Here are the fixed patches for Spyro 3 and Sydney 2000 UK. I kinda stole the trick from @krHACKen to use the labels in the ELF file to inject own code. Codes are adapted from the Babydock original patches from 2000, I hope he doesn't mind. All patches were tested only in the no$psx for the code validation. So any further testing is welcomed.
Spyro 3 was hard to find unreferenced and consecutive labels for the code injection. I had to jump between two places in the executable file anyway. To check if the Libcrypt is passed, you need to go to the Sheila level. To trigger the crack protection, according to the various sources, 500 gems need to be collected and (or?) skateboard challenge passed. As long as the Zoe does not notice you about a hacked copy, then the patch is working correctly. Data are patched after the first decryption and the original values are restored after the encryption. The place where the jump is made does not seem to be checked by the game until the own code is executed.
Sydney 2000 does use a few code overlays. The memory does change after the booting of game, during the loading of menus, events, gyms, etc. The check is performed before the first loading screen, and the BPC register is cleared. It does look suspicious to me, but I haven't encountered any other checks in game (or maybe I haven't played enough, I suspect one minute is not enough probably). There is a different MW routine in the memory when the menu is loaded, but it does not seem to be executed and is replaced with the different code during the loading of event. That is why the original PDX patch is not working correctly, because it does patch that offset after a new code overlay is loaded, glitching the graphics completely. It would be good to test this game extensively too, but I bet nobody would be willing to destroy his gamepad because of all that stupid button mashing.
After all, the Sydney 2000 does look like a LC2 routine to me, not LC3 one.
Spyro 3 was hard to find unreferenced and consecutive labels for the code injection. I had to jump between two places in the executable file anyway. To check if the Libcrypt is passed, you need to go to the Sheila level. To trigger the crack protection, according to the various sources, 500 gems need to be collected and (or?) skateboard challenge passed. As long as the Zoe does not notice you about a hacked copy, then the patch is working correctly. Data are patched after the first decryption and the original values are restored after the encryption. The place where the jump is made does not seem to be checked by the game until the own code is executed.
Sydney 2000 does use a few code overlays. The memory does change after the booting of game, during the loading of menus, events, gyms, etc. The check is performed before the first loading screen, and the BPC register is cleared. It does look suspicious to me, but I haven't encountered any other checks in game (or maybe I haven't played enough, I suspect one minute is not enough probably). There is a different MW routine in the memory when the menu is loaded, but it does not seem to be executed and is replaced with the different code during the loading of event. That is why the original PDX patch is not working correctly, because it does patch that offset after a new code overlay is loaded, glitching the graphics completely. It would be good to test this game extensively too, but I bet nobody would be willing to destroy his gamepad because of all that stupid button mashing.
After all, the Sydney 2000 does look like a LC2 routine to me, not LC3 one.
