+  RHDN Forum Archive
|-+  Romhacking
| |-+  ROM Hacking Discussion
| | |-+  Seeking a relative searcher that can search for hex values with wildcards
Pages: [1]
Author Topic: Seeking a relative searcher that can search for hex values with wildcards  (Read 2 times)
FaustWolf
Guest
« on: May 19, 2008, 10:06:58 am »

Hey all! I'm looking for a relative search utility that can handle files as large as 600MB and that can conduct searches using hex values instead of letters, with wildcard capability. Basically, something that can do what Griffin Knodle's Relative Searcher 2.4 could do as illustrated in the section "Finding Pointer Tables" in his tutorial. I didn't see Relative Searcher 2.4 on this site, and given that the tutorial was written in 1998 with NES games in mind, I imagine that program might not be able to handle ISO-size files to begin with.

I tried creatively (naively? Cheesy) using letters to "replicate" a hex search in the Monkey Moore relative search program, but the relative differences between letters in a 26-character alphabet do little to help when you're trying to search for byte strings like 0x92 ** ** ** 20 ** ** ** ** and the like. I suspect some of the awesome relative searchers hosted here are capable of the task, but without in-depth documentation I'm at a loss as to how I'd get a program to recognize that it's searching for hex strings as opposed to letter strings.
creaothceann
Guest
« Reply #1 on: May 19, 2008, 02:34:49 pm »

WinHex
FaustWolf
Guest
« Reply #2 on: May 19, 2008, 03:35:17 pm »

Vielen, vielen danke! :crazy:

My goodness, I have not seen such an efficient and useful search program as the one WinHex uses. This makes finding pointer tables a breeze -- if the pointer tables one seeks are actually there, of course.
« Last Edit: May 19, 2008, 03:44:45 pm by FaustWolf »
MathOnNapkins
Guest
« Reply #3 on: May 19, 2008, 04:34:56 pm »

...

I'll admit I'm pretty ignorant when it comes to PSX hacking, but wouldn't it be beneficial to split the ISO into sections somehow for faster searching?

I mean, I would think that Chrono Cross's disk image is constructed with at least an ounce of sanity, grouping data together logically.

Or maybe not? Honestly, I've been annoyed just searching through a 96MB DS rom before.
Karatorian
Guest
« Reply #4 on: May 19, 2008, 06:09:13 pm »

Well, 'pysr' is a little command line utility I found in the utilities database the other day (when I needed to do some realative searching) that can handled hex searches and wildcards.
FaustWolf
Guest
« Reply #5 on: May 19, 2008, 11:08:08 pm »

I'll try that too, Karatorian, thanks! Since MathOnNapkins has already guessed that I'm working on Chrono Cross, I might as well divulge everything in case someone can share helpful knowledge. I'm looking at the possibility that there might be pointers to all the character and enemy models in Cross, and finding these pointers is crucial to in-depth hacking. The game engine knows somehow where the data begins and ends, because swapping models causes the game to freeze only when the new model's size is greater than the original model's; my utter failure to find these pointers thus far is the one thing keeping fans from playing a Dark Serge hack, among other things.

As it stands, I've been able to use WinHex to eliminate the possibility that the pointers are absolute (and not relative) in nature -- it was a very unlikely possibility, sure, but the fact that I couldn't check before was still bothering me. The game image's Table of Contents, for example, does report all file offsets in absolute terms (and unfortunately, the Table of Contents is not an active pointer table).  However, I've not been able to use WinHex to conduct *relative* searches with hexadecimal; if anyone knows of such a function in WinHex, please let me know.

But to answer your question, MathOnNapkins, I've found that an ability to look at the entire iso while it's still whole is extremely useful for solving certain problems. Case in point is the probable presence of relative pointers to the models I'm examining. If I happen across something that looks like a pointer table, I can add the potential pointer value to the pointer table's starting offset and see if I end up with the address of a model. For what it's worth, WinHex takes only 1 minute to search through a whole Chrono Cross game image -- it's lightning fast. Ah, if it could only do relative searches!

But in all likelihood, the pointers to character and enemy models may be stored in each room's fieldscript and battle scripts. Horrible and redundant as that may sound (it would necessitate changing pointers in every single room's appropriate scripts), the fact that there is no pointer table directly preceeding the models is suggestive. Furthermore, there is the fact each room's uncompressed dialogue text repeats the game's debug info; if the developers were willing to stuff all that in each room's code, why not a slew of pointers as well? Unfortunately I haven't succeeded in getting Terminus Traductions' translation tools to decompress the fieldscript and battle script yet; a simple bait & switch of the fieldscript and dialogue text doesn't work, probably because the translation tools are geared specifically to look for certain things characteristic of compressed dialogue.
Pages: [1]  


Powered by SMF 1.1.4 | SMF © 2006-2007, Simple Machines LLC