[flame]

For PSP games information like this is loaded from resource files. Those are in the USRDIR folder. However, sometimes they are in the game's executable, the EBOOT.
These resource files are TINY. All of the item information for Nayuta no Kiseki is in a 4kB file that's present in the game's memory throughout the entire runtime (it loads on boot from resource files). That's not a massive hit because PSP has 32MB of main memory (minimum) to work with and all the database files together are probably around 100kB.
I worked on Last Ranker. The compressed database files are always resident. The game decompresses them when you open the menu and clears them when the menu is closed.
Different games are different. You can see where that data is coming from and trace it back. Once you trace it back to the UMD, you can then look for those byte patterns and find the file in which that data is located.

Also in PPSSPP, you can uncheck "Run on Load" and then reset the game. If the data is present at this time in the memory, then you can be sure the data is coming from the EBOOT.

[ACmod]

How the stats in the game work:

This video shows the garage (customization/build) interface: https://www.youtube.com/watch?v=xP0o6_-rRpI

here is another video that helps explain.  https://www.youtube.com/watch?v=xSp2ZcjxVa4

Side note: The "E/D/C/B/A/S" rankings are actual numbers, the letters are just an easier view mode that you can toggle back and forth from (and you see that in the first video). Almost every stat in-game is visible from the menu.

Text explanation of how they work:

Short explanation: There's no "base" character stats. Every stat is based on the combination of your parts equipped, so unlike an RPG there's no leveling up. You progress by unlocking new parts (one of the problems is that most of the parts you unlock are useless because the stats are not very well balanced).

Long explanation:

The "player" is comprised ENTIRELY of a set of parts, which affect every in-game stat. Such as:

Head
Core
Arms
Legs
Booster
FCS
Generator
Radiator
Inside Weapon
Extension Weapon
Back Left Weapon
Back Right Weapon
Arm Left Weapon
Arm Right Weapon
Optional parts (these are "special" items that seem to modify stats of the whole character)

Within each category all parts have unique stats. For example, every "head" part has the following stats:
Head
>AP (Health)
>Weight (affects your total weight and speed, as well as approaches the weight cap limit for your legs)
>Energy Drain (affects the rate that your energy bar recharges)
>Def Shell (adds to your Defense vs "shell" damage)
>Def Energy (adds to your Defense vs "energy" damage)
>Cooling (affects how fast your "heat" bar decreases. This is a moving rate, so if you are taking 1000 heat per frame and you have 1000 ?>cooling per frame, your heat bar will not move)
>Stability (affects stagger when taking damage or falling, based on how heavy of an attack you get. This leads me to believe there's a >"hidden" weapon stat for impact force/stagger since not every weapon staggers the same)
>etc. (there are 15 stats for each head part, these are just a few).

The heads vary only by the different stats they have and 3d model. So you can compare two head parts purely by the 15 stats that make them up. One might have more weight but less energy drain, etc.

Some of the stats (like AP, cooling, weight, etc.) is also found in other categories and contribute to your total AP (health). So head AP + core AP + arm AP + leg AP = TOTAL AP (which, in the expanded stats view, is on the right hand side of the garage where your "character" stats are)

Another example of how stats work is radars. Some Heads have radars (and heads without radars will have "0" or "None" for the stat). But there are also back radars. They BOTH share the same set of stats "like 'scanning interval") and influence the same radar during gameplay. I believe that when having both, it replaces the weaker one with the stronger one for each stat, or may treat it cumulativley (I can test in-game to find the exact formula/relation, but that gives you at least an idea of how two parts can share the same stat)

How weapons work:

So if a grenade launch does 3050 damage, then every shot does "3050" damage. The resulting loss of health when it hits someone is reduced by a % based on the defense of whatever it hits. So if they have 1250 defense it reduces the health loss from 3050 to 1525. The damage of one weapon is not influenced by anything else in the game. The only way that the damage from a weapon will change is by changing the defense of the target being hit, or the one exception below:

There are one or two parts you can equip that increase the damage of a weapon, but it doesn't actually change the weapon's stats. For example, when you equip an energy-based weapon (say 500 damage) and equip a special optional part, it boosts all energy based weapon damage by 7%. The energy-based weapon does NOT get a stats increase, however in-game when you fire it will do "535" damage before defense reduction. You can also see one character stat  ("total firepower, which is attack x ammo") will increase by 7% when you do this.



Does that explain things better? There are no base "character" stats. All the character stats are taken from the composition of the items equipped.


What's in the ISO:

The file system for the ISO looks like such:

Sysdir
>OPNSSMP.BIN (Size: 48)
>EBOOT.BIN (size: 4192640)
>BOOT.BIN (size: 4192292)
>Update
>>PARAM.SFO (size: 0)
>>EBOOT.BIN (size: 8388608)
>>DATA.BIN (size: 100663296)
USRDIR
>AC.BIN (size: 226551808)
>>bgm
>>>(contains many .at3 audio files, total size: 8192)
>>movie
>>> (contains many .pmf video files, plus a subfolder with more video files, total size: 2048)

Cheat engine on PPSSPP

Also cheat engine needs a few settings changed to work with PPSSPP and only works with v1.0.1 I believe. http://www.cheatengine.org/forum/viewtopic.php?p=5543519&sid=7688791ddfdfc0b147a6ce19109aa4c5

If you want to run the game in PPSSPP you also need a workaround cheat for CWcheats, here:

_G Armored Core: Last Raven Portable
_C1 Hang Workaround
_L 0xE0010003 0x002BB274
_L 0x202BB274 0x34070001
_C0 Hang Workaround [Disable]
_L 0x202BB274 0x28A70003

[STARWIN]

One more thing. Search the ps2 game for these values too. If you do find the spots and they aren't compressed or whatever, you can mod the stats without touching a debugger at all. You can search over the whole ps2 image (sees all files and more, but some values won't be visible because of technical stuff) or extract data/exe files and search from them (most things visible but possibly many files, can avoid searching large audiovisual data to avoid false hits). I haven't extracted/inserted files from/to ps2 images but internet says that cdmage works for ps2 too, so here: http://www.lpthe.jussieu.fr/~talon/bin-cue/CDmage1-02-1B5.exe (edit: internet says that cdmage won't work for dvd images as well, so if that is true, some other tool needed)

[NoOneee]

2) In the Cheat Engine match list if you R-click and choose change value, it will change. The regular change value will not work, not sure the reason.

Offtopic, but this may be because of the dynamic recompilation. The value is also probably somewhere else in the memory as a regular PC variable. You can try disabling the dynamic recompilation to see if it solves the issue. actually nvm, I read it wrong.

[ACmod]

To clarify on my previous post, I want to edit those individual stats.


So, for example, every head has a "weight" stat. I want to go in and change the "weight" value (and other values) of most of the heads to balance them out so that more of them are useful in gameplay.

[flame]

Okay, so try searching for the head AP value 909 in Cheat Engine + PPSSPP. Results? If no results then this is gonna be really tough and I can't solve it. All of those numbers should be there in the memory. If there are a lot of results, change the head and search again for 909 to narrow it down. Finally, R-click on matches and change the value. You might need to swap heads before the value will change on-screen. If the value changes back to 909 immediately, then try setting a write breakpoint on that address to see what's happening.

Maybe a more detailed tutorial is needed but feel free to try this yourself.
I will give it a try as well.

[ACmod]

Yeah, I've tried that already with a few parts to no avail.

I can search for total defense (1593 in that screenshot) and isolate a a few values. Each time I equip a new part (say, moving it to 1600) all these values move to 1600. However, every time I do this process the number of values I get that are changing varies dramatically (I've gotten only "2" that match and I've also gotten "12" that match).

On top of that, writing a cheat that changes all of those values to something else doesn't do anything when activated. This is what leads me to think that the part values aren't actually stored in RAM but character stats (on the left) are. This is problematic since a cheat would only change the "equipped" value not the value of the part (setting ammo to "50" will make the equipped weapon always have 50 ammo no matter what), most likely, but I haven't even gotten a cheat to work that far.

I will keep troubleshooting though, you guys have been extremely helpful, far more than any other community I have asked about this. At the very least, I've learned a lot.

EDIT: Trying that exactly with one head gives me about 20 results, I'll try to manually change them in real time. Before I was just finding the address and writing a cheat, then applying the heat.

[flame]

It's time now to use your time travel powers.
1) Change heads to something else
2) Save state
3) Change to the "909" head (CR-XXXXXX)
4) Find the value 909 (the address where it is)
5) Set a write breakpoint on that address
6) Load state
7) Change to the "909" head
Voila!
It's possible this won't work either, but it is likely to.
That's the "basic pointer" tutorial from cheat engine tutorial. If it does work, you can backtrace to see where is the pointer stored that points to where this part's data is.

Going back to the basic "909" searching, look in the memory to see if you see some of the other values near there where the value is found, like 197 for example.

[ACmod]

I'm having some trouble figuring out how the breakpoints work but I'm going back through the tutorial and trying to sort it out. I'll reply again when I can test it on the game itself.

edit: it doesn't help that apparently cheat engine 6.5.1's Points tutorial (step 6) seems to have wrong instructions. The page information doesn't match up to what other guides say to do also, so I'm a bit lost on what the proper procedure is or why each step needs to be completed. I'll try finding another set of articles to explain how to use it without working through the tutorial.

What exactly is a breakpoint or a pointer? I had no problem up through step 5 but step 6 can't be completed even when I follow a guide to complete the tutorial.

[flame]

Breakpoint: https://en.wikipedia.org/wiki/Breakpoint
In practice, a breakpoint consists of one or more conditions that determine when a program's execution should be interrupted.
Execution breakpoint: Stop when the program counter gets to this address.
Memory breakpoint: Stop when the memory at this address is read or is written to.
Memory breakpoints can be set such that they trigger only on read or only on write.

At 0x090D4FA0 I found AP value for CR-H695 (this is a head). This was upon starting a new game (and repeatable). It might be different for loaded games with large parts inventories. You could try finding the others, they're probably around. If you look below this you see some other heads.

I set my breakpoint on this and found this gets written on initial load of the game. This looks like ZLIB or GZIP algorithm. Those are the same...sort of. Isn't GZIP a wrapper for ZLIB algorithm? So that's good news...I guess? The bad news is those values are stored in that big archive file most likely (and as expected). EDIT: I saw the "classic" ZLIB header 78 9C, so that's the compression ID for you.


So I have matched 0x890C4FA0.
Now to get cwCheat addr I do 0x890C4FA0 - 0x887F0000 = 0x8D4FA0
To get PSP virtual address you just add 0x8800000. 0x890C4FA0 - 0x887F0000 + 0x8800000 = 0x90D4FA0 unless my math is off
cwCheat addrs use a BASE of 0x8800000. For example, if you're constant writing address 0, that's actually PSP virtual address 0x8800000.

Now you go to PPSSPP debugger, click in the memory view, CTRL+G, paste in that address and inspect it to verify that indeed it's the entry for this head part.
Questions? I just did this by guess and check, several wrong guesses at first.

A response to my earlier question was posted over at cheat engine forums that I didn't notice until now: http://www.cheatengine.org/forum/viewtopic.php?t=594040&sid=6f3a4facc55fcfd88b627bdd30bee31c Due to this it will make guess and checking faster in the future.

Here is my cwCheat code for:
_C0 Starting head part CR-H695 MAX AP
_L 0x108D4FA0 0x0000FFFF

You really don't want to make huge numbers of cheat codes or even one cheat code with lots of lines, but it's a start at least.

[BlackDog61]

Also a side note that you'll want to search for values in hexadecimal, little endian. Not decimal. (Wikipedia is your friend to understand either of these words. )

[flame]

The game stores these values, that you want to change, in half-words. Cheat Engine calls this "2 bytes" it's the same thing. Just to show you how the pattern-matching algorithm works in my brain, those values can be greater than 255 and all of them are less than 65535, so half-word and word are the only possibilities.

Cheat Engine does not support big-endian searching. There is a feature request to add it so I guess it's up to the developer. Little-endian only for now. That's fine. R4000 runs in little-endian mode on PSP. You don't have to worrry about endianness much when working on PSP. About the only time is converting from numbers to hex manually.

I gotta get better at writing tutorials, huh. I'll try putting the PPSSPP + Cheat Engine tutorial on Data Crystal.

[ACmod]

Breakpoint: https://en.wikipedia.org/wiki/Breakpoint
In practice, a breakpoint consists of one or more conditions that determine when a program's execution should be interrupted.
Execution breakpoint: Stop when the program counter gets to this address.
Memory breakpoint: Stop when the memory at this address is read or is written to.
Memory breakpoints can be set such that they trigger only on read or only on write.

At 0x090D4FA0 I found AP value for CR-H695 (this is a head). This was upon starting a new game (and repeatable). It might be different for loaded games with large parts inventories. You could try finding the others, they're probably around. If you look below this you see some other heads.

I set my breakpoint on this and found this gets written on initial load of the game. This looks like ZLIB or GZIP algorithm. Those are the same...sort of. Isn't GZIP a wrapper for ZLIB algorithm? So that's good news...I guess? The bad news is those values are stored in that big archive file most likely (and as expected). EDIT: I saw the "classic" ZLIB header 78 9C, so that's the compression ID for you.


So I have matched 0x890C4FA0.
Now to get cwCheat addr I do 0x890C4FA0 - 0x887F0000 = 0x8D4FA0
To get PSP virtual address you just add 0x8800000. 0x890C4FA0 - 0x887F0000 + 0x8800000 = 0x90D4FA0 unless my math is off
cwCheat addrs use a BASE of 0x8800000. For example, if you're constant writing address 0, that's actually PSP virtual address 0x8800000.

Now you go to PPSSPP debugger, click in the memory view, CTRL+G, paste in that address and inspect it to verify that indeed it's the entry for this head part.
Questions? I just did this by guess and check, several wrong guesses at first.

A response to my earlier question was posted over at cheat engine forums that I didn't notice until now: http://www.cheatengine.org/forum/viewtopic.php?t=594040&sid=6f3a4facc55fcfd88b627bdd30bee31c Due to this it will make guess and checking faster in the future.

Here is my cwCheat code for:
_C0 Starting head part CR-H695 MAX AP
_L 0x108D4FA0 0x0000FFFF

You really don't want to make huge numbers of cheat codes or even one cheat code with lots of lines, but it's a start at least.

This seems like a huge step in the right direction, I just need to catch up and figure out how to get there. The cheat works when loading up a new game, however:

Once you enter a mission (gameplay), the head's AP resets (total AP in the left hand corner is back to what it would be if the cheat was not actie) and upon exiting the mission the values in the garage are all reset back to their original values. Re-enabling the cheat in-game does not reset it.

Here's what I'm thinking:

So Step 1: Follow that procedure for the stat I need to change
Step 2: Find out how to make the change persist in gameplay (perhaps there is an AP stat for the part in the garage, and then another AP stat for "equipped part" when you enter a mission)
Step 3: Incorporate all the changes into a cheat
Step 4: (?) use the cheat's addresses to incorporate the changes into a hacked ROM
 
Is it possible to use the Cheat engine information to identify what values in the ISO binaries contribute to these states? For example, if the ISO has an entry for "CR-H69S" AP, is it possible to identify which lines of hex need to be changed using the cheat that modifies it? I know PPSSPP can load the entire ISO into system RAM so could the PPSSPP disassembly check to see which ISO values are being read for certain in-game values being displayed on screen?

[flame]

Those values are in that huge (200MB?) archive file.
Also you are not going to find it in plain text - it is compressed.

I recommend offzip by Luigi Auriemma. What offzip is doing:
1) Look for ZLIB header
2) Try decompression
3) If it works (complete compressed stream with terminator), output file (otherwise no action)
4) Go to (1) and keep going until whole file is searched.

I think RHDN has offzip in the utilities section.

After that, search through the extracted files using wmxEdit. CTRL+SHIFT+F is the "find in files" function.
----------------------
Cheat Engine operates on memory. It can't help you find where in the file image the data you need to change is.

[ACmod]

Yeah, AC.BIN is the 200mb file.

I'll return to those instructions once I'm confident in how to use Cheat Engine to identify where the addresses I need to change for each part is, and how to change the part values in gameplay (not just in the garage). But at least now I have a gameplan and learning to do, and it seems possible to accomplish.
September 16, 2016, 12:41:27 am - (Auto Merged - Double Posts are not allowed before 7 days.)I'm trying to figure out how you identified 0x890C4FA0 as the address for the 809 AP head, now. Isolating the addresses (by equipping and unequipping the head and then doing 'next' scan) I get these four every time, none of which match that:



I get those same 4 regardless of the save state of the game (both with new game and with all parts unlocked.) How would I narrow down those 4 more? And how did you narrow down to only 890C4FA0?

EDIT: Now I can't seem to replicate the 4 addresses showing up again. hm.

[flame]

It's pointers. The game is either moving data around, loading data (not too likely) or uncompressing data and then clearing the uncompressed version once it's not needed anymore.

I found the following chain
[09CB30D4] + 0x10 Get the value at that address and add 0x10
[] + 0x10 Get the value at the address from the previous step and add 0x10
[] + 0x508 Get the value at the address from the previous step and add 0x508
[] + 0x198 ...
[] + 0x20
This address is start of the entry for that first head. From here you can offset to find the specific value you need.
I am pretty sure the whole chain only works when you are in garage mode.

I need to translate this website: http://wikiwiki.jp/cwcheat/?CODE%A4%CE%B8%FA%B2%CC
Just this part: multi pointer(0.2.2REVA以降)
It says how to make a multi-pointer cheat that will work for something like this.
I know some Japanese but that one looks rather complicated.
If there is English documentation of it, that will work too, but there isn't.

I did a manual check of it and it worked even after completing a battle. The final address ended up being different than it was before the battle.

This is really complicated, I suggest you switch to looking at changing the ISO. This is actually the most complicated example I've ever seen thus far. Falcom games load "database" data on startup and then never move or unload it, so it's easy to make cheats. When you enter battle it sets a pointer to all of the battle data (otherwise it's zero) so it's easy to make cheats that affect battle as well - this is the "simple pointer codes" 0x6 at the above link.
-------------------------
OK, I kind of half got it at least.
I'm not really expecting you to be able to replicate this but give it a shot.

offzip tutorial
1) make your project folder, mine I called ACLR (name does not matter)
2) make a folder "dumped" under this folder
3) use UMDgen and extract AC.BIN into your project folder
4) copy offzip.exe to your project folder
This tool is free. Download link: http://aluigi.altervista.org/mytoolz.htm
5) Hold left shift and R-click in your project folder. Choose "Open command window here"
6) Type the following: "offzip -a AC.BIN dumped 0 > output.txt"

There are not less than 5,215 files in here. Not to worry though, go to your trusty plaintext searching tools. offzip is a compressed searcher.
We know the first head part is CR-H695 so try searching for that. But I guess first we need to know about how to use our text searching tool.

Umm...I guess ask if you have questions? We want to search all 5,215 files in the dumped folder for CR-H695.

I found hits in 3 files:
006cc000.bnd 09880800.bnd 0c780800.bnd

The content looks the same in all the files.
The 09880800 and 0C780800 files have three copies of this data, not sure why. All three copies look the same. We can just change them all when that time comes to make sure the changes take effect.

I wanted to run a quick test, so I picked the first file which just has one copy of the data. The original AP value for CR-H695 is 809, that's 0x329. I changed this to 0xFFFF 65535 using a hex editor. It just randomly happens to be the case that the AP value is at offset 0x100 within each entry.

I saved the new file using a different filename in the project folder, and copied the original file into the project folder. I then ran xdelta and made a patch out of this. You don't really need xdelta for this because it's just two bytes, but whatever.

We need to make a new AC.BIN with our modified file.
"006cc000.bnd" this file is named after the offset in which it appears in the AC.BIN file. Let's now look at output.txt that got created when offzip was run. Search for 6cc000 and you see this:
  0x006cc000  25553321 -> 69981040 / 0x01f2a9a9 _ 1156 8:7:28:0:1:bd91e339
  0x01faa800  80 -> 800 / 0x01faa850 _ 523863 8:7:28:0:1:88ae04ef

There's key info we need here: The 0x6cc000 number (where is the compressed data), the 25553321 number (how big is the compressed data) and the 1faa800 number (where is the next file).

That is now enough so we write the pseudocode:
1) Make temporary AC.orig file with original file contents
2) Decompress the "6cc000" file (need the 25553321 number for this step)
3) Apply patch
4) Make the new AC.BIN file.
4A) Copy the first 6cc000 bytes
4B) Compress and then write the patched file
4C) Write zeros up until 1faa800
4D) Copy the rest from AC.orig

Now write the real code corresponding to the pseudocode:
http://pastebin.com/5Hga0vWG
Here is my xdelta test patch:
http://www.filedropper.com/006cc000

Now you have an AC.BIN (modified version) for testing use.

I don't have python code yet that can do ISO replacement so use UMDgen to put the file in. UMDgen tutorial for replace files with alignment:
1) Open the UMD ISO in UMDgen
2) Export file list
3) Replace files using drag & drop
4) Import file list
5) Write uncompressed ISO (use a different filename than the original UMD ISO)

Test in PPSSPP and....


Whoops, still didn't work. I forgot to disable my cheats.
Let me change the other values and report back.

[ACmod]

How did you find "09CB30D4" to start the chain? And where did you get "0x10, 0x508, 0x198..." etc? Those seem to be arbitrary.

And lastly, do you mean that I should look into changing the ISO as the final product (after figuring out what to change via cheat engine), or that I should give up on cheat engine entirely?

[flame]

You just go backwards a lot of times.
The end of the chain is 0x90D4FA0 (where the value is). So set a write breakpoint there, then backtrace to see where that value was gotten, just keep doing that until the address value doesn't change anymore.
You can end up with a long chain doing it many times. Eventually you get to one that doesn't move around.

Those are address offsets. So the computer has "records" in its memory, some people call them "struct" though this is a C language-specific term. If the computer needs field #2, it will get it by the following formula: RECORD_BASE_ADDR + offset_to_field_2
That's what those offsets are. It's how computers "know" where data in their memory is.
A lot of the higher-level records in the memory have pointers as the record fields so the computer can find each record in the memory.

Take for example the "head parts data" record
At 0x100 in the record is the AP value.
If the computer wants to know the AP value for the record, it doesn't need to know where the AP value it. All it really needs to know is where the head parts data record is. Because if you know the record address, you can add 0x100, read the halfword there, and now you have the head AP value. So this one would be [record address] + 0x100.
Those higher stages are records that have other records within their data (as opposed to values like AP).

Yeah, because the memory structure is not that simple and if you just mess with file data directly you won't need to worry about it.
It will make your balance testing a little more difficult.
-------------------------------------------------------------------
So there was one file I was missing, 093ae800, which also had parts data in it. And that solved it. I also did all of them so it works perfectly now.
Here's my new program:
http://pastebin.com/wAx3jpCE
Here's a set of four patches, one for each of the files we need to change:
http://www.filedropper.com/aclr

Check out my super-powerful AC! At least it has a lot of AP anyway.

[ACmod]

This looks massively helpful. I'll try to edit the ISO next then, according to all of this info.

One thing though, in your gameplay/mission image it lists your AP at 7313 (top right corner), which is below what the normal AP is (unmodified). Does it drop when you take damage? If you set the AP of your head to 65535 then total AP should read "9999" at least, and maybe not even drop until you take ~55000 damage first.

I believe AP in the stock game ranges from 6500 to 9800 from minimum to maximum possible, and "max AP" cheats always put the value at 9999. So head+core+arm+leg = (809+2296+1794+3514 = 8413). If you raised the AP of the head to, say, 1009 , then the total AP should rise to 8613. I'll see if I can get your patch running and try it out on my end though to confirm.

EDIT: Wait I figured it out. Head AP at 65535 means 73139 AP. So it must just only list the first 4 digits, which would be 7313.

EDIT2: Haha, I didn't even notice the extra digit at the end there. I'm so used to seeing only 4 numbers that my brain ignored the 5th. Awesome, though. Thanks.
September 17, 2016, 03:14:24 am - (Auto Merged - Double Posts are not allowed before 7 days.)Okay, so I've got some more time for this. What did you use for the Find/replace in multiple files? I don't have a tool for that. Normal windows search doesn't yeild anything either. Offzip doesn't open to a GUI.

[flame]

wxMEdit
https://wxmedit.github.io/

Once in the program:
CTRL+SHIFT+F to open find in files dialog box