[Tutorial]How to Write your own PPC Functions

04-02-2014, 12:48 PM #1

VezahMoDz

Do a barrel roll!

132

Posts

3,107

Reputation

0

Credits

Member

Dec 2013

NextGenUpdate

(adsbygoogle = window.adsbygoogle || []).push({}); So got Bored and i thought i could do some new stuff on ngu, I might add some new Tutorials to the Thread if you guys want me to

. I will start off with some very basic and easy stuff and get more Advanced later

NOTE!: You should have a basic knowledge of PPC or you might get lost in here

Tutorial 1: SV_GameSendServerCommand:

1.Open Up IDA and Load the Ghosts 1.09 elf. (if you open it up the first time it will load for a bit so let it do that!)

2.We are going to Open UP the String View like this You must login or register to view this content.

3. Search for fps: -> double click it and it will get you to here: You must login or register to view this content. double click on the XREF and it will get you to the fps function

4.You should see this know You must login or register to view this content. Look at the beq instruction -> we gonna start writing our function 1 instruction after that. Im going to use Choco's PPC Compiler for it just search for it in the ps3 forums

(its way easier stare

)

Function that we gonna write in:

    

lis %r3, 0x0200               //loads 0x02000000 into r3

lwz %r3, 0x00(%r3)        //read at 0x02000000 and store the value in r3 (ClientNumber!)

li %r4, 0                       //loads r4 with 0 (its the type argument)

lis %r5, 0x0200              //Load r5 with 0x02000000

addic %r5, %r5, 0x5000  //This adds 0x5000 to r5 so it will be 0x02005000 then + Read string at 0x02005000 and store it to r5

bl 0x53D984 //SV_GameSendServerCommand 1.09!

b 0x6C  // branch to the end of the FPS Function

copy that to the ppc compiler , click compile and it should look like this:

You must login or register to view this content.

Now that we have our opcode's we gonna write it out in IDA, to do this we will go to IDA and click on hex view(at the offset 0x369084!) -> Press F2 and write All the bytes from the PPC Compiler in. Once your done press F2 again to enable it. Click back on IDA View and it should look like that:
You must login or register to view this content.
If not try it again from the Beginning..

Now that we have everything from IDA go to Visual Studio and Add this Somewhere:

    

public void SV_GSSC(int client, string CMD)

        {

            byte[] ppc = new byte[] { 0x3C,0x60,0x02,0x00,0x80,0x63,0x00,0x00,0x38,0x80,0x00,0x00,0x3C,0xA0,0x02,0x00,0x30,0xA5,0x50,0x00,0x48,0x1D,0x48,0xED,0x48,0x00,0x00,0x6C }; //PPC Function we have just written..

            byte[] reset = new byte[] { 0x80,0x7E,0x00, 0x00, 0x7C, 0x63, 0x07, 0xB4, 0x4B, 0xE4, 0xC6, 0x69, 0x3C, 0x80, 0x00, 0x37, 0x60, 0x7D, 0x00, 0x00, 0x3B, 0xE4, 0x8F, 0xD4 }; //Original PPC Function of FPS..

            PS3.Extension.WriteInt32(0x02000000, client); //This will Write the clientIndex to r3

            PS3.Extension.WriteString(0x02005000, CMD); //This will write the CMD to r5

            PS3.SetMemory(0x0369084, ppc);                 //This is our ppc function

            PS3.SetMemory(0x0369080, new byte[] { 0x40 }); //This will execute our code(change the beq to bne)

            Thread.Sleep(5);

            PS3.SetMemory(0x0369080, new byte[] { 0x41 }); //this will stop the execution(change the bne back to beq)

            PS3.SetMemory(0x0369084, reset);  //This will write the Original ppc code back in!

        }





You need PS3Lib for it , Also you can call it like this SV_GSSC(0, "c hello"); or whatever xD

If you have any problems with it just pm me, i will help you

P
I hope you find this usefull and understood everything of it as its my first Tutorial

Great Thanks to BadLuckBrian, i have learned so much of you PPC Tutorials <3 You must login or register to view this content.
-BuC and Choco for the PPC Compiler <3

(adsbygoogle = window.adsbygoogle || []).push({});

The following 21 users say thank you to VezahMoDz for this useful post:

Bad Luck Brian, BaSs_HaXoR, Camo-, FusionIsDaName, Sir Quack, iMoDz-Baptiste, ItsLollo1000, Jannik007, MrKiller261, John, Notorious, Obris, Shark, Smoky420, SnaY, TheFallen, ThePaaqoHD, Fatality, xShaTTer.

04-03-2014, 12:02 AM #11

Notorious

Caprisuns Is Back

736

Posts

20,411

Reputation

10

Credits

Member

Nov 2013

NextGenUpdate

Originally posted by SC58

Here's some basic one.

You must login or register to view this content.

Maybe some of yall can learn to make this :p

Thanks for sharing

04-06-2014, 09:19 PM #12

John

skid

1,823

Posts

65,874

Reputation

155

Credits

NextGenUpdate Elite

Dec 2012

NextGenUpdate

Originally posted by VezahMoDz

So got Bored and i thought i could do some new stuff on ngu, I might add some new Tutorials to the Thread if you guys want me to

. I will start off with some very basic and easy stuff and get more Advanced later

NOTE!: You should have a basic knowledge of PPC or you might get lost in here

Tutorial 1: SV_GameSendServerCommand:

1.Open Up IDA and Load the Ghosts 1.09 elf. (if you open it up the first time it will load for a bit so let it do that!)

2.We are going to Open UP the String View like this You must login or register to view this content.

3. Search for fps: -> double click it and it will get you to here: You must login or register to view this content. double click on the XREF and it will get you to the fps function

4.You should see this know You must login or register to view this content. Look at the beq instruction -> we gonna start writing our function 1 instruction after that. Im going to use Choco's PPC Compiler for it just search for it in the ps3 forums

(its way easier stare

)

Function that we gonna write in:

    

lis %r3, 0x0200               //loads 0x02000000 into r3

lwz %r3, 0x00(%r3)        //read at 0x02000000 and store the value in r3 (ClientNumber!)

li %r4, 0                       //loads r4 with 0 (its the type argument)

lis %r5, 0x0200              //Load r5 with 0x02000000

addic %r5, %r5, 0x5000  //This adds 0x5000 to r5 so it will be 0x02005000 then + Read string at 0x02005000 and store it to r5

bl 0x53D984 //SV_GameSendServerCommand 1.09!

b 0x6C  // branch to the end of the FPS Function

copy that to the ppc compiler , click compile and it should look like this:

You must login or register to view this content.

Now that we have our opcode's we gonna write it out in IDA, to do this we will go to IDA and click on hex view(at the offset 0x369084!) -> Press F2 and write All the bytes from the PPC Compiler in. Once your done press F2 again to enable it. Click back on IDA View and it should look like that:
You must login or register to view this content.
If not try it again from the Beginning..

Now that we have everything from IDA go to Visual Studio and Add this Somewhere:

    

public void SV_GSSC(int client, string CMD)

        {

            byte[] ppc = new byte[] { 0x3C,0x60,0x02,0x00,0x80,0x63,0x00,0x00,0x38,0x80,0x00,0x00,0x3C,0xA0,0x02,0x00,0x30,0xA5,0x50,0x00,0x48,0x1D,0x48,0xED,0x48,0x00,0x00,0x6C }; //PPC Function we have just written..

            byte[] reset = new byte[] { 0x80,0x7E,0x00, 0x00, 0x7C, 0x63, 0x07, 0xB4, 0x4B, 0xE4, 0xC6, 0x69, 0x3C, 0x80, 0x00, 0x37, 0x60, 0x7D, 0x00, 0x00, 0x3B, 0xE4, 0x8F, 0xD4 }; //Original PPC Function of FPS..

            PS3.Extension.WriteInt32(0x02000000, client); //This will Write the clientIndex to r3

            PS3.Extension.WriteString(0x02005000, CMD); //This will write the CMD to r5

            PS3.SetMemory(0x0369084, ppc);                 //This is our ppc function

            PS3.SetMemory(0x0369080, new byte[] { 0x40 }); //This will execute our code(change the beq to bne)

            Thread.Sleep(5);

            PS3.SetMemory(0x0369080, new byte[] { 0x41 }); //this will stop the execution(change the bne back to beq)

            PS3.SetMemory(0x0369084, reset);  //This will write the Original ppc code back in!

        }





You need PS3Lib for it , Also you can call it like this SV_GSSC(0, "c hello"); or whatever xD

If you have any problems with it just pm me, i will help you

P
I hope you find this usefull and understood everything of it as its my first Tutorial

Great Thanks to BadLuckBrian, i have learned so much of you PPC Tutorials <3 You must login or register to view this content.
-BuC and Choco for the PPC Compiler <3

Should this work for other call of duties? like mw3?

04-06-2014, 09:48 PM #13

VezahMoDz

Do a barrel roll!

132

Posts

3,107

Reputation

0

Credits

Member

Dec 2013

NextGenUpdate

Originally posted by goon

Should this work for other call of duties? like mw3?

Yep just the offsets and the difference between the end of the function and the location where the branches are, is different Winky Winky

04-06-2014, 10:06 PM #14

milky4444

Banned

425

Posts

11,968

Reputation

78

Credits

Banned

Sep 2012

NextGenUpdate

Originally posted by VezahMoDz

So got Bored and i thought i could do some new stuff on ngu, I might add some new Tutorials to the Thread if you guys want me to

. I will start off with some very basic and easy stuff and get more Advanced later

NOTE!: You should have a basic knowledge of PPC or you might get lost in here

Tutorial 1: SV_GameSendServerCommand:

1.Open Up IDA and Load the Ghosts 1.09 elf. (if you open it up the first time it will load for a bit so let it do that!)

2.We are going to Open UP the String View like this You must login or register to view this content.

3. Search for fps: -> double click it and it will get you to here: You must login or register to view this content. double click on the XREF and it will get you to the fps function

4.You should see this know You must login or register to view this content. Look at the beq instruction -> we gonna start writing our function 1 instruction after that. Im going to use Choco's PPC Compiler for it just search for it in the ps3 forums

(its way easier stare

)

Function that we gonna write in:

    

lis %r3, 0x0200               //loads 0x02000000 into r3

lwz %r3, 0x00(%r3)        //read at 0x02000000 and store the value in r3 (ClientNumber!)

li %r4, 0                       //loads r4 with 0 (its the type argument)

lis %r5, 0x0200              //Load r5 with 0x02000000

addic %r5, %r5, 0x5000  //This adds 0x5000 to r5 so it will be 0x02005000 then + Read string at 0x02005000 and store it to r5

bl 0x53D984 //SV_GameSendServerCommand 1.09!

b 0x6C  // branch to the end of the FPS Function

copy that to the ppc compiler , click compile and it should look like this:

You must login or register to view this content.

Now that we have our opcode's we gonna write it out in IDA, to do this we will go to IDA and click on hex view(at the offset 0x369084!) -> Press F2 and write All the bytes from the PPC Compiler in. Once your done press F2 again to enable it. Click back on IDA View and it should look like that:
You must login or register to view this content.
If not try it again from the Beginning..

Now that we have everything from IDA go to Visual Studio and Add this Somewhere:

    

public void SV_GSSC(int client, string CMD)

        {

            byte[] ppc = new byte[] { 0x3C,0x60,0x02,0x00,0x80,0x63,0x00,0x00,0x38,0x80,0x00,0x00,0x3C,0xA0,0x02,0x00,0x30,0xA5,0x50,0x00,0x48,0x1D,0x48,0xED,0x48,0x00,0x00,0x6C }; //PPC Function we have just written..

            byte[] reset = new byte[] { 0x80,0x7E,0x00, 0x00, 0x7C, 0x63, 0x07, 0xB4, 0x4B, 0xE4, 0xC6, 0x69, 0x3C, 0x80, 0x00, 0x37, 0x60, 0x7D, 0x00, 0x00, 0x3B, 0xE4, 0x8F, 0xD4 }; //Original PPC Function of FPS..

            PS3.Extension.WriteInt32(0x02000000, client); //This will Write the clientIndex to r3

            PS3.Extension.WriteString(0x02005000, CMD); //This will write the CMD to r5

            PS3.SetMemory(0x0369084, ppc);                 //This is our ppc function

            PS3.SetMemory(0x0369080, new byte[] { 0x40 }); //This will execute our code(change the beq to bne)

            Thread.Sleep(5);

            PS3.SetMemory(0x0369080, new byte[] { 0x41 }); //this will stop the execution(change the bne back to beq)

            PS3.SetMemory(0x0369084, reset);  //This will write the Original ppc code back in!

        }





You need PS3Lib for it , Also you can call it like this SV_GSSC(0, "c hello"); or whatever xD

If you have any problems with it just pm me, i will help you

P
I hope you find this usefull and understood everything of it as its my first Tutorial

Great Thanks to BadLuckBrian, i have learned so much of you PPC Tutorials <3 You must login or register to view this content.
-BuC and Choco for the PPC Compiler <3

tanx 4 this, im a nub at ppc