IW4 Binary Patches

The project documents native script compilation, a custom-map loader, compatibility improvements, and fixes for game stability and malformed network messages.

How it started:

I came back to playing my favorite game after all these years and lost all my progress due to an account change with playstation accounts at Sony. That started me down a path of investigating a way to fix it. In addition, a friend of mine in the modding community requested that I try and figure out a way how to return the gsc compiler back into the game, which was a script compiler used to change runtime properties of the game. Little did I know this game was riddled with malicious users.

The ELF Format:

The PlayStation 3 uses the ELF (Executable and Linkable Format) to organize executable code, memory, and program data. Its Cell processor uses a PowerPC-based CPU alongside specialized processors for parallel computing. PS3 executables are typically packaged as encrypted SELF files, which must be decrypted to analyze the underlying ELF. Reverse engineering tools like Ghidra help translate compiled PowerPC instructions into readable code, allowing developers to reconstruct functions, understand memory structures, and determine how the original software operates without access to its source code.

Account Fix:

I had looked into the community to see if any existing fixes were there, there was a man by the name of VirusMike that had used an SPRX (think of it as a application library) to save stats locally to the hard drive, then load the stats when you booted the game again. It was a clever fix; but I wanted to get to the root of the problem. What I uncovered was that the client must seed its existing `dwGetOnlineUserID` cache with the server-issued `bdAuthTicket.user_id` when PS3 Demonware authentication succeeds. This aligns stats reads, leaderboards, and related identity consumers with the authenticated Demonware principal.

Stock TU 1.14 derives its online user ID from the mutable PSN Online ID:
1. `FUN_002F7D78` obtains `SceNpId` through `sceNpManagerGetNpId` at import stub `0x0050F544`.
2. `FUN_0030E5C8` copies up to 16 bytes from `SceNpId.handle.data`. Those bytes are the PSN Online ID text, not a stable numeric account ID.
3. `FUN_0030E690` (`dwGetOnlineUserID`) calls `0x004C7B58 -> FUN_003F2688` on a cache miss.
4. `FUN_003F2688` lowercases the name, hashes it with Tiger192, takes the first eight digest bytes, reverses them, and returns that name-derived `u64`.
5. `0x0030E748..0x0030E750` stores the result in the online-user cache.

Cache details:
- Pointer cell: `0x0072BACC`
- Stock cache address: `0x020AEFE0`
- Valid byte: cache `+0x04`
- Cached `u64` user ID: cache `+0x08`

The incorrect identity is applied directly to the remote stats read path:
- `FUN_0030DFF0` calls `dwGetOnlineUserID` at `0x0030E034`.
- It passes that `u64` to `0x004C8818 -> FUN_004028C8` at `0x0030E078`.

The remote writes at `0x0030D3B8` and `0x0030D6FC` have no owner-ID argument. Their wire/API shape is therefore consistent with binding writes to the authenticated session principal, while stock reads are explicitly keyed by the locally name-derived ID; replacing the read-side cache value with `bdAuthTicket.user_id` restores persistence.

The affected condition is that the legacy name hash does not equal the Demonware principal. This is observed with post-2018/new-name and renamed PSN accounts; the date alone is not the identity rule.

GSC Compiler:

My biggest challenge was bringing custom scripting back to Modern Warfare 2 on PS3 while staying compatible with players running the stock 1.14 update. I adapted an older script compiler to work inside the newer game, preserving the networking behavior that standard clients depended on. The PS3’s limited memory made this especially demanding, so I used a keyhole optimizer to help reduce the added code’s footprint and fit it alongside the existing game.

The result allowed me to run custom patches written in GSC, the game’s scripting language, again. Scripts could be loaded from standard patch files and compiled directly by the game, restoring a familiar way to add features and change gameplay. I confirmed it worked on real PS3 hardware by loading a match, spawning a player, and successfully running my Jacob Patch v2.

Security Patches:

Playing Modern Warfare 2 on PS3 could mean dealing with malicious players who froze your PlayStation, disrupted matches through forced teleportation, or exploited weaknesses to make the game run unauthorized code. I built IW4-Binaries to address the security problems behind this abuse and help make online multiplayer a more comfortable, dependable experience.

I patched known vulnerabilities and added protections that reject harmful messages, handle unsafe game data, and block unauthorized actions that could crash the game or interrupt matches. These fixes preserve normal online play while closing the documented attack paths, giving players greater peace of mind and more freedom to focus on enjoying the game.

You can read a full write up here: https://github.com/jacob-schroeder/IW4-Binaries/blob/main/README.md.