GameLabo has released a game SaveData editor for the PSP. This editor is capable of editing your SaveData, to gain higher Level and HP, better items and unlocked special videos. You will need special "cheat codes" to edit every game you wish to. The codes will start to be published on the Japanese magazine "Game Labo", 3rd issue of year 2006. But still, the author has included a very detailed but hardcore tutorial with the tool. Here come the details:
System version 1.00 and 1.50 are the best. It is possible to start this program on 2.00, but some limitations can happen. 1.51 and 1.52 users should upgrade to 2.00 and then downgrade to 1.50. PSP with 2.01 or higher system software are not supported.
PC and USB cable (or Memory Stick adapter) for copying Laboko into your PSP
Copy the folders from the archive.
PSP/GAME/LABOKO% EBOOT for 1.00 and 2.00 goes here
PSP/GAME/LABOKO EBOOT for 1.50. Better not to copy this for 1.00 and 2.00
Then start it from Game -> Memory Stick in the PSP main interface.
Running on 2.00
You can try running this program on 2.00 using the EBOOT Loader v0.9. Copy only PSP/GAME/LABOKO%/EBOOT.PBP. When prompted for kernel mode, press X to continue. Due to some problems on the Loader side, the program can be somehow unstable. UMD launching and USB disk mode functions contains too many problems, better not to use them on 2.00.
How to use – Code:
When running Laboko, please don’t remove your Memory Stick.
You can enter code continuously, but better not enter an ultra-long code.
Gamelist.txt is not contained in this package.
Laboko can be unstable when there are too many SaveData entries.
UMDs may not be started always. Please check the required Firmware version in advance.
Controls in dump screen:
Circle: Enter "Edit Mode".
Cross: Return to "Browse Mode" from "Edit Mode".
Start: "Search" anything you want to. When finished, use L and R to jump to previous/next found entry.
Select: Close the opened view of a file.
When having 2 files opened at the same time, press Sqare+L or Square+R to jump among inconsistent bytes.
– About PSP SaveData
The PSP SaveData is decrypted, and can be managed in the PSP system. There are 3 confirmed ways for handling (parameter constructor) the SaveData in the system, and 2 types of data (PARAMS type) by Jan 2006. Newer systems can also use older types.
Constructor Size PARAMS PSP System
0x5c8 0x01 1.00-
0x5dc 0x01 1.50-
0x600 0x21 2.00-
Software released for 2.00 and higher uses a new type (PARAMS Type 21), which uses a unique gamekey for each game. Without this gamekey, decryption and encryption is impossible. However, a part of 2.00+ required games are still using PARAMS Type 01. Laboko has some of the gamekeys embedded already.
But, even you can decrypt the SaveData, you still can’t just start editing the data immediately, since sometimes, a game will run consistency checks on the SaveData. When you modified the SaveData of a game requires such checks, and tried to load it in the game, a message saying "The file is corrupt." can be displayed. Though you may still be able to see it in the SaveData instead of "Corrupted data", the SaveData has already fallen into an unrecognizable state to the game. To support such games, we need a way to breach the consistency checks. Let’s take "Monster Hunter Portable" as an example. Laboko will generate a check code automatically when saving the modified data.
Still, no only the PSP system, but the game itself may commence encryption on the savedata on its own. Under these cases, you must offer support to this encryption, like for Ys. Laboko doesn’t support such games currently.
The form of the codes:
Laboko's codes are just machine codes. The parsing of the code works like a 4–bit CPU, all in hexadecimal.
<Laboko's code> ::= <command> <command> ...
Each command consists of 1 op code (what to do) and several operands (data to use). In some cases there can be not operand at all.
<command> ::= <op code> [ <operand> [ <operand>[...] ] ]
Currently there are only 3 types of op codes ><
Op Code Process Operands
0 Do nothing None
1 Write data 2: Address & Data
20 Serial code 5: Start Address, Start data,
Address increment, data
increment, repeat times
The value of the Operands can be assigned now.
1st Bit of Operand Continued Bits Description
0 0 0 (bit)
2 1 nibble *4-bit
3 2 byte *8-bit
4 4 short *16-bit
5 8 long *32-bit
Here are some examples of operands:
0 0 (bit)
23 0x3 (nibble)
345 0x45 (byte)
45678 0x5678 (short)
56789abcd 0x6789abcd (long)
Commands should look like this:
0 do noting
13aa0 write data 00 at address aa
14aaaa3dd write data dd at address aaaa
14aaaa4xxyy write byte value yy xx orderly
from address aaaa
15aaaaaaaa4xxyy write byte value yy xx orderly
from address aaaaaa
14aaaa5xxyyzzww write byte value ww zz yy xx orderly
from address aaaa
204aaaa3dd3bb3ee3cc from address aaaa, use dd as
the initial data, bb as address
increment, ee as data increment,
write cc times
Data is written in LSB first. Opcode 1 means to divide the data into bytes. Serial code must be consistent when defining start data and increment, such as byte, short or long. Inconsistency is not acceptable. Repeat times can range from 1 to 0x1000.
To reflect all the points mentioned above, the codes should look like this:
100 write data 00 to address 0.
1420205000f423f write data 000f423f to address 2020.
2020<-3f, 2021<-42, 2022<-0f, 2023<-00
204123431021301320 start at address 1234, initial data 10,
address increment 1, data increment 01,
repeat 20 times, write in.
It may be fine to input them continuously:
write data 00 to address 0.
write data 000f423f to address 2020.
start at address 1234, initial data 10, address increment 1, data increment 01, repeat 20 times, write in.
In serial codes, the initial data and data increment must be consistent as byte, short or long. When using 0 or nibble as data type, the initial and increment is unnecessary, and will lead to errors.
– About SH Code (Hash Code)
When entering and selecting codes, something like SH000 will be shown. This is the hash of each code. When it is conflicting with others (same hash with other codes), please endure it. This hash cannot be inputted manually currently, but we have implemented it, because we think it may become useful later. When facing a conflict, just add 0 at the end of the code to make the hash change.