(adsbygoogle = window.adsbygoogle || []).push({}); Sdrawkcabs Teleport To Crosshair Tutorial

requirements
- crosshair coordinates
- player coordinates
- an active hook
- controller adress
- some knowledge of mips

first we want to find our controller address if you don't know how to find one heres how.

here are our button values your going to need them to find your controller address.

    

    Select button = 0001

    Start button = 0008

    Up D-Pad button = 0010

    Right D-Pad button = 0020

    Down D-Pad button = 0040

    Left D-Pad button = 0080

    Left trigger = 0100

    Right trigger = 0200

    Triangle button = 1000

    Circle button = 2000

    Cross button = 4000

    Square button = 8000

EXAMPLE : if you are holding the triangle button the value of the address your looking for will be : 1000

how you find it : hold down a button in the list above make sure your cheat device is on pause game : true then search the value to the right of the button your chose.

(make sure you search in hex)

alternative method : in some game that wont work what you have to do is this, hold a button and search great then let go and search less continue to do this until you only have a few results

notes :
(make sure you search in hex)
(when you are pressing no buttons the value will be "0")
(it dos not matter if the controller address makes you automatically press the button as long as it displays the correct value)

ok now that you have the control address your going to need to find your player and crosshair coordinates.

finding player coordinates : make sure cheat device is on pause game : true. search for an unknown 32 bit value. move your player and search different then move again and search different again. stand still ever once in a while and search same to get rid of junk address's. once your down to 20-100 results add them to your cheat browser. turn on the cheats one by one. the cheat that changes your locations or makes it so you cant walk in a certain direction is your players coordinates.

alternative method : because the method above can take a long time and also give you a lot of unwanted results this method is very popular. jump or go to higher ground a search greater then go lower and search less. repeat until you only have a few address's then copy them to your cheat browser and active at them one by one. then one that locks you in the air is your hight coordinate. because coordinates are almost always located right next to each other all you have to do is copy your hight coordinate in to your decoder to find the x & y coordinates.

notes :
(make sure cheat device is on pause game : true)
(search unknown 32 bit value)
(coordinates are commonly dma so take a ram dump just in cause)

finding crosshair coordinates : search unknown 32 bit value make sure your cheat device is on pause game true. move your cross hair and search different then move it again and search different again. every once in awhile keep your crosshair in the same place and search same to get rid of junk address's.

notes :
(because your cross hair is always in the middle of your screen this method dos not work for some games)
(coordinates are commonly dma so take a ram dump just in cause)

why do you need a hook? : because games skip over nop caves which is where you will be writing your routine your going to need an active "hook" to jump to the start of your routine.

how to find a hook : search "03E00008" it can take a long time, but you can cancel your search almost right away because you will portly already have several thousand results. copy the last 5-20 results and nop them all. if the address freezes it mean you have an active hook.

finding your hooks value : open up ps2dis, go to your hooks address and enter : J$ address of the first line of your routine. (real addressing)

notes :
(if your hook is inactive it will not jump to your routine)


here's the mips template.
(thanks to BRIAN1337 & 1337 GAMER)
templates by : sdrawkcab
(correct me if im wrong)

mips commands for reference

[url]https://www.mrc.uidah...tal/MIPSir.html[/url]

regular code

    

    hook

    lui t0 $ first half of controller (real addressing)

    lw t0 $ second half of controller(t0)

    addiu t1, zero, $ button value

    lui t2 $ first half of crosshair coordinate (real addressing)

    lui t3 $ first half your coordinate (real addressing)

    bne t0 t1 $ jr ra

    nop

    lw t4 $ second half cross hair coordinate X(t2)

    lw t5 $second half cross hair coordinate Y(t2)

    lw t6 $ second half cross hair coordinate Z(t2)

    sw t4 $ second half your coordinate X(t3)

    sw t5 $ second half your coordinate Y(t3)

    sw t6 $ second half your coordinate Z(t3)

    jr ra

dma code

    

    hook

    lui t0 $ first half of controller (real addressing)

    lw t0 $ second half of controller(t0)

    addiu t1, zero, $ button value

    lui t2 $ first half of crosshair coordinate pointer (real addressing)

    lw t2 $ second half of crosshair pointer (t2)

    lui t3 $ first half your coordinate pointer (real addressing)

    lw t3 $ second half of crosshair pointer (t3)

    bne t0 t1 $ jr ra

    nop

    lw t4 $ offset cross hair coordinate X(t2)

    lw t5 $ offset cross hair coordinate Y(t2)

    lw t6 $ offset cross hair coordinate Z(t2)

    sw t4 $ offset your coordinate X(t3)

    sw t5 $ offset your coordinate Y(t3)

    sw t6 $ offset your coordinate Z(t3)

    jr ra

brief mips explanation (will improve when i find the time)

lui t0 $ first half of controller (real addressing)
Loads the first 16bits of your controller address into the upper half of t0

lw t0 $ second half of controller(t0)
Loads word in to register (t0)

addiu t1, zero, $ button value
t1 is holding selected button value

lui t2 $ first half of crosshair coordinate (real addressing)
lui t3 $ first half your coordinate (real addressing)
Loads the first 16bits of your controller address into the upper half of t2/t3
you only need to load the first half once because coordinates are almost always
located right next each other.

bne t0 t1 $ jr ra (adress of jr ra)
if you are not pressing your selected button value it will branch to the jr ra (end of your routine)
with out this your routine would just run right through and you would always be teleporting to your cross hair.

nop
this acts as a delay slot. it will activate if your branch dos not jump to the selected address.

lw t4 $ second half cross hair coordinate X(t2)
lw t5 $ second half cross hair coordinate Y(t2)
lw t6 $ second half cross hair coordinate Z(t2)
Loads words in to register (t2)

sw t4 $ second half your coordinate X(t3)
sw t5 $ second half your coordinate X(t3)
sw t6 $ second half your coordinate X(t3)
stores word. (this will activate the code)

jr ra
ends the routine

here's a few codes i made using this method.

    

#teleport to projectile

;credit sdrawkcab

;bullets arrows grenades bombs ect

;press select

;if there is no projectile active you will teleport

;to where the last one hit/detonated

0x000000cc 0x0a200400

0x00001000 0x3c0808a6

0x00001004 0x8d082d88

0x00001008 0x24090001

0x0000100c 0x3c0a09c1

0x00001010 0x3c0b090b

0x00001014 0x15090007

0x00001018 0x00000000

0x0000101c 0x8d4c78f0

0x00001020 0x8d4d78f4

0x00001024 0x8d4e78f8

0x00001028 0xad6c3780

0x0000102c 0xad6d3784

0x00001030 0xad6e3788

0x00001034 0x03e00008



#teleport to boss

;credit sdrawkcab

;must be in same area

;L + select (boss 1)

;R + select (boss 2)

0x00001000 0x3c0808a6

0x00001004 0x8d082d88

0x00001008 0x24090101

0x0000100c 0x3c0a090c

0x00001010 0x3c0b090b

0x00001014 0x15090007

0x00001018 0x00000000

0x0000101c 0x8d4c1c80

0x00001020 0x8d4d1c84

0x00001024 0x8d4e1c88

0x00001028 0xad6c3780

0x0000102c 0xad6d3784

0x00001030 0xad6e3788

0x00001034 0x03e00008

0x00001040 0x3c0808a6

0x00001044 0x8d082d88

0x00001048 0x24090201

0x0000104c 0x3c0a090c

0x00001050 0x3c0b090b

0x00001054 0x15090007

0x00001058 0x00000000

0x0000105c 0x8d4c9650

0x00001060 0x8d4c9654

0x00001064 0x8d4c9658

0x00001068 0xad6c3780

0x0000106c 0xad6d3784

0x00001070 0xad6e3788

0x00001074 0x03e00008

0x000000cc 0x0a200410

0x00060054 0x0a200400



 #teleport to map cross hair

 ;credit sdrawkcab

 ;press select

 ;real adressing hook

 0x00007060 0x0a200400

 0x00001000 0x3c0809ad

 0x00001004 0x8d08545c

 0x00001008 0x24090001

 0x0000100c 0x3c0a08b8

 0x00001010 0x3c0b0994

 0x00001014 0x15090007

 0x00001018 0x00000000

 0x0000101c 0x8c4cf190

 0x00001020 0x8d4df194

 0x00001024 0x8d4ef198

 0x00001028 0xad6cb720

 0x0000102c 0xad6db724

 0x00001030 0xad6ef198

 0x00001034 0x03e00008



#teleport to grenades

;credit sdrawkcab

;down dpad

;best with remote grenades

;ofgamers.forumotion.com

0x00002500 0x3c0809ad

0x00002504 0x8d08545c

0x00002508 0x24090040

0x0000250c 0x3c0a08b8

0x00002510 0x3c0b0994

0x00002514 0x15090007

0x00002518 0x00000000

0x0000251c 0x8d4cbae0

0x00002520 0x8d4dbae4

0x00002524 0x8d4ebae8

0x00002528 0xad6cb720

0x0000252c 0xad6db724

0x00002530 0xad6eb728

0x00002534 0x03e00008

0x00107FC8 0x0a200940



#cross hair elevator

;credit sdrawkcab

;press R + down for free aim

;then hold L while in free aim

;use analog up to increase hight

;use analog down to decrease

0x00001500 0x3c0809ad

0x00001504 0x8d08545c

0x00001508 0x24090300

0x0000150c 0x3c0a099a

0x00001510 0x3c0b0994

0x00001514 0x15090003

0x00001518 0x00000000

0x0000151c 0x8d4cb728

0x00001520 0xad6ce728

0x00001524 0x03e00008

0x00107FC8 0x0A200540

thanks please pm if you have any problems or questions.

    

[UPDATE] 

+ dma template

+ new format 

+ more codes