V1.4

PS5 Debug Studio: code caves for console cheat menus, bulk add in the Scanner

Code-cave cheats made in the tool can now be exported to .shn, .mc4 and GoldHEN .json, so they run from the console's cheat menu, not only from the PC. The Scanner can now add many results to the address list at once. Two cheat-runtime fixes are included as well.

Code caves in .shn / .mc4 / GoldHEN .json

• Hook cheats now export to the console formats. Before, any cheat with a hook or @Buffers was refused, because these formats can only write fixed bytes at fixed offsets. Now the cave code is written into unused space inside the game's own code, and the hook site becomes jmp cave, the same way hand-made console code caves work.
• Works wherever the game loads. Every jump is relative, so the exported cheat doesn't depend on the game's load address.
• Safe to turn off. Turning the cheat off restores only the hook site; the cave stays in place, unused. The game never jumps into half-removed code, whatever order the cheat menu writes the lines in.
• Find free space. In the new Code caves box of the export window, give the cave offset yourself, or press Find free space with the game running. It scans the game's code for unused CC / 00 padding and prefers space at the end of the code. If you typed an offset, it checks that the bytes there are free.
• Buffers.
  • Buffers the cave code only reads are placed next to the code.
  • Buffers the code writes need memory the game doesn't use, because code pages are read-only. There's a separate field for that location.
• Inputs used by the cave are fixed at their default values, since these formats can't ask for a value. The export window lists the values it used.
• AOB hooks: a hook found by AOB needs a fixed offset for these formats; untick Locate by AOB when saving it. ShnExt export keeps AOBs as before.

Offsets: nothing to subtract

The .shn <Offset> is counted from the start of the game executable. That's the same number the tool shows as module(main)+0x…: a cave at module(main)+0x1BC000 is <Offset>1BC000</Offset>, with no Absolute tag.

The real addresses shown in the Scanner, Hex editor and Disassembler include the game's load address (0x400000 for most PS4 games). That's where the "-0x400000" comes from when you write a .shn by hand. Export does it for you.

Scanner

• Add selected and Add all buttons above the results. Picking several results with Shift / Ctrl+click already worked, but wasn't shown anywhere; there's now a hint next to the buttons.
• Ctrl+A selects the whole page of results.
• Add all takes every page of results, not just the 1,000 on screen, up to 10,000 addresses. It asks first when there are more than 1,000.
• Adding many is fast. The address list used to redraw once per address added; now it redraws once per batch.

Cheat runtime fixes

• Section N cheats: if one possible address couldn't be read (for example, section N + offset ran past the end of that section), the whole cheat failed. Now the other address is tried.
• Master Code cheats: a Master Code dependent and an ordinary cheat with the same address text shared one remembered address, so the ordinary cheat could write into the Master Code's block. They're now kept apart.