PS2 Patch Engine 1.03

PS2 Patch Engine is a tool designed to embed both static (ELF) and run-time (memory) patches directly into PS2 disc images.
Patches can provide widescreen support as well as controller remapping

• PS2 Widescreen Patch Archive
• PS2 Controller Remapper

Images may be in .iso, .img or .bin format, .bin images can also be converted to .iso.

Not all games will work but, based on analysis, compatibility should be better than 95%.

Patched images are compatible with both PS2 emulators and real PS2 hardware and have been tested with PCSX2, OPL, ESR discs and the PS3's PS2 Classics emulator.

How to use it

Opening an image

• Drag and drop the .iso/.img/.bin file or click 'Browse'

Using patches

• Drag and drop, copy and paste or click 'Browse' to add patches
• Patches can be in either RAW (unencrypted) or PNACH (PCSX2 cheat file) cheat code format
• Not all cheat code types are supported!
  • For RAW: Code types 0, 1, 2 are supported
  • For PNACH: 'word, 'short', 'byte' as well as 'extended' types 0, 1, 2 are supported

Options

• Selecting the 'RAW Code' radio button interprets patches in RAW format
• Selecting the 'PNACH' radio button interprets patches in PNACH format
• Selecting the 'Autohook' check box enables automatic Mastercode determination
• Unless patches are not working for a particular game this option should be left enabled
  • If 'Autohook' is disabled the following dialog will appear when applying memory patches to a game
    • - Mastercodes must be in RAW format and must begin with '9' (9 type 'hook' Mastercode)
    • - Enter one or more Mastercodes and press 'OK' to continue
    • - In case of an error one of the following error messages will appear
    • "No valid Mastercodes"
      • No valid RAW codes were entered
    • "Unsupported Mastercode type"
      • A RAW code with a type other than '9' was entered
    • "Unable to validate Mastercode"
      • One or more of the Mastercodes provided is either incorrect or the address referenced by the hook cannot be found in any executable (ELF) on disc.
      • Some Mastercodes which will work on CodeBreaker or ps2rd may still report this error.

Patching

• Click the 'Patch' button to create a new patched image
• If a game contains multiple executables (ELFs) and a patch can be applied to more than one executable then one of following dialogs will appear
• Clicking 'Remember selection' will supress future prompts where the selected options are available
• A 'Save As' dialog will appear asking for the file name of the new patched image
• If the image format is .bin selecting "ISO image" in the "Save as type" drop down or changing the extension to .iso or .img will convert the image from .bin to .iso format
• The following dialog will appear and a new (patched) image will be created, press 'cancel' or close the window to cancel the operation

Finally

• This was a ton of work (10,000+ lines of C) so I'm hopeful that it finds some use.

General FAQ

• "It's asked me a question...what do I do?"
  • If no patch format is selected or no valid patches were found then one of the following dialogs will appear
  • Clicking 'Yes' will create an unmodified copy of the image (although the image format can still be converted from .bin to .iso)
• "I got an error...what does it mean?"
  • One of the following errors may occur immediately after clicking 'Patch' or after selecting executables to apply patches to
    • "Unable to embed engine"
    • Either no Mastercode was found (with 'Autohook' enabled) or PS2 Patch Engine was unable to locate the resources neccessary to embed a real-time patch engine
    • "Too many patches to embed"
    • PS2 Patch Engine can embed more than 100 patches per-executable into most games (the actual limit varies from game to game but the absolute maximum is 160), this error indicates that the number of memory patches exceeds the game's patch limit.
    • Note: While there is no explicit limit on the number of ELF patches that can be applied the total number of applied patches is limited to 1024; patches after 1024 will be ignored.
    • "Patch list contains unsupported cheat types"
    • Not all cheat types are supported - see the Using patches section above
    • "Patch list contains misaligned writes"
    • Patches can only be applied to addresses which are aligned to their data size - this is a restriction imposed by the Emotion Engine (and nearly all CPUs)
      • Patch type 0 (byte) can use any address
      • Patch type 1 (short) can use any even address
      • Patch type 2 (word) can use any address which is a multiple of four
• "What's the compatibility like?"
  • PS2 Patch Engine should work for the vast majority of PS2 titles, but there are some that are known to be incompatible
    • Metal Gear Solid 3
      • Apparently loads executable code from somewhere on disc that is not in an ELF file...maybe
    • Red Dead Revolver
      • The executable uncompresses and/or unencrypts itself when it loads which makes offline analysis impossible
    • Destroy All Humans 1 & 2
      • No idea - maybe similar to MGS3
• "This patch works perfectly in PCSX2 and/or ps2rd but it doesn't work with this!"
  • Some patches are meant to be applied at run-time (rewritten constantly) while others can be written once directly into the game's executable.
  • If the address specified by a patch falls into the memory range that an executable occupies then the patch will, by default, be applied there instead of at run-time.
  • In order to force a patch to be applied at run-time add the word "memory" to the end of the line the patch is written on, for example
  • This may be applied as either an ELF or memory patch depending on the address:
    • patch=1,EE,20836500,extended,3FE3838 //3FAAAAAB
  • This will always be applied as a memory patch:
    • patch=1,EE,20836500,extended,3FE3838 //3FAAAAAB memory
• "Why can't I use other cheat types?"
• "Why can't it apply more memory patches?"
  • Embedding a real-time cheat engine requires exactly that, embedding data into an executable - there is only so much space that can be made available and the code required to support all cheat types would greatly reduce the maximum number of patches that could be applied
• "The program doesn't work for hack XXXXX on game XXXXX!!!"
  • First try marking patches as "memory" (as described above), next try disabling 'Autohook' and entering a Mastercode.
  • If all else fails report it here and I'll add it the list of incompatible games

Technical FAQ

• "How can you embed code into an executable without breaking it?"
  • By knowing that PS2 games are written in C - in this case by exploiting string.h.
  • string.h functions compiled into PS2 games are stand-alone and vector optimized to take advantage of the PS2's 128-bit registers and vector instruction set, this can make them very fast for very large data sets but it also makes the implementations very long.
  • It is possible to write much shorter but identically functional versions of these routines - this is how PS2 Patch Engine creates usable space in the executable where the code for the patch engine and the patch tables reside.
  • The following functions can be replaced by PS2 Patch Engine: memcpy, strncpy, strlen, strcpy, memchr, memset (replaced in that order as patch table size requires), in the case of memcpy, memmove must also be located in the executable so that the memcpy function can be replaced by a single jump instruction.
  • In order to verify the shorter implementations of these functions I used Red Hat's string.h test for embedded systems, compiled with PS2SDK and tested in PCSX2.
  • Interesting side note - the implementation of strcat produced by PS2SDK actually fails this test (I used a reference implementation in C when testing to avoid false errors).
• "What is the performance impact of running an embedded patch engine?"
  • That's a tricky question - on the one hand the replaced string.h functions should be much slower for large data sets, but for very small (possibly more commmon) data sets they may actually be the same or even faster.
  • One thing is for sure - the performance will not be identical but given the speed of the Emotion Engine (290+ Mhz) the differences *should* be effectively unnoticable.
• "Do modified .bin files have correct error coding?"
  • Yes! EDC (Error Detection Code) and ECC (Error Correcting Code) are recalculated for each modified sector in .bin files, I have verified correct calculation for Mode 1 and Mode 2 Form 1 sectors.
• "Are multi-track images supported?"
  • Yes! PS2 Patch Engine does not modify any part of an image that would break a multi-track image, it will also automatically create a matching .cue file when patching a .bin image if one already exists in the same directory as the .bin.