Next Generation Emulation banner

redlofredlof's Guide to Convert Codetwink Cheats to PNACH Files! for newbs.

1 reading
30K views 40 replies 14 participants last post by  Swtboy  
#1 · (Edited)
Redlof's guide to create pnatch files from Codetwink codes:D
Thanks to CKEMU for the original IDEA.
Download content available at CKEMU's website.


Step1: Download CBcrypt from http://www.ckemu.com/public/CB2crypt-v1_11.rar

Step2: Download disc Codetwink disc checker from http://www.ckemu.com/public/ps2vers.zip

Step3: Register at Codetwink website CodeTwink.com
The codes here are all cheat codes none of the codes will help you gain fps

Step4: Search for your game and check whether the Advanced PS2 identification code matches with your game.

In this case I am using the game Soul Calibur 2

For this Use CodeBreaker Disc Version to scan your disc drive
(the drive you've inserted the PS2 CD or DVD into,
if you're using an ISO, mount it with Daemon Tools).
It will then scan the ELF, if the two strings match, your codes will work,
if they don't these codes won't work for the game.

Advanced Identification System
Key: 23 52 54 DF 21 DE 55 B3 0F 70 D2 21 94 EA 7F D8 EF 3D 59 12
Image


The first line in disc checker should match the one on the site

Image


Step5: Creating pnach file

Open/Create a new text document
Image


In the text file enter the following as
gametitle=Soul Calibur 2 [SLUS 20643] (U) [E1b01308]
comment=code for character
The (U) stands for the region code of the game as USA.
Similarly (E), (J) for Europe and Japan versions of games
You can determine this just by seeing this SLUS, SLES, SLJS
The highlited text Below is the CRC for the game, this is also the name of the pnach file as E1b01308.pnach
Image


You can find the CRC from the DOS pcsx2 output window

Image


Step6: Search for your desired code on codetwink website

The codes on the website are in codebreaker/codetwink format and need to be converted to make them work with pcsx2. For this you will require CBcrypt.

pcsx2 does not require the master code.

Open up Cbcrypt and copy the Raw code on the left side of CBcrypt and then click on decrypt to get the converted codes
Image

The new codes at codetwink do not require common v7 encryption.
However if the codes do not work you can try to decrypt with
common v7 encryption ON.

If the decrypted code starts with 1 or 2, then change them to 0 {zero}
For example:
Raw code
2A9F1D35 02020202
2A9B1D35 02020202
1A6D2EE8 00000202

Decrypted code
203FE82C 02020202
203FE830 02020202
103FE834 00000202

Fixed code
003FE82C 02020202
003FE830 02020202
003FE834 00000202
If the decrypted code already starts from 0 or some other letter other then 1 and 2 then no need to change anything

Step7: Now enter the decrypted code as

gametitle=Soul Calibur 2 [SLUS 20643] (U) [E1b01308]
comment=code for character
//cervantes weapons unlock code
patch=1,EE,003FE82C,word,02020202
patch=1,EE,003FE830,word,02020202
patch=1,EE,003FE834,word,00000202
The "//" is used to separate a comment from a code.

Codes can be single line or multiple lines in length.

This process can be repeated to add cheats,
simply paste in the cheat on the left hand side of cbcrypt, and decrypt them,
enter the decrypted code into the pnach file in the same format as shown above.

Here is a bigger example of a pnach I created
gametitle=Soul Calibur 2 [SLUS 20643] (U) [E1b01308]
comment=code for character
//test code
patch=1,EE,003fe78a,word,00000002
//sophita
patch=1,EE,003fe720,word,00000003
//seung mina
patch=1,EE,003fe721,word,00000003
//yoshimitsu
patch=1,EE,003fe722,word,00000003
//charade
patch=1,EE,003fe723,word,00000003
//cervantes
patch=1,EE,003fe724,word,00000003
//lizardman
patch=1,EE,003fe725,word,00000003
//assassin
patch=1,EE,003fe726,word,00000003
//berserker
patch=1,EE,003fe727,word,00000003
//kilik duel rod
patch=1,EE,003fe7e2,word,00000002
//talim costume
patch=1,EE,003fe72d,word,00000003
//cassandra costume
patch=1,EE,003fe732,word,00000003
//taki costume
patch=1,EE,003fe738,word,00000003
//ivy cos
patch=1,EE,003fe744,word,00000003
//sophita
patch=1,EE,003fe754,word,00000003
//seung mina
patch=1,EE,003fe757,word,00000003
//extra VS mode
patch=1,EE,003fe75f,word,00000003
//unlock cassandra weapons
patch=1,EE,003fe796,word,00000202
patch=1,EE,003fe798,word,02020202
patch=1,EE,003fe79c,word,02020202
//taim weapons
patch=1,EE,003FE782,word,00000202
patch=1,EE,003FE784,word,02020202
patch=1,EE,003FE788,word,02020202
//Unlock Raphael Weapon Codes
patch=1,EE,003FE778,word,02020202
patch=1,EE,003FE77C,word,02020202
patch=1,EE,003FE780,word,00000202
//yungsung Weapon Codes
patch=1,EE,003FE78C,word,02020202
patch=1,EE,003FE790,word,02020202
patch=1,EE,003FE794,word,00000202
//mitsurugi weapons
//patch=1,EE,0A2B1D34,word,02020202
//patch=1,EE,0A171D34,word,02020202
//patch=1,EE,0AE12EF7,word,00000202

//taki weapons
patch=1,EE,003FE7AA,word,00000202
patch=1,EE,003FE7AC,word,02020202
patch=1,EE,003FE7B0,word,02020202
//nightmare
//patch=1,EE,0AF72A06,word,00000202
//patch=1,EE,0AE54F8C,word,02020202
//patch=1,EE,0AE56B8C,word,02020202
//astharoth weapons
patch=1,EE,003FE7C8,word,02020202
patch=1,EE,003FE7CC,word,02020202
patch=1,EE,003FE7D0,word,00000202
//ivy weapons
patch=1,EE,003FE7D2,word,00000202
patch=1,EE,003FE7D4,word,02020202
patch=1,EE,003FE7D8,word,02020202
//killik weapons
patch=1,EE,003FE7DC,word,02020202
patch=1,EE,003FE7E0,word,02020202
patch=1,EE,003FE7E4,word,00000202
//xiang weapons
patch=1,EE,003FE7E6,word,00000202
patch=1,EE,003FE7E8,word,02020202
patch=1,EE,003FE7EC,word,02020202
//maxi weapons
patch=1,EE,003FE7F0,word,02020202
patch=1,EE,003FE7F4,word,02020202
patch=1,EE,003FE7F8,word,00000202
//necrid weapons
patch=1,EE,003FE7FA,word,00000202
patch=1,EE,003FE7FC,word,02020202
patch=1,EE,003FE800,word,02020202
//heihachi weapons
patch=1,EE,003FE804,word,02020202
patch=1,EE,003FE808,word,02020202
patch=1,EE,003FE80C,word,00000202
//sophita weapons
patch=1,EE,003FE80E,word,00000202
patch=1,EE,003FE810,word,02020202
patch=1,EE,003FE814,word,02020202
//seung mina weapons
patch=1,EE,003FE818,word,02020202
patch=1,EE,003FE81C,word,02020202
patch=1,EE,003FE820,word,00000202
//yoshimitsu weapons
patch=1,EE,003FE822,word,00000202
patch=1,EE,003FE824,word,02020202
patch=1,EE,003FE828,word,02020202
//cervantes weapons
patch=1,EE,003FE82C,word,02020202
patch=1,EE,003FE830,word,02020202
patch=1,EE,003FE834,word,00000202
You can disable a code by putting // in front of the code.
See the red colored code for that.

Step8: Save the file as a .pnach file with the file name same as your game CRC.
The CRC should be correct otherwise the pnach will not be recognised by pcsx2 and the pnach will not load at all.
Image


Step9: Put this new pnach file in the patches folder located in pcsx2 parent directory
eg.,
c:\Program Files\pcsx2 0.9.6\patches\
or
d:\pcsx2 0.9.6\patches\


Step10: Enable the patches in pcsx2 as shown in image for below.
Image
 
#4 ·
The codes on the website are in RAW format and need to be converted to make them work with pcsx2. For this you will require CBcrypt.
The codes are in Codebreaker format, you want then in RAW format so you are using CBcrypt to Decrypt them

If the decrypted code starts with 1 or 2, then change them to 0 {zero}
This is wrong, for example
Code:
Decrypted code
203FE82C 02020202
203FE830 02020202
103FE834 00000202

you translated it to:

Fixed code
003FE82C 02020202
003FE830 02020202
003FE834 00000202 

and then

patch=1,EE,003FE82C,word,02020202
patch=1,EE,003FE830,word,02020202
patch=1,EE,003FE834,word,00000202
the translation of the last code is wrong it should be
patch=1,EE,003FE834,short,00000202

codes should be translated this way:
Code:
003FE82C 00000002    patch=1,EE,003FE82C,[B]byte[/B],00000002
103FE830 00000202    patch=1,EE,003FE82C,[B]short[/B],00000202
203FE834 02020202    patch=1,EE,003FE82C,[B]word[/B],02020202
The first numer indicates the data's length.

Try searching for a code different from

0XXXXXX 000000YY
1XXXXXX 0000YYYY
2XXXXXX YYYYYYYY

The true intention of the lines

203FE82C 02020202
203FE830 02020202
103FE834 00000202

is to write 10 "02".
if you write the cheats like

patch=1,EE,003FE82C,word,02020202
patch=1,EE,003FE830,word,02020202
patch=1,EE,003FE834,word,00000202

PCSX2 is writing 10 "02" and 2 "00"

If the decrypted code already starts from 0 or some other letter other then 1 and 2 then no need to change anything
Any cheat that doesn't start by 0,1,2 is not working with this method

for example code "Unlock All Weapons for soul calibur 2"

403FE778 002F0001
02020202 00000000
103FE834 00000202

it means

Code:
 4aaaaaaa xxxxyyyy
 dddddddd 00000000  

Starting with the address specified by aaaaaaa, 
this code will write to xxxx addresses. 
The next address is determined by incrementing 
the current address by (yyyy * 4). 
The value specified by dddddddd is written 
to each calculated address. Also known as a "Patch Code."
So it writes 44 (2f) times "02020202" starting from adress 03FE778 and then writes another two "02" in adress 3FE834 (with the line 103FE834 00000202)

If you translate this code your way it will be wrong.

Anyway in pcsx2 are implemented almost any code if you use it with

Code:
code 
XXXXXXXX YYYYYYYY

translated to

patch=1,EE,XXXXXXXX,extended,YYYYYYYY
 
#6 · (Edited)
I will try to explain it better

patch=1,EE,xxxxxxxx,size,yyyyyyyy

work writing "size" of "yyyyyyyy" starting in address "xxxxxxxx"

for example

patch=1,EE,00000100,byte,00000001

writes 01 in address 00000100

patch=1,EE,00000101,byte,00000002

writes 02 in adresss 00000101

and these two lines do the same that this line

patch=1,EE,00000100,short,00000201

It writes 0101 starting in address 00000100 so it first writes 01 in address 100 and then 02 in address 101


For example with these codes that you posted
Code:
//unlock cassandra weapons
patch=1,EE,003fe796,word,00000202
patch=1,EE,003fe798,word,02020202
patch=1,EE,003fe79c,word,02020202
First patch writes 00000202 starting in address 3fe796 until adress 3fe799
you get something like
Code:
address      data
3fe795       ..
3fe796       02
3fe797       02
3fe798       00
3fe799       00
3fe79A       ..
Second patch writes 02020202 starting in address 3fe798 until adress 3fe79B
you get something like
Code:
address      data
3fe795       ..
3fe796       02
3fe797       02
3fe798       02
3fe799       02
3fe79A       02
3fe79B       02
3fe79C       ..
Third patch writes 02020202 starting in address 3fe79C until adress 3fe79F
you get something like
Code:
address      data
3fe795       ..
3fe796       02
3fe797       02
3fe798       02
3fe799       02
3fe79A       02
3fe79B       02
3fe79C       02
3fe79D       02
3fe79E       02
3fe79F       02
3fe7A0       ..
With this i can see that the first patch was translated wrong because it gets overwrited by the second one.

With theses cheats you are unable to know what data is in 3fe798 and 3fe799because it's written with two different values. Probably it will be "02" because the way pcsx2 works.

But hey with the last patch of this code
Code:
//yungsung Weapon Codes
patch=1,EE,003FE78C,word,02020202
patch=1,EE,003FE790,word,02020202
patch=1,EE,003FE794,word,00000202
It writes

Code:
address      data
3fe793       ..
3fe794       02
3fe795       02
3fe796       00
3fe797       00
3fe798       ..
Overwriting the previous code.

That's why it's important the byte,short,word thing.


And any other code that start for anything but 0,1 or 2 should not work because they are not writing directly in memory.

For example
Code:
// FFXII  P1 Press R3+L1 For Super Fast Speed
D056BADC 0000FBFB
1025C7E8 000041F7
This code means checks if the data in adress 056BADC is FBFB and if it is it writes 41F7 in adress 25C7E8

If i translate it your way

it will be
Code:
patch=1,EE,0056BADC,word,0000FBFB
patch=1,EE,0025C7E8,word,000041F7
it will write 0000FBFB in 56BADC (by the way 56BADC it's the adress with pad "registers") and then it will write 000041F7 in 25C7E8

But if you used what i said

Code:
patch=1,EE,D056BADC,extended,0000FBFB
patch=1,EE,1025C7E8,extended,000041F7
It will work


i know all of this because i write the "extended" thing in pcsx2 and for that i have to study how codebreaker/armax codes works
 
#8 · (Edited)
I respect your opinion, you seem to know a lot, but the last code did not work (both your way and mine). Its like you are reading my mind.oO

it's for FFXII NTSC version, i tried it today to check if the 0.9.6 version has my last code ( i modied it little before 0.9.6 comes out) and it works.

i attached my ffxii pnach if you want to try it
 
#10 ·
Well done redlof :D fantastic guide

you've taught me a thing or 2. ;)
 
#11 ·
Try this in tekken 5

P1 Press L1+L2 For Death Blow On P2
D015D402 0000FAFF
203A9A3C 00000000

like

patch=1,EE,D015D402,extended,0000FAFF
patch=1,EE,203A9A3C,extended,00000000

or

Hit Anywhere P2 & P1 Cant Hit P2
D01F55CC 0000282D
201F55D8 16140017

patch=1,EE,D01F55CC,extended,0000282D
patch=1,EE,201F55D8,extended,16140017
 
#12 ·
Well done redlof :D fantastic guide

you've taught me a thing or 2. ;)
Thank you pcxl

Try this in tekken 5

P1 Press L1+L2 For Death Blow On P2
D015D402 0000FAFF
203A9A3C 00000000

like

patch=1,EE,D015D402,extended,0000FAFF
patch=1,EE,203A9A3C,extended,00000000

or

Hit Anywhere P2 & P1 Cant Hit P2
D01F55CC 0000282D
201F55D8 16140017

patch=1,EE,D01F55CC,extended,0000282D
patch=1,EE,201F55D8,extended,16140017
tekken5 does not have any controls set for L1 and L2, are you sure?
Are these codes from code twink, my disc does not match the one at codetwink. Let me try these.
 
#14 · (Edited)
@Pontifice
the first code crashes the emulator and the second one does not work.


ummm things are getting hard

try this for soul calibur 2 from codetwink

1-Hit Death P2
D03E531E 00004370
203E531C 3F800000

patch=1,EE,D03E531E,extended,00004370
patch=1,EE,203E531C,extended,3F800000

this code give an error/crash

vtlb miss: addr 0xD, mode 1


The code works only if I make it like this
patch=1,EE,003E531E,word,00004370
patch=1,EE,203E531C,word,3F800000

Using extended does not work.
 
#17 · (Edited)
I have borrowed soul calibur 2 from a friend and the code

patch=1,EE,D03E531E,extended,00004370
patch=1,EE,203E531C,extended,3F800000

works

patch=1,EE,003E531E,word,00004370
patch=1,EE,203E531C,word,3F800000

works also, but because the second line writes empty life for p2 and keeps writing it all the time the

patch=1,EE,D03E531E,extended,00004370

part works like a check to see if a battle is at the moment and only write empty life during battles.
----------------

Anyway try this other code
//P1 Needs 1 Win To Win
patch=1,EE,003D448C,word,00000000
patch=1,EE,003D448C,word,00000001

Start a Weapon Master game, and you will be unable to finish stage two because you will always have only one victory

and later this one
//P1 Needs 1 Win To Win
patch=1,EE,D03D448C,extended,00000000
patch=1,EE,003D448C,extended,00000001

Start a Weapon Master game, and you will be able to finish stage two because it checks that you have 0 victories to change it to 1, so in places of the game that the player needs 3 or more victories this code works
 
#18 ·
Bump?

So can anyone clarify what is the right way to do this? I can't get a code to work using anything, be it leaving it as is, decrypting it (with V7 support on and off), and using either word or extended phrases. Either the emulator crashes with a tlb miss (redlofredlof's way), or it runs, but with no effect (Pontifice's way).

I got one code to work using redlofredlof's way a while back. It's a simple single line one for Dragonball Z Budokai Tenkaichi 3 (max zeni), but trying to add a multi-line second cheat (all items), nothing is working.

Here is the page with the codes (it's the last code).

CodeTwink Network - Dragonball Z-Budokai-Tenkaichi 3 (PS2 Cheats)

Here is the code decrypted with V7 encryption (since I had to use it for my previous one).

Code:
E0021821 003998F8
20399900 24020001
20399904 A0822EC8
E0022021 0039B5D4
2039B5E4 24020001
2039B5E8 A0622EC8
Here it is without V7 encryption.

Code:
CBC83D43 A6FAD178
CCCFFD2C AC86D56D
A15ED413 1141F579
C95ED2A3 E417EFFE
86169D96 226E6870
36646825 CDB988B0
I tried the code the following ways (these are using the result from with V7 encryption on).

Code:
//all items
patch=1,EE,E0021821,word,003998F8
patch=1,EE,00399900,word,24020001
patch=1,EE,00399904,word,A0822EC8
patch=1,EE,E0022021,word,0039B5D4
patch=1,EE,0039B5E4,word,24020001
patch=1,EE,0039B5E8,word,A0622EC8

//all items
patch=1,EE,E0021821,extended,003998F8
patch=1,EE,20399900,extended,24020001
patch=1,EE,20399904,extended,A0822EC8
patch=1,EE,E0022021,extended,0039B5D4
patch=1,EE,2039B5E4,extended,24020001
patch=1,EE,2039B5E8,extended,A0622EC8

//all items
patch=1,EE,E0021821,byte,003998F8
patch=1,EE,20399900,short,24020001
patch=1,EE,20399904,word,A0822EC8
patch=1,EE,E0022021,byte,0039B5D4
patch=1,EE,2039B5E4,short,24020001
patch=1,EE,2039B5E8,word,A0622EC8
(I had no idea to determine whether to use byte, short, word, etc., because that was never explained, so I basically guessed).

I've tried others (like the non-V7 encryptions of the same thing, etc.), but you get the point.

redlofredlof's guide, while it seems to work most of the time, apparently isn't the correct way to do it. Could someone perhaps explain the correct way for the codes that don't seem to work with redlofredlof's method?
 
#19 ·
byte - values between 0-255(0-FF)
short - values between 0-65535(0-FFFF)
word - values between 0-4294967295(0-FFFFFFFF)
extended - that the only thing I don't know.

The E0 type is if a condition is met(or in most of the cases they are called just jocker codes)then to enable the code below.

BTW pcsx2 have problems with those type of codes so problems like those that you encounter can be expected.

Try it like this:
patch=1,EE,00399900,word,24020001
patch=1,EE,00399904,word,A0822EC8
patch=1,EE,0039B5E4,word,24020001
patch=1,EE,0039B5E8,word,A0622EC8
but remove the code as soon as possible because in this way the code is always on(both conditions are removed)
 
#25 ·
can some tell me how to use pnach cause i did everything and tryed to get the Infinite Zenni on DBZ Budokai Tenkaichi 3 and when i tryed to run it it just crashed

gametitle=Dragonball Z-Budokai-Tenkaichi 3 [SLUS 21678] (U) [428113C2]
comment=Patch by Code Master
//Max Zenni
patch=1,EE,6F420470,word,6F420470