How to make Sony PlayStation emulator option – example 1.
For example, consider PCSX-Reloaded SVN r71989
Work RAM is 80000000 - 801FFFFF (2Mb).
We'll find a zero address on known address of parameter:
Game: G.Darius (PAL) http://www.artmoney.ru/tables/SonyPS/G.Darius%20(PAL).amt
Known address of parameter: Score 1P (exact value) integer 4 bytes 800BA8B8
need to find an equivalent PC address , then add to that address
offset -BA8B8h, and we have got our zero address.
PCSX-Reloaded emulator uses module addressing, as well as those emulators:
FinalBurn Alpha, FBA Plus, FBA Shuffle, FBA-ReRecording new versions
Sega Saturn – SSF
PSX – PSXjin
Gamecube/Wii – Dolphin
GBA – VBA-RR, VBA-M etc,
Nes – FCEUX
SNES – SNES9X, SNES9X-ReRecording
DreamCast – NullDC, NullDC Optimized
Sega Model 3 - Supermodel
You have to create emulator options with module addressing for these
3DO – FreeDO, 4DO
Dos – DosBox
Nintendo Virtual Boy - VBjin
Multisystem – MESS, MAME (Contains a debugger with memory editor that is useful to find a zero addresses)
Other emulator options with pointer to zero address regularly tested for two different Windows versions, if pointer will not work on any version of Windows, it will also be converted to a module addressing. We recommend to make new emulator options with pointer to zero address with module addressing.
Emulators without a pointer to zero address (speed access to memory is faster without the pointer):, as well as those emulators:
Sony PlayStation – ePSXe
Nintendo DS - DeSmuME
DreamCast, Sega Naomi 1/2, Sammy Atomiswave – Demul (zero address fixed at 2C000000)
SNES – Bsnes, ZSNESWin
Nes – VirtualNes (older versions), puNes, Bsnes, Nintendulator 0.975 beta 9-12-11
Nintendo 64 – 1964, emu-1964, (zero address fixed at 20000000)
PC Engine/Turbografx/CD – Mednafen, PCEjin
Arcade emulator ZiNc (Capcom ZN1/ZN2 based on PSX hardware)
Wonderswan Color, NeoGeo Pocket/Color - Mednafen
Killer Instinct 1/2 – Ultra64 emu
Atari Jaguar – Jagulator
Atari 8-bit, Atari 5200 - Altirra
Emulators with “Pointer-to-pointer structure” - Sega Model 2 emu (thanks to ArtMoney developers) , GB/GBC emulator TGB Dual, Multisystem emulator Mednafen in Atari Lynx emulation mode, and Atari ST emulator SainT.
ArtMoney can select emulator options automatically when loading of ArtMoney table. You can view MD5 file hash in "Process Information" window.
Start the emulator. Next, open the Process Information and check MD5 hash:
Now run G.Darius, wait until first mission is loading, increase your
points in game to 1200, then press Pause button. Exact value search (value is 1200), type integer 4
Increase your points in game to 5400. Then go back to ArtMoney, click the "Filter" button, enter value 5400 and click OK button
We can easily determine our address of a timer from two remaining addresses. Now change value at this address to another value, I changed value to 99999.
(1) RMB at this address - "Copy" (Ins). (2) Next enter offset -BA8B8h in "Plus" field, and click "Plus" button. (3) Next, run the search for pointer to the zero address with a module addressing – (4) note “Use module addressing” and “Scan only static addresses in modules” when searching.:
We get pointer in the PCSXR.EXE module. We need address in module:
As a result, we obtain the emulator option:
PCSX Reloaded r71989;pcsxr.exe;N;d62715ec1156025824be5a203cc524d1
Emulator option contains a version of the emulator, bytes order, MD5 checksum, EXE fie name, emulator virtual zero address (base address, start of RAM, RAM base), and a module name, module address/pointer and size of this memory area
It's necessary to test emulator option on games in two different Windows versions. I made this emulator option in Windows 7 , check the option on the XP SP3
G. Darius (PAL)
CT Special Forces 3 – Bioterror (PAL) (no dma)
Windows XP SP3