V1.4

PS5 Debug Studio: code caves for console cheat menus, bulk add in the Scanner

Code-cave cheats made in the tool can now be exported to .shn, .mc4 and GoldHEN .json, so they run from the console's cheat menu, not only from the PC. The Scanner can now add many results to the address list at once. Two cheat-runtime fixes are included as well.

Code caves in .shn / .mc4 / GoldHEN .json

• Hook cheats now export to the console formats. Before, any cheat with a hook or @Buffers was refused, because these formats can only write fixed bytes at fixed offsets. Now the cave code is written into unused space inside the game's own code, and the hook site becomes jmp cave, the same way hand-made console code caves work.
• Works wherever the game loads. Every jump is relative, so the exported cheat doesn't depend on the game's load address.
• Safe to turn off. Turning the cheat off restores only the hook site; the cave stays in place, unused. The game never jumps into half-removed code, whatever order the cheat menu writes the lines in.
• Find free space. In the new Code caves box of the export window, give the cave offset yourself, or press Find free space with the game running. It scans the game's code for unused CC / 00 padding and prefers space at the end of the code. If you typed an offset, it checks that the bytes there are free.
• Buffers.
  • Buffers the cave code only reads are placed next to the code.
  • Buffers the code writes need memory the game doesn't use, because code pages are read-only. There's a separate field for that location.
• Inputs used by the cave are fixed at their default values, since these formats can't ask for a value. The export window lists the values it used.
• AOB hooks: a hook found by AOB needs a fixed offset for these formats; untick Locate by AOB when saving it. ShnExt export keeps AOBs as before.

Offsets: nothing to subtract

The .shn <Offset> is counted from the start of the game executable. That's the same number the tool shows as module(main)+0x…: a cave at module(main)+0x1BC000 is <Offset>1BC000</Offset>, with no Absolute tag.

The real addresses shown in the Scanner, Hex editor and Disassembler include the game's load address (0x400000 for most PS4 games). That's where the "-0x400000" comes from when you write a .shn by hand. Export does it for you.

Scanner

• Add selected and Add all buttons above the results. Picking several results with Shift / Ctrl+click already worked, but wasn't shown anywhere; there's now a hint next to the buttons.
• Ctrl+A selects the whole page of results.
• Add all takes every page of results, not just the 1,000 on screen, up to 10,000 addresses. It asks first when there are more than 1,000.
• Adding many is fast. The address list used to redraw once per address added; now it redraws once per batch.

Cheat runtime fixes

• Section N cheats: if one possible address couldn't be read (for example, section N + offset ran past the end of that section), the whole cheat failed. Now the other address is tried.
• Master Code cheats: a Master Code dependent and an ordinary cheat with the same address text shared one remembered address, so the ordinary cheat could write into the Master Code's block. They're now kept apart.

V1.3

PS5 Debug Studio: ShnExt, scanner undo and game naming update

This release adds full ShnExt support (AOBs, hooks, code caves, item dropdowns) on both import and export, undo for the scanner, inputs for code caves, and one naming standard for games that reads the title id and app version straight from the console.

ShnExt

• Export to .ShnExt. A new file type in the export dialog, written the way the ShnExt app writes it. ShnExt export is built into the released .exe; it is not available when running from source.
• AOBs, hooks and code caves are kept. Before, a cheat had to be fixed byte patches to export. Now AOB finders, hooks into code caves, cave blocks that jump between each other, data values and inputs are all written as ShnExt patches.
• Item lists become dropdowns. An input that picks from an item list is exported as a ShnExt dictionary dropdown, with the whole list inside the file.
• Round trips are exact. Importing a ShnExt project and exporting it again gives back the same patches, including the original code text, the label names and the value types.
• Decrypted projects import fully. .ProjReap projects bring their game name, title id, version and item dictionaries. Values shared between patches are linked, and the description tells you which cheat to turn on first.
• Original bytes for fixed sites. When a hook or patch sits at a fixed offset, the dialog can read the game's original code for it with "Read original bytes".
• The export list shows what each patch holds, e.g. "ok – 1 AOB, 1 hook, 1 input".
• Long patches are split at 1,024 bytes, onionHEN's limit.
• Negative or huge offsets are refused instead of being written wrong.
• Fixes:
  • Register jumps like jmp rax were reported as missing labels.
  • nop:N inside longer code, dword [x] without ptr, // comments and movabs with a variable now assemble.

Tested:

• 589 public Reaper trainers: 5,614 of 5,633 cheats import, and 5,603 come back identical after export.
• 1,585 GoldHEN cheat files converted to ShnExt read back identically in onionHEN.
• The Dark Souls 3 and Dark Souls Remastered projects (18 patches) come back identical.

Game names, title ids and versions

Every game, file and export now uses the same standard as GoldHEN, ShnExt and Reaper Studio:

Field	Example
Title id	CUSA08155, PPSA01341
App version	01.03 (PS4), 01.004.000 (PS5)
Content id (optional, new)	UP0700-CUSA08155_00-DARKSOULS3BST000
Process	eboot.bin
File name	CUSA08155_01.03.json, PPSA01341_01.004.000.ps5c

• From console. With the game running, New game and Export fill in the title id, content id and app version. The version comes from the game's param.sfo (or param.json), the same source Reaper Studio uses. This needs a ps5debug-NG version with the foreground-app command; older payloads still give the title id, and you type the version. The console doesn't report game titles, so the game name is yours to type; it's reused when the library already has that game.

• Older files are corrected. When a cheat file is loaded or imported, the tool fixes:

  • lower-case title ids
  • title ids that only appear in the game name or content id
  • versions like 1.4 or v01.03, which are written in full
  • an empty process, which is set to eboot.bin

  The untouched original of each library file is kept in deleted\<name>_before_naming.json.

• New and imported files are named <TITLEID>_<VERSION>.json. Existing library files keep their names.

• Versions never mix. An import no longer merges cheats for a different app version into the same file, since the offsets differ.

• Our own exports follow the standard too. .ps5c and tool JSON exports now have the same header as the console formats, need a title id and version, and are named <TITLEID>_<VERSION>.ps5c.

• Version warning. Turning on a cheat made for a different app version than the running game writes a warning to the log. AOB cheats usually still work.

• Record from Caller and "Save as cheat" from a code cave fill in the version and content id.

Scanner

• The options column scrolls when the window is short. Range search options were cut off before.
• Undo scan and scan history. Each scan step's results are kept, up to 1,000,000 addresses per step, for 1–8 byte and float types. Going back re-reads only those addresses and continues from there.

Code caves (Disassembler)

• Inputs and buffers have defaults. Every $input and @buffer the cave code uses is listed with a type and a default value, like the Caller's assembler. The defaults are used for the preview and for Enable.
• Saved cheats keep them. The cheat gets the inputs with their types and defaults, and an alloc step for each buffer. "Insert step into Cheat Editor" adds the inputs too.
• Float inputs go into the assembly as their IEEE bits (mov eax, $speed).

Import

• No doubled "(master code)" in cheat names.

V1.2

PS5 Debug Studio: cheat format compatibility update

This release makes .shn, .mc4, GoldHEN .json and ShnExt cheats behave the way GoldHEN and onionHEN expect, on both import and export. It was tested against all 5,445 files in the GoldHEN cheat repository and against onionHEN's own cheat parser.

Importing cheats

• Every GoldHEN repository file now imports, up from 5,438 of 5,445.
• UTF-16 .shn files are supported.
• Absolute lines (<Absolute>True</Absolute> in .shn/.mc4, "absolute": true in .json) now use the address as written instead of adding the executable base.
• Names with quotes (e.g. Max YEN "After Gained Or Used") no longer break .mc4 and .shn imports.
• GoldHEN "button" cheats keep their own off value.
• Damaged off values (an odd number of hex digits) are no longer trusted. When the cheat is turned off, the original game bytes are restored instead.
• Hex with stray spaces or odd length is read the way GoldHEN reads it.
• "Trainer info" entries with no offset are skipped instead of writing to the start of the executable.
• Out-of-range section numbers are treated as section 0, as onionHEN does.
• Title IDs in file names are found even when next to _ (e.g. Mirage_PPSA07230_…).

ShnExt

• Simple ShnExt cheats (fixed offset plus code or nop:N) import correctly. Before, they crashed the import.
• nop:N is understood (N bytes of 90).
• Hooks on computed addresses now patch the right place.
• Real game names from the project are used when available.
• Encrypted .ShnExt files opened in the toolkit now show a clear message pointing to the Cheat Player.

Running imported cheats

• Section N lines are checked against the game. The cheat patches whichever meaning (PS4-tool or onionHEN/GoldHEN) holds the line's original bytes, and turning it off uses the same address.
• Master Code cheats work like GoldHEN. Cheats marked "MC" find their real address inside the code the Master Code wrote, and their description reminds you to turn the Master Code on first.
• An address picked without verification is retried the next time the cheat is turned on, instead of being kept.

Exporting cheats (.shn / .mc4 / .json)

• Absolute addresses are exported as Absolute lines, with a warning, instead of being refused.
• GoldHEN .json can now carry section.
• On and off values of different lengths are kept, with a warning, since GoldHEN accepts them.
• Offsets past 4 GB no longer come out as the wrong section.
• Negative offsets export correctly. These are caves placed just before the executable.
• Cheat names with quotes are written so onionHEN can read them.
• Absolute lines are written first, which avoids an onionHEN bug that marks earlier normal lines as absolute.
• Results match: exports of the GoldHEN repository files read back in onionHEN with the same patches as the originals, except lines onionHEN itself can't read.

V1.1

What's new

Debugger

• Breakpoints / watchpoints panel can be resized: drag the divider between the code view and
  the list.
• Pop out the breakpoints list: "Pop out ⧉" opens it in its own window (handy on a second
  screen). Close it or press "Dock back" to return it. Size, position and pop-out state are
  remembered.
• Code before the breakpoint: when the game stops, the code view also shows the instructions
  leading up to the current line, which now sits about a third of the way down.
• Scrolls on small screens: the Debugger tab gets a scrollbar instead of cutting off panels.

Pointer scan

• Works with the updated ps5debug-NG pointer-scan payload, and still with the previous one.
• Reports when part of the game's memory couldn't be read during a pass, so missing chains
  aren't silent.

Fixes

• Kernel panic on reconnect: pressing Connect again while the debugger was attached, then
  attaching or refreshing, could crash the console.
  • Connect, Disconnect and closing the tool now detach the debugger cleanly first, and give the
    console time to finish closing the session.
  • If the connection drops on its own, the debugger is shown as detached.
  • Attach waits and retries once if the console is still closing the last session.
• Code cave "Save as new cheat" had no buttons: with "Locate by AOB" ticked, the popup
  crashed before its Save / Cancel buttons were drawn. Fixed.
• Windows too big for laptop screens: the code cave window, "Record cheat from Caller", the
  export dialog and the others now fit the screen, with their buttons always visible.
  • "Record cheat from Caller" now has its Save / Cancel buttons in a bar along the bottom, and
    its options column scrolls.

Notes

• To use the server-side pointer scan, load the updated ps5debug-NG payload with the
  pointer-scan command. Without it, the tool falls back to turbo scans as before.

V1

Initial release