Imposter
Chat Lobby Name Changing Subroutine
Release Date: 12 Dec 2008
Here it is, the long awaited imposter hack with the new added features of not
locking up your PSP and actually changing your name.
How to install:
Open your NitePr Cheat file for Killzone Liberation. Copy all 3 cheat sections
to your cheat file. Save your cheat file. Start the game.
How to use:
1. Wait until you get into the lobby.
2. Open NitePr, and turn the "Imposter_Name" and the "Imposter_Sub" cheats to
always on by pressing the square button. This will turn them blue.
3. Exit NitePr back to the lobby.
4. Activate and deactivate your cheats by pressing the music button twice. This
will load the name and subroutine.
5. Return to NitePr. Turn the "Imposter_Hook" cheat to toggle on by pressing
the cross or "X" button. Exit NitePr.
6. Toggle your cheats once by pressing the music button twice. Your name will
change in the lobby.
7. Turn off all Imposter Cheats. They only need to be run once per lobby.
How to make your own name:
1. Open NitePr, browse to the Cheater tab.
2. Select the Imposter_Name cheat and edit it by pressing the triangle button.
3. Press up and down on each digit to change it. You can see the letters on
the right. The digits go in the opposite of the letters so to edit the
first letter, change the fourth digit of the first line. The second letter,
the third digit, and so on.
The last character (the first hex number on the third line) must be 00.
4. Save the cheat.
How to make it permanent:
5. Write down the address (0x006FB000) and values of each of the three lines.
6. Replace the lines in your NitePr cheat file with what you copied down.
Multiple Names:
You can copy the Imposter_Name block as many times as you want and edit
each copy to be its own name. Obviously activating more than one at a time
will have unpredictable results. Just activate whichever name you want to
use with the sub.
Assembly:
This is the assembly language I wrote to make this particular cheat.
I commented it to make it easier to understand.
Code
Imposter_Sub:
addiu $sp, $sp, -80
# Preserve the registers
sw $ra, 0($sp)
sw $a0, 4($sp)
sw $a1, 8($sp)
sw $a2, 12($sp)
sw $a3, 16($sp)
# Store the address references
lui $a0, 0x08EF
ori $a0, $a0, 0xC000
sw $a0, 20($sp)
lui $a0, 0x08EF
ori $a0, $a0, 0xC010
sw $a0, 24($sp)
# Get the base pointer
lui $a0, 0x08DD
ori $a0, $a0, 0x6E1C
lw $a1, 0($a0)
or $a0, $a1, $zero
lw $a1, 0xF0($a0)
sw $a1, 28($sp)
# Abort if there is no base
beq $a1, $zero, getlost
nop
# Find the base address for the lobby
or $a0, $a1, $zero
lw $a1, 12($a0)
or $a0, $a1, $zero
lw $a1, 4($a0)
sw $a1, 32($sp)
nop
# Load the current name
or $a0, $a1, $zero
lw $a1, 16($a0)
sw $a1, 36($sp)
lw $a1, 20($a0)
sw $a1, 40($sp)
lw $a1, 24($a0)
sw $a1, 44($sp)
# Load the replacement name
lw $a0, 20($sp)
lw $a1, 0($a0)
sw $a1, 52($sp)
lw $a1, 4($a0)
sw $a1, 56($sp)
lw $a1, 8($a0)
sw $a1, 60($sp)
# Replace the name
lw $a0, 32($sp)
lw $a1, 52($sp)
sw $a1, 16($a0)
lw $a1, 56($sp)
sw $a1, 20($a0)
lw $a1, 60($sp)
sw $a1, 24($a0)
# Store the current value
lw $a0, 24($sp)
lw $a1, 36($sp)
sw $a1, 0($a0)
lw $a1, 40($sp)
sw $a1, 4($a0)
lw $a1, 44($sp)
sw $a1, 8($a0)
getlost: nop
# Restore registers
lw $a0, 4($sp)
lw $a1, 8($sp)
lw $a2, 12($sp)
lw $a3, 16($sp)
nop
# Call the jal
nop ## This line is replaced after assembly
nop
# Restore the return address and return.
lw $ra, 0($sp)
jr $ra
addiu $sp, $sp, 80
I assembly my programs using a program called MARS. A java based MIPS
simulator. Pretty cool machine and an excellent way to learn MIPS. I take
the dump of the assembled program and dump it as a series of hex digits, one
word per line. I then replace the jal line with a generated jal for whichever
hook I am using.
Next, I put this hex output into an Excel spreadsheet that I wrote with
formulas to automatically line number and format it for NitePr. If you are
interested in either MARS, or this silly spreadsheet, let me know.
Anyways, the result is 3 cheats for NitePr. And the desired hack that so
many people have been begging me for.
Code
0x006FB084 0x8fa40014
0x006FB088 0x8c850000
0x006FB08C 0xafa50034
0x006FB090 0x8c850004
0x006FB094 0xafa50038
0x006FB098 0x8c850008
0x006FB09C 0xafa5003c
0x006FB0A0 0x8fa40020
0x006FB0A4 0x8fa50034
0x006FB0A8 0xac850010
0x006FB0AC 0x8fa50038
0x006FB0B0 0xac850014
0x006FB0B4 0x8fa5003c
0x006FB0B8 0xac850018
0x006FB0BC 0x8fa40018
0x006FB0C0 0x8fa50024
0x006FB0C4 0xac850000
0x006FB0C8 0x8fa50028
0x006FB0CC 0xac850004
0x006FB0D0 0x8fa5002c
0x006FB0D4 0xac850008
0x006FB0D8 0x00000000
0x006FB0DC 0x8fa40004
0x006FB0E0 0x8fa50008
0x006FB0E4 0x8fa6000c
0x006FB0E8 0x8fa70010
0x006FB0EC 0x00000000
0x006FB0F0 0x0E201953
0x006FB0F4 0x00000000
0x006FB0F8 0x8fbf0000
0x006FB0FC 0x03e00008
0x006FB100 0x27bd0050
#Imposter_Hook
; Snagged from the HAXER hack by Twist3d.
0x002C4344 0x0E3BEC00
Now if you are the modder type, careful. This bad boy will blow to crap if you
try to mod it without knowing what you are doing. The result will be a locked
up PSP which will power off. It sucks and is a pain. This is the reason that
I provided the assembly language and build routine. If you want to mod the
hack, understand it first.
I am now working on a Marquee scroller for the chat lobby allowing a scrolling
message where your name would appear in the chat lobby. These are some things
you can do with the subroutine skeleton that I wrote earlier.
