gh-Pharaoh2k/ps5debug-NG

Watch

Fork 0

FW 11.60 / RE2 v01.000.003 - RDWR watchpoints trigger, WRONLY does not - guidance needed for permanent patch workflow #16

New issue

Closed

opened 2026-06-03 20:49:15 -05:00 by farscaper11 · 2 comments

farscaper11 commented

2026-06-03 20:49:15 -05:00

(Migrated from github.com)

Hi Pharaoh2k,

I wanted to provide a detailed update on my testing with Resident Evil 2 (CUSA04288) v01.000.003 on PS5 FW 11.60 using ps5debug-NG v1.2.7.

PS4 Cheater Testing

I started by locating the handgun ammo value through normal scans in PS4 Cheater.

Example:

Started with 7 rounds in the handgun.
Fired shots and narrowed the value down through successive scans.
Successfully identified the ammo address.
Changed the value manually from 3 back to 7 and confirmed the ammo immediately returned in-game.
Changed the value to 50 and confirmed the ammo count changed to 50 in-game.
Enabled lock/freeze and confirmed the ammo stayed at 50 while firing.

This confirms that on FW 11.60 with ps5debug-NG v1.2.7:

Memory reads work.
Memory writes work.
Live value editing works.
Freeze/lock works correctly.

Reaper Studio Testing

Using the live ammo address found by PS4 Cheater, I attached Reaper Studio and began testing watchpoints.

WRONLY Watchpoints

I tested:

WRONLY LEN_1
WRONLY LEN_4

Result:

Ammo decreased normally while firing.
Watchpoint never triggered.
No breakpoint information was generated.

RDWR Watchpoints

I then switched to RDWR.

Result:

The watchpoint immediately triggered.
Reaper froze execution and populated the breakpoint information window.
Register information and disassembly information were captured successfully.

Example instructions captured:

mov eax,dword ptr [rdx+0x20]

and

cmp dword ptr [rcx+0x20],0

The registers resolved correctly to the live ammo structure.

Example values observed:

RCX = 0x2415FC8F0

RCX + 0x20 = 0x2415FC910

which matched the active ammo address being tracked by PS4 Cheater.

Additional Observations

Reaper successfully attaches to the game.
RDWR watchpoints trigger consistently.
Breakpoint information populates correctly.
Register information populates correctly.
Disassembly populates correctly.

However:

WRONLY watchpoints never seem to trigger when ammo decreases.
RDWR triggers on access/read operations before I can identify the actual decrement/write instruction.
Reset does not always resume the game correctly after a breakpoint.
Detaching the debugger consistently resumes gameplay.
In one case the game remained stuck on a loading screen after a breakpoint until the debugger was detached.

Current Status

At this point I have confirmed:

ps5debug-NG v1.2.7 is reading memory correctly.
ps5debug-NG v1.2.7 is writing memory correctly.
PS4 Cheater freeze/lock functionality works correctly.
Reaper Studio can attach and debug the process.
Reaper Studio can trigger and capture watchpoints.
I can identify instructions accessing the ammo structure.

The remaining step appears to be tracing from the accessed value to the actual instruction that decrements or writes the ammo value so a permanent patch can be created.

One additional thing I noticed while documenting my setup:

I am currently using Reaper Studio v1.0.4.1.

While reviewing the GitHub releases, I noticed that Reaper Studio v1.0.4.2 (Beta 4.2) and MultiTrainer2 v1.1.8.2 (Beta 8.2) are available.

Before I continue deeper into debugging, do you think it's worth upgrading to Reaper Studio v1.0.4.2 first? I noticed several watchpoint, breakpoint, and debugger-related fixes in the changelog, so I'm wondering if some of the behavior I'm seeing may already be addressed in the newer release.

Also, sorry for asking, but would it be possible to provide a brief workflow or instructions document for the intended Reaper Studio process from this point? I don't want to keep bothering you with basic questions, and having a guide for tracing an accessed value to the actual decrement/write instruction would help me continue testing and provide more useful feedback.

If upgrading to v1.0.4.2 is recommended before continuing, I'm happy to do that and retest everything from the beginning.

Thanks again for all your work on ps5debug-NG and for taking the time to answer questions from testers like me.

Hi Pharaoh2k, I wanted to provide a detailed update on my testing with Resident Evil 2 (CUSA04288) v01.000.003 on PS5 FW 11.60 using ps5debug-NG v1.2.7. ### PS4 Cheater Testing I started by locating the handgun ammo value through normal scans in PS4 Cheater. Example: * Started with 7 rounds in the handgun. * Fired shots and narrowed the value down through successive scans. * Successfully identified the ammo address. * Changed the value manually from 3 back to 7 and confirmed the ammo immediately returned in-game. * Changed the value to 50 and confirmed the ammo count changed to 50 in-game. * Enabled lock/freeze and confirmed the ammo stayed at 50 while firing. This confirms that on FW 11.60 with ps5debug-NG v1.2.7: * Memory reads work. * Memory writes work. * Live value editing works. * Freeze/lock works correctly. ### Reaper Studio Testing Using the live ammo address found by PS4 Cheater, I attached Reaper Studio and began testing watchpoints. #### WRONLY Watchpoints I tested: * WRONLY LEN_1 * WRONLY LEN_4 Result: * Ammo decreased normally while firing. * Watchpoint never triggered. * No breakpoint information was generated. #### RDWR Watchpoints I then switched to RDWR. Result: * The watchpoint immediately triggered. * Reaper froze execution and populated the breakpoint information window. * Register information and disassembly information were captured successfully. Example instructions captured: mov eax,dword ptr [rdx+0x20] and cmp dword ptr [rcx+0x20],0 The registers resolved correctly to the live ammo structure. Example values observed: RCX = 0x2415FC8F0 RCX + 0x20 = 0x2415FC910 which matched the active ammo address being tracked by PS4 Cheater. ### Additional Observations * Reaper successfully attaches to the game. * RDWR watchpoints trigger consistently. * Breakpoint information populates correctly. * Register information populates correctly. * Disassembly populates correctly. However: * WRONLY watchpoints never seem to trigger when ammo decreases. * RDWR triggers on access/read operations before I can identify the actual decrement/write instruction. * Reset does not always resume the game correctly after a breakpoint. * Detaching the debugger consistently resumes gameplay. * In one case the game remained stuck on a loading screen after a breakpoint until the debugger was detached. ### Current Status At this point I have confirmed: * ps5debug-NG v1.2.7 is reading memory correctly. * ps5debug-NG v1.2.7 is writing memory correctly. * PS4 Cheater freeze/lock functionality works correctly. * Reaper Studio can attach and debug the process. * Reaper Studio can trigger and capture watchpoints. * I can identify instructions accessing the ammo structure. The remaining step appears to be tracing from the accessed value to the actual instruction that decrements or writes the ammo value so a permanent patch can be created. One additional thing I noticed while documenting my setup: I am currently using Reaper Studio v1.0.4.1. While reviewing the GitHub releases, I noticed that Reaper Studio v1.0.4.2 (Beta 4.2) and MultiTrainer2 v1.1.8.2 (Beta 8.2) are available. Before I continue deeper into debugging, do you think it's worth upgrading to Reaper Studio v1.0.4.2 first? I noticed several watchpoint, breakpoint, and debugger-related fixes in the changelog, so I'm wondering if some of the behavior I'm seeing may already be addressed in the newer release. Also, sorry for asking, but would it be possible to provide a brief workflow or instructions document for the intended Reaper Studio process from this point? I don't want to keep bothering you with basic questions, and having a guide for tracing an accessed value to the actual decrement/write instruction would help me continue testing and provide more useful feedback. If upgrading to v1.0.4.2 is recommended before continuing, I'm happy to do that and retest everything from the beginning. Thanks again for all your work on ps5debug-NG and for taking the time to answer questions from testers like me.

OpenSourcereR-dev commented

2026-06-03 23:35:54 -05:00

(Migrated from github.com)

mov eax,dword ptr [rdx+0x20]

and

cmp dword ptr [rcx+0x20],0

Please try watching other addresses that are actually being written to.
This is most likely not a ps5debug-NG issue. Kindly report after further testing.

Thank you for the detailed info. Yes, using Reaper Studio v1.0.4.2 (Beta 4.2) and MultiTrainer2 v1.1.8.2 (Beta 8.2) is highly recommended. The address you're watching is most likely only being read, not written to, as can be seen in your captured instructions: ``` mov eax,dword ptr [rdx+0x20] and cmp dword ptr [rcx+0x20],0 ``` Please try watching other addresses that are actually being written to. This is most likely not a ps5debug-NG issue. Kindly report after further testing.

OpenSourcereR-dev commented

2026-06-07 02:42:31 -05:00

(Migrated from github.com)

User tests determined this to be most likely caused by environment issues, not ps5debug-NG.
User was unable to reproduce the issue after several payload updates.
If the user can isolate the culprit, that would help. Issue is closed for the time being.

User tests determined this to be most likely caused by environment issues, not ps5debug-NG. User was unable to reproduce the issue after several payload updates. If the user can isolate the culprit, that would help. Issue is closed for the time being.