Hi. Besides button codes and hints, is there anything like gameshark for the xbox? I heard of trainers or something, but what do they do? It would be lame if there are no gameshark device for xbox.
Hey Flashed, is there another method to get action replay free besides having to make your own usb controller. That's pretty scary stuff. Isn't there a burnable version of action replay for xbox? If there isn't, is there another way to cheat for xbox? Do you know what trainers are. I have beat many games, and want to explore their cheat values.
the action replay for xbox does not allow you to cheat. it mearly allows you to download other peoples saved games and use them. If you have your xbox modded, then you are better off downloading a copy of Xbox Save Game Manager and ftp'ing the save game to your xbox. Now as for the cheating, the best way to go is to get trainers or learn how to create them yourself.
yeah, I have a couple of tutorials on how to create trainers. They isn't really 100% specific but I'll post them on here later. I have to cruise to work at the moment.
There are things called "Trainers" It's alot like gameshark. Like If you get the halo trainer u can get like unlimited shield, super jump, stuff like that, gameshark-y cheats. You dont need a usb or anything either, u just need to DL it and install it.
Ummmmm, tim1210 you really didn't read all of this thread did you? If you did then you would have noticed that we were already talking about using trainers. And shortly I am going to post a couple of tutorials on how to make trainers.
Yep! I got trainers to work and they are pretty sweet! Thank you so much Flashed for all you help-If not for you help, I wouldn't be using some sweet cheats for burnout 3. So Bubba1982, action replay for xbox doesn't really allow you to cheat? That's pretty stupid then. Besides http://trainers.evolutionx.info/pg/downloads/category/3/index.php&root=1&start=30, where else can I get more trainers?
well, the trainer tutorial has been submitted to the guides section and is now awaiting approval from aD staff. If it doesn't get approved then I'll just paste it in here. Fear not, you will get a guide.
decided to post the first tutorial in here anyways. remember, this is not a tutorial made by me. ok. Evox Trainer Tutorial. Tools needed: Computer Xbox Latest Evox CXBX (http://www.caustik.com/cxbx/) Network connection between xbox and computer brain Useful tools: Ida Pro (any will do, 4.30-current is ideal) The first step to writing a trainer is to pick a game, just about any game will do, but its best to start out with something simple, where its easy to tell the values you are dealing with. It helps if the value is something you can see update, such as lives or amount of ammo. I looked back through the games that I've wrote trainers for, and most of them weren't what I'd call simple, Armed and Dangerous and TMNT (# of continues) were easiest, so lets try one of those.. After selecting a game get a copy of the xbe onto your computer and load it up in caustiks CXBX, go to the file menu and say 'export exe' and save it to something like tmnt.exe, now go to the edit menu, and select the dump xbe info to option, dump it to a file so that you can cut and paste. Open the output file up with a text editor (notepad/wordpad) and scroll until you see something like (from max payne 2): Dumping XBE Certificate... Size of Certificate : 0x000001EC TimeDate Stamp : 0x3FB3F515 (Thu Nov 13 16:18:13 2003) Title ID : 0x5454000C Title : L"Max Payne 2" The part you care about it the title ID, copy that to another text editor window and be sure to save it, you'll need it to write the trainer. Now load up the game on your xbox (I will be showing how to do the Continue trainer for TMNT), telnet to your xbox's ip.. You will see: RemoteX Debugger V1.1 . Pick a character, I chose Leonardo.. Hit A until you you see a bunch of the little robot thingies coming at you.. Now look at your status bar, you have health (bar) # of Shurikens, score, and '6' hearts. type: value 6 The output should look like: Store Game State in slot 0 ... ... Done. Slot 0 Val 6 -- Now lose a life, and continue, now on the screen it says '5' so do a value 5 search. the output should look like: Store Game State in slot 1 ... ... Done. Slot 0 Val 6 Slot 1 Val 5 -- repeat the above process again (lose a life and continue) then search for 4.. Store Game State in slot 2 ... ... Done. Slot 0 Val 6 Slot 1 Val 5 Slot 2 Val 4 (a bunch of crap) I then wen't back to the title screen (Start) and started playing again, now that my life count is back to 6, so I do a value 6 search.. Check 83d00000:83f58000 83d03088 83d030d0 83d0343c 83d03444 83d034d8 83d03910 83d0395c 83d08084 83d0842c 83d0c2dc 83d0c2e0 83d0c2e4 83d0c2e8 83d0c2ec 83d0c600 83d0c604 83d0c618 83d0c634 83d0c638 83d0c63c 83d0c670 83d17424 83d1781c 83d814c0 83d81830 83d81c1c Check 00a80000:00b80000 00b72448 Check 83b34000:83c60000 83b97274 83b99a54 Check 83575000:835b5000 From this I would have to say that only three of these addresses look like good targets, 00b72448 83b97274 83b99a54 The next step is to look at what data is stored there.. so type: db <address> 10 you should see: 00b72448 : 06 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 | ................ 83b97274 : 06 6a 7e d2 06 6c 81 d2 06 6a 7e d2 07 66 79 d0 | .j~R.l.R.j~R.fyP 83b99a54 : 06 67 79 d2 59 a1 af e2 bf dc e1 f4 ff ff ff ff | .gyRY!/b?\at From this I would have to say the first one is the best canidate. Most if not all games for xbox are wrote in C (or C++) and in C a integer (whole number) is 4 bytes long. Although you can store values in a single byte, unless memory is tight, it is seldom done (from what I've seen so far). So now what? Lets see if we can change the value.. type: poke 00b72448 7 ! The hearts value went up to 7! We may have the correct address.. Now its time to see. Now we want to see when this value is changed.. so type: bpmb 0 00b72448 w Now its time to die again. When you hit start to continue the game froze. This is good, it means this value WAS updated when you continued.. BP 0 @ 0002a261 EAX : 00b72424 EBX : 00000000 ECX : 00000001 EDX : 00000006 ESI : 013bcd24 EDI : d0044df0 EBP : d0044d4c TMNT hangs after you do a break point (At least it does for me) so just reboot your system (type reset in the telnet window) or turn the xbox on and off and reload TMNT, and reconnect with telnet. now in IDA pro, click the VIEW-ASM tab, then go to the jump menu, select jump address and type in 0002a261. .text:0002A250 arg_0 = dword ptr 4 .text:0002A250 .text:0002A250 mov eax, dword_2AA8E0 .text:0002A255 mov edx, [eax+24h] .text:0002A258 mov ecx, [esp+arg_0] .text:0002A25C sub edx, ecx .text:0002A25E mov [eax+24h], edx .text:0002A261 retn .text:0002A261 sub_2A250 endp Look at the instruction before the break, they are moving the value in edx to some memory location, this is whats updating the value we see on the screen. So where does this edx value come from? If you look at the line above that: .text:0002A25C sub edx, ecx This means: edx = edx - ecx if we look back to what our break point said, we see that ecx equals one, so that means its edx = edx - 1 and since edx equals 6 after the subtraction, that means it was previously 7. so rewrote in english: move some address stored at 2AA8E0 into eax *move the value that is at eax + 24h into edx move the value (1) that was pushed to this routine into ecx -subtract ecx from edx and place it in edx *move edx back to where it came from (eax + 24h) So we have a few options, we can change ecx to 0, we could not subtract the value, or we could remove all instructions from the function, or we could just return as soon as we get to the function. move some address stored at 2AA8E0 into eax *move the value that is at eax + 24h into edx move the value (1) that was pushed to this routine into ecx *move edx back to where it came from (eax + 24h) If we remove the subtraction part, we end up moving a value from eax+24h to edx then from edx to eax+24h That will keep the value the same, so lets do that.. The SUB starts at 0002A25C and ends at 0002A25D so we have to remove two bytes, the simplist way to do this is to 'NOP' (no operation) the SUB instruction. so in your telnet window type: poke 0002A25C 90 poke 0002A25D 90 Now start playing, and try to die, the value should stay the same, and you now have infinite lives!
