffe" would be -2 and so on. I think the 0x7fff is the cut off for where it stops adding and begins actually subtracting: so "addiu r5, r5, 0x7000" would be +0x7000.
The PS1 requires "aligned" memory reads and writes. In other words, if you use the lw (Load Word) op code which loads 4 bytes from RAM into a register, the RAM location that is being read from or written to must be divisible by 4. So the read/write locations will always end in 0x0, 0x4, 0x8 or 0xC when using LW/SW (load/store word). If you don't follow this rule, your changes may play on an emulator, but will crash on actual hardware.
The MIPS architecture has a delay after certain op codes are enacted. So if you use any Load or Store operation, you have to wait one cycle (1 op code) before you can use the loaded/stored data. You will sometimes see a LW op followed by a "nop" (no Operation) rest because of this. You don't have to waste this cycle, you just can't use the data in the Loaded/Stored location till the next cycle.
On Branch or Jump operations, there is a 1 cycle delay as well. So the Op following the Branch or Jump will be enacted before the jump/branch happens.
Cheat codes can be very useful when tracking down data locations. Codes usually contain the memory location where the game stores the data. In this case, a cheat code for editing a unit's AGI stat should give you the location where that stat is stored in RAM. Once you know that, you can set a break (in the debugger) that will pause the game when that area in RAM is accessed. When the game stops, it should be near/in the function that uses AGI to calculate hit odds.
When using a break in Psx debugger, it stops on the op code AFTER the break was triggered.
In Psx debugger, Ctrl+G lets you go jump to locations. in memory.
F7 executes one op at a time (used after a break is triggered)
F8 executes one op at a time, but speeds past called functions. A called function will have a JAL op code. The function is still run,just doesn't show you the steps.
You can set up break conditions using a tag such as "r5==0x32"
When you get ready to write new code and inject it, a complier program called
armips is the one you will want to use. It will convert your op tags to machine code and inject them into the PSX exe. I can help you set up armips if you get that far.
