Creating a PSP FreeCheat Memory Patch

FreeCheat is a memory editor and cheat device (like Action Replay) for the PSP. It includes features like a live in-game memory viewer and searcher. One of the feature that intrigued me is the memory patcher. I had no idea what it does, but I assume it does what it says: patches the memory. Problem is: I’ve searched everywhere, but there seems to be no information on how to create a FreeCheat memory patch for the PSP (only .pat files for Monster Hunter). Well, it’s not that hard. After some trial and error, I’ve found out how to create a FreeCheat .pat memory patch. Note that the following should only be attempted by a person with enough technical knowledge to understand it.

To create a memory patch, first you need to find out what you want to patch. I suggest using FreeCheat’s own memory searcher to find the memory location. Another method if using FreeCheat to dump the memory to a file, and open it on your computer with a hex editor. Once you find something you want to replace, look at the address. On FreeCheat, this is the hex number on the bottom left of the memory viewer box. On your hex editor, it should be listed as “address” or “offset”. This should be between 0×0000000 and 0x017FFFFF. Now take this number and add 0×08800000 (hex math please) to it.

You can now create a new file in your hex editor to be the patch. The first four bytes in the file is the memory offset (that you found) in big endian form. The problem is that the offset you found is a little endian number. You need to convert it to a big endian number. Most hex editors allows something like this. I use 0xED on OSX, so on there (make sure it’s set to Edit->Number Mode->Little Endian!), I would type in 00000000, highlight it, and under “32 bit unsigned”, I would paste in the offset I found and it would convert it automatically. Then in the rest of the hex document, fill in whatever you want to replace the memory with. Save this as a .pat file and copy it to your PSP at /FreeCheat/PATCH and on the PSP, open up FreeCheat, go to MEM Manager and Load MEM Patch.

Load Creative Zen V Plus’s firmware on your Zen V

So thanks to a Napster promotion, I’ve got a free 1GB Creative Zen V. If you know anything about me, you’d know that the first thing I did was pop open IDA Pro, and see what I can make this device do that it’s not made for doing. After some quick Googleing, I’ve noticed there’s no modifications or anything for this POS music player. However, I did notice that Creative sells a higher priced player that plays videos too. Anyways, enough talk, here’s how to turn your Zen V to a Zen V Plus (NOTE: You still won’t get radio because it’s not in the hardware)

Directions:

  1. Download the ZEN V Plus firmware 1.32.01 here. It’s last update was in 07, so I don’t think there’s going to be a newer version, but if there somehow is, follow the “DIY” instructions in the next section to do it manually.
  2. Make a copy of the ZENVPlus_PCFW_L22_1_32_01.exe file you just downloaded. Name it ZENV_Patch.exe.
  3. Patch ZENV_Patch.exe with this IPS file using any IPS patching utility.
  4. Run ZENV_Patch.exe and let it reboot your Zen V.
  5. Now, you should be getting an error on the device. THIS IS NORMAL. The firmware update should fail and put you in recovery mode.
  6. In recovery mode on the Zen, choose “Reload Firmware”
  7. Now, on your PC, force quit ZENV_Patch.exe and open up ZENVPlus_PCFW_L22_1_32_01.exe
  8. Wait until the update is done, and your Zen V is now a Zen V Plus!

DIY

Now, how does this work? Well, basically the first “firmware update” with ZENV_Patch.exe makes the device think it’s a Zen V Plus, and the second update with the official file actually copies the firmware on. ZENV_Patch.exe is just the Zen V Plus updater hex-edited to run on the Zen V. You can make your own ZENV_Patch.exe by taking the official update, opening a HEX editor, and replacing every instance of “C.r.e.a.t.i.v.e. .Z.e.n. .P.l.u.s” to “C.r.e.a.t.i.v.e. .Z.e.n” (Please note that the periods represent the ASCII character 00 (null)). After doing so, the updater will accept the Zen V.

Now, maybe one day, I’ll port RockBox or something to it…