[hackerkts]

Tutorial: Hacking fixed value DMA games
Tool(s) used: CWCheat 0.2.1 REV.A, DMA hunter from nitePR Rev K STABLE

DMA stands for dynamic memory allocation, if a game is DMA, the address will change. "When will the address change?" It can be on when you go to different map, reload the game, load/save the game, bought someone in-game ects. DMA games are really a pain in the donkey if you don't know how to hack it, once you know how to find pointer and offset you can kick DMA games' donkey ;D

"What's pointer and offset?" Well, you only need to know pointer and offset will point to the right address, maybe a story will helps you understand more about it. As the story goes...

You had a crush with a girl(I will name her Grace) in your class, she sit on the front row first seat. The seat is the address. You don't dare to approach her and ask for her name and number, you only know where she seat.

One day, she was transferred to another class which you don't know which. What you're going to do to locate her? First you will need to know her name, you went to ask your teacher the girl name, so now you have her name, Grace. The name is actually the pointer, now you know her name, and her precious class (her precious class is just some bits of information, which is the offset). now with her name and some bits of information, you're able to find her even if next time she transfered to another location.

Let's get started, I will use a easy dma game to hack
Objective: Find the pointer and offset for instant win
Game used: DownStream Panic [US] (ULUS-10322)
Requirement(s): Make sure your memory stick has some space, at least 100mb. Change the time of the menu pop out to 0 second (instant), you can do that at "Setting", "Controller check delay".

I assume at this step you already know how to hack a non-dma games(if you haven't read my previous tutorials, please do so before you continue), so let's get started. Starts the game, search the address for the amount of fishes you saved.

Ok, I have found the address, jot down the address!
Level 1 - 0x00D88D88 (first address)

Now you'll need to make a dump, go to the cheat menu, "Enable dump function", go back to the game and press Square button. The game will pause and wrote "Dumping", once it's done the game will start again. Now your have your first dump.

Now you will need to make the address change, for this game each level has different address so let's proceed to level 2. Search for the address for the number of fishes you saved.

I've found it, jot down the address!
Level 2 - 0x00E88E68(second address)

Make a dump again, now you have your second dump.

Optional(but it's recommend to follow):
Make the address change again by going to next level, search and jot down your third address, make your third dump.

Let's check what you have in your hand now, you can find your dumps at your memory stick root,

first address - 0x00D88D88
second address - 0x00E88E68
third address - 0x00E802A8
dump 1 - MEMDUMP0.dmp
dump 2 - MEMDUMP1.dmp
dump 3 - MEMDUMP2.dmp

Extract nitePR_revK_STABLE.zip to a folder, I will name it "nitePR revK", run DMAhunter.exe

Press enter and select dump 1 and dump 2, now enter your first address, followed by your second address.

Wow, it found so many pointers, don't worry. That's why I asked you to make 3 dumps. Now save all the informations down. Right click on it, "Select All" and right click again. Now it's save to your clipboard, open up a notepad and paste everything in.

Remove,

SANiK's DMA code hunter

Please get ready to select the two dumps
(Press enter to start)

Please enter the address of the cheat in RamDump #1
Please enter hex only (0xEF123... etc.): 0x00D88D88

Please enter the address of the cheat in RamDump #2
Please enter hex only (0xEF123... etc.): 0x00E88E68

Searching...

and also,

Press any key to continue . . .

Save it as 1&2.txtdon't ask me why, just do it okay? You will know later.

Now repeat the step, but this time we choose dump 2 and 3. And put in second and third address. It found one pointer, that's great! Save it as 2&3.txt

Repeat it again, now use dump 1 and 3, first and third address, save it as 1&3.txt

Remember to remove those words I said, now proceed to Compare 3 Memory Dumps paste in all the informations in 1&2.txt, 2&3.txt and 1&3.txt and click "Submit"

Take note: that link will be there until 1st of June 2008 when my domain expired, OHG will be hosting those scripts .

You should saw this

Found 1 same pointers in all 3 dumps:
0XDE040

That script will helps you determine which pointer shown on all 3 dumps, now it's easy. We one pointer, so let's try to use it.

Go back to any text file you made just now, copy the information down.

Found, address 0XDE040, value changed from 0X9688E50 to 0X9680290

0XDE040 is the pointer
0X9688E50 is value 1
0X9680290 is value 2

Let's get to the calculation part

Method 1:

Step 1: Convert value 1 into cheat format, minus 0x08800000 from value 1
0X9688E50 - 0x08800000 = 0x00E88E50

Step 2: Calculate the offset, minus the address 1 with the result you found on Step 1(minus from bigger value to a smaller value).
0x00E88E68 - 0x00E88E50 = 18

Method 2:

Step 1 : Convert value 2 into cheat format, minus 0x08800000 from value 2.
0X9680290 - 0x08800000 = 0x00E80290

Step 2: Calculate the offset, minus the address 2 with the result you found on Step 1(minus from bigger value to a smaller value).
0x00E802A8 - 0x00E80290 = 18

That's it, you found the pointer (0XDE040) and calculated out the offset (18).

Actually I had make a script to calculate them out at Calculate pointer and offset

Now you can kick dma-games' donkey! ;D