
   ELF Search Tool 1.05 by pelvicthrustman    
______________________________________________

ELF Search Tool is designed to provide a fast
method of locating hex data patterns and
generating memory patches for PS2 ELF files.

ELF Search Tool is free software and is
provided with NO WARRANTY to the extent
permitted by law.
______________________________________________

Table of Contents
___________________

I   Selecting an ELF
II  Search pattern options
III Search & Replace patterns
IV  Result format options
V   Searching an ELF
VI  Saving results
___________________

I Selecting an ELF
___________________
  
- Click the "Browse" button and navigate to
  the root directory of the game disc, then
  select the file (only the appropriate file
  should be visible).
  Note: On Widows XP SP2 and older some ELF
  files may not be visible, in this case
  select "All Files" and look for the file
  named: SXXX_###.##, where X's are letters
  and #'s are numerals.
  
- Drag the ELF file from the file browser
  over the ELF Search Tool Window.
___________________

II Search pattern options
___________________
  
- Endian
  
  This option allows you to select the
  "endianness" of Search/Replace
  data patterns.
  
  The "endianness" of data is the order of
  its significant digits; numbers are
  normally written with the most significant
  digit first, this is called "big" endian
  format. When numbers are written with
  the least significant digit first they
  are called "little" endian. While big
  endian is the most common format data
  copied from hex editors is usually little
  endian.
  
  - If Big is selected the Search/Replace
    patterns are interpreted as big endian.
    
  - If Little is selected the Search/Replace
    patterns are interpreted as little endian.

- Alignment
  
  When searching for data patterns this
  option specifies how often the pattern
  is compared against the ELF file's data.
  
  Since some data may have a known alignment
  (ELF instructions are Word aligned) this
  option can help reduce the number of
  erroneous search results.
  
  In the MIPS r5900 (PS2 EE) architecture
  - byte is 8-bits (2 hex digits)
  - half word is 16-bits (4 hex digits)
  - word is 32-bits (8 hex digits)
    
  - If Byte is selected then the Search 
    pattern will be compared to the ELF
    file's data at every byte in the file.
    Note: This is the standard hex editor
    behavior.
    
  - If Half Word is selected then the
    Search pattern will be compared to the
    ELF file's data at every other byte in
    the file.
    
  - If Word is selected then the Search
    pattern will be compared to the ELF
    file's data at every fourth byte in
    the file.
  
  Note that when generating patches with
  the PNACH or RAW Code result formats
  Alignment is automatically set to Word.

- Range
  
  ELF files contain segments which are
  marked to define their behavior.
  ELF Search Tool only searches segments
  which are set to be loaded into memory.
  Some of these segments are marked as
  containing executable code, while others
  are marked as containing data. 
  
  - If Executable is selected only segments
    marked as executable are searched.
    
  - If Non-Executable is selected only
    segments NOT marked as executable are
    searched.

  Note that while executable code is
  only present in the executable range
  non-executable data may be present
  in either range.
___________________

III Search & Replace patterns
___________________

ELF Search tool loads data patterns from
the Search and Replace fields to search
and create patches for ELF files.
Text files can be loaded into these using
the Load Search Patterns and
Load Replace Patterns buttons.

Search and data patterns contain
hexadecimal data strings, these are
interpreted with the following rules:
  
- Each line is a different pattern
- Blank lines are ignored
- Space and tab characters are
  ignored and may be present
  between digits
- Only characters 0-9,a-f,A-F,x,X,*
  are considered digits; if any
  other character appears on a
  line that character is considered
  the end of the line
- If an uneven number of digits is
  specified (ex: 4AA35) the last
  digit is ignored as it requires
  two digits to define a byte
- Patterns of less than four bytes
  are ignored
  
Patterns may be defined with a bitmask
to allow for partial binary comparisons.
For an explanation of bitmasking see:
http://en.wikipedia.org/wiki/Mask_(computing)

The default bitmask is always a corresponding 
'F' or 1111 for each digit in a pattern,
there are two methods to redefine the bitmask:

Writing the 'x' or 'X' character in a pattern
sets the pattern data to zero and the pattern
mask to zero - thus the pattern effectively
ignores that hexadecimal digit, for example:
     pattern: ABCD1XX4
     data:    ABCD1004
     mask:    FFFFF00F

Writing '*' into the pattern causes the next
digit read to be used as the bitmask for
the character following that, for example:
     pattern: A*1B*2CD1234
     data:    ABCD1234
     mask:    F12FFFFF
___________________

IV Result format options
___________________

These options effect the function of the 
Search button as well as the format of
results displayed in the Result field.
  
- If Address is selected the Replace
  field is ignored and the ELF file is
  searched for patterns specified in the
  Search field, results are displayed
  one result per line as the address in
  memory where the pattern appears.
  A comment is placed next to the address
  indicating the actual data at that address.
  
- If Offset is selected the Replace
  field is ignored and the ELF file
  is searched for patterns specified in
  the Search field, results are displayed
  one result per line as the file offset
  where the pattern appears. A comment 
  is placed next to the offset indicating
  the actual data at that offset.
  
- If PNACH is selected both the Search
  and Replace fields must contain
  the same number of patterns and each
  pattern must have the same effective
  length which must be a multiple of
  four bytes (words). Results are displayed
  in PNACH (pcsx2 patch file) format.
  Each line contains an address/data pair
  for one word in a pattern, words which
  are identical in both the search and
  replace patterns are ignored. A comment 
  is placed next to each line indicating
  the original data at that address. When
  saving results from PNACH searches by
  pressing the Save button the default
  file name will be the CRC of the ELF.
  
- If RAW Code is selected both the Search
  and Replace fields must contain
  the same number of patterns and each
  pattern must have the same effective
  length which must be a multiple of
  four bytes (words). Results are displayed
  in RAW (unencrypted) cheat format.
  Each line contains an address/data pair
  for one word in a pattern, words which
  are identical in both the search and
  replace patterns are ignored. A comment 
  is placed next to each line indicating
  the original data at that address.
  
  Note: Comments included in the output
  begin with the characters '//'. Data in
  comments is displayed in big endian format.
___________________

V Searching an ELF
___________________
  
- Press the Search button to begin a search.
___________________

VI Saving results
___________________
  
- Press the Save button to save the contents
  of the Result field.
  