[Discussion] 60FPS patches for PSP games that run at 30FPS

[GamerzHell9137]

(03-17-2015 02:10 AM)LunaMoo Wrote:  It is wrong, because 15 fps is an accidental result of treating in-game by code which should apply for fmv's only.
Generally comparing different things is not a way I would recommend, because without suprise they work differently. 60fps is really easy to unlock in those (like pretty much all) games if you check properly how the game works in the place of your interest(in-game) and how it's forcing the 30fps. You don't even have to use any external tools for that, ppsspp disassembly is all that's needed, here's a small proof:

And that took me like 5s just because I already knew how to do it in MHp3rd HD and they are all using same engine. But don't be too happy seeing that.

The thing is "making the game run at 60 fps" is NOT enough to patch most games, since only a few does work properly after patching it. For example those Kingdom Hearts games which started it or Project Diva and few others, you just remove framelimiting part and voila - it works perfectly without any more work.
In most games through doing that will leave game running at double speed and we have to find a way to change the speed back which sometimes can still be easy as some games were designed for 60 fps and after limiting it to 30 they simply doubled the speed of everything by a single function like for example in Assassin's Creed or Ghost in the Shell.
Others and I think most "hunting" games are example of it, might had been designed for 30fps and don't seem to have any main function which affects speed of everything, but instead set speed of many things separately by lots of different constants scattered into many functions ~ and that is which makes it really hard/time consuming to patch fully, just as with my Toukiden Kiwami patch which still has some minor animations running at twice the speed.

It's certainly not impossible, but and I would say that for all games which doesn't have 60fps yet, if you really want it done, try to learn a bit and do it yourself. Everyone is different, try different things, have different ideas and might succeed where others already gave up.

So where do we start researching it?
I would give it a try if i knew where to start.

And maybe you could show us how you hacked Diva and those other games with frame limiting (please?) ?

[cybercjt]

(03-17-2015 06:01 AM)GamerzHell9137 Wrote:  

(03-17-2015 02:10 AM)LunaMoo Wrote:  It is wrong, because 15 fps is an accidental result of treating in-game by code which should apply for fmv's only.
Generally comparing different things is not a way I would recommend, because without suprise they work differently. 60fps is really easy to unlock in those (like pretty much all) games if you check properly how the game works in the place of your interest(in-game) and how it's forcing the 30fps. You don't even have to use any external tools for that, ppsspp disassembly is all that's needed, here's a small proof:

And that took me like 5s just because I already knew how to do it in MHp3rd HD and they are all using same engine. But don't be too happy seeing that.

The thing is "making the game run at 60 fps" is NOT enough to patch most games, since only a few does work properly after patching it. For example those Kingdom Hearts games which started it or Project Diva and few others, you just remove framelimiting part and voila - it works perfectly without any more work.
In most games through doing that will leave game running at double speed and we have to find a way to change the speed back which sometimes can still be easy as some games were designed for 60 fps and after limiting it to 30 they simply doubled the speed of everything by a single function like for example in Assassin's Creed or Ghost in the Shell.
Others and I think most "hunting" games are example of it, might had been designed for 30fps and don't seem to have any main function which affects speed of everything, but instead set speed of many things separately by lots of different constants scattered into many functions ~ and that is which makes it really hard/time consuming to patch fully, just as with my Toukiden Kiwami patch which still has some minor animations running at twice the speed.

It's certainly not impossible, but and I would say that for all games which doesn't have 60fps yet, if you really want it done, try to learn a bit and do it yourself. Everyone is different, try different things, have different ideas and might succeed where others already gave up.

So where do we start researching it?
I would give it a try if i knew where to start.

And maybe you could show us how you hacked Diva and those other games with frame limiting (please?) ?

Yea I'm a bit interested too, it seems like it's a bit easy for you to use the Disassembler to look for some codes... and if it's really that easy I might give it a try on other games.

[LunaMoo]

Yup it's easy, with some experience you don't even have to search for it, just randomly stop the code execution a few times and if you recognize a function which can be used for frameskip, mess around with it and that's how I do it for most games. It works because in 30fps game only some functions repeat twice per frame like functions which do frameskip and the chance of random stopping into them is very high, but that's not a reliable method or anything to start from without having any experience.
So if a quick look doesn't lead me anywhere I just check some of the ways that games set 30 fps, most commonly it uses sceDisplayWaitVblankStartCB or sceKernelWakeupThread syscalls or similar so I set a breakpoint on those, check return address(RA button) after it breaks on it, then if it's under a branch I change it to always return false when it's using wakeup thread or true if it's the other one or modify the code in any other way that should result in always waking up or avoid waits which is that's how game does it's frameskip would result in 60fps. If it doesn't, I continue and check if the syscall is used elsewhere until I find it.

Cheat engine can also be used if you totally have no experience with assembly or branch deciding to skip frame or not is not directly jumping into one of the commonly used syscalls. You do that by comparing memory, but that takes longer time and ultimately if you compare different places like fmv/menu/in-game it might lead to confusion like the 15fps cheat or absolutely nothing when it uses completely different code.
Instead I would rather find a code which executes twice per frame meaning using disassembly again, and then compare memory when this code execution refreshes a frame and time it doesn't. That might seem harder since again disassembly scares some people or taking more time, but actually since nothing else usually changes during same frame, it would find the result very quickly maybe even give a single result after one search starting from unknown value and searching for changed value which is faster than doing xx scans between different savestates and more reliable at the same time.
The result of such comparism could be a patch already, but IMO you should always check what function reads it and make an asm patch just to learn a bit more how games work and have an easier time and depend less on luck in the future, because really the key to have it easy is understanding, if you know how games work, this is very easy, if not then it's a timewaste.

That pretty much sums all simple tricks I use to unlock 60fps quickly to see if the game works fine or requires more work at fixing stuff like speed, timers etc. which unfortunately most games do.

Time for an example ~ I'll take a game which I didn't tried yet, The Warriors and try to patch it now doing few screenshots.
So after running a game and opening disassembly(ctrl+D on windows) I click "Funcs" to find a list of named functions and see if there are any which I can try using, there's a sceDisplayWaitVblankStart which could be used for frameskip so let's start from setting a breakpoint on it.
   
Then clicking RA button to return to function from where it was linked to.
   
We can see there that there are few branches which should be checked, let's check the shortest that compares to zero and if it fails other ones.
   
v1 register get's value 1 and 0 there when I set a breakpoint on that branch and as result skips every second frame, so since this branch actually goes back, let's just nop it.
   
And check if it did anything:
   
Yeah it did as simple as that, and who would have thought, it seems to also be one of those games which instantly work fine without messed up speed, so let's make a cw cheat from that:

Code:

_S ULUS-10213
_G The Warriors
_C0 60 fps
_L 0xE001FFF6 0x003B517C
_L 0x203B517C 0x00000000
_C0 60 fps[Disable]
_L 0x203B517C 0x1440FFF6
//Edit: dunno if it's just me with my pc(both cpu&gpu underclocked;p), but this game worked pretty badly for me before I disabled Vertex Cache, which I would recommend while trying this patch as obviously it makes the game even more demanding:].

And to explain all of this _S and _G lines aren't needed, but they help others find our cheats by google or whatever, so it's worth posting those:3 _L 0xE line isn't required either, I just add it to avoid repeating the write. As for the address you can see that in disassembly it's "08BB517C" while in CW cheat it's "03B517C"(we don't count first number in cw cheat since it's just a code type) that's because cw cheat 0 starts from 8800000 in psp, so we have to decrease the address from disassembly by 8800000 to get our cw cheat address.
Disable code simply restores original code, I just copy it from disassembly after restarting game without cheat, or before even patching the address in the first place, it's always good to have althrough not required either.

Anyway while potentially rare, there are still games which might be easily patched just like that and work without double speed.

[GamerzHell9137]

I'm still confused....

1. CRTL+D ... Check
Press funcs button .... Check
Find sceDisplayWaitVblankStart ....... Check
Click on it for a exclamation mark to appear ..... Check



2. Press RA button.... Check



3. Now, what's a branch? is that the blue line on the side that goes from the start to the end or all the things that are in the yellow field? There are some in other colors so that's why i'm asking.

And that's all i get from the things you said lol.
You said something about breakpoints, there is some button called breakpoint but dunno if i press it or not. I just get some things that's i'm not sure what to do with.

EDIT: And how did you set that true in the 3rd pic?

[LunaMoo]

Wall of text incoming...
I suck at explaining and skipped some more obvious details about ppsspp disassembly and mips to avoid even bigger walls of text, anyway when you double click on an opcode to make it red with an exclamation mark then you already set an execute breakpoint, you can remove breakpoint by clicking it again or pressing delete when it's highlited on breakpoint list at the bottom or just deactivate it by clicking the checked square there:3.

Branches are just opcodes which allow you to do different things depending on their conditions are met or not. Basically all opcodes like beq, bne, bnel, bgez, bc1fl etc. and yeah in ppsspp disassembly they show an arrow on the side pointing the place where they'll branch when conditions are met. When the conditions are not met, it'll just continue to execute another line or line after it in case of "likely" branches. "b" is also a branch but it's basically beq zero,zero which is always true, so it's used as a short distance jump.

I didn't set a branch on my screenshot to true, when you set a breakpoint on a branch or execute line by line and stop at branch it shows if conditions are met(true) or not(false), value of v0 as seen on the screenshot was 0x1 and bne means "branch if not equal" and so it's "true" since 1 is not 0 which this branch was comparing. Since that branch was running twice per frame and v0 was 1 only every second time, it was actually alternating between true and false skipping a frame whenever set to true.

On your screenshot bnel v0,zero,0x08908D88 looks like it just checks if an address does exist or not in v0 register, so I think only iteresting branch there to check is bc1fl 0x08908cfc which compares f0 to f20(it does it at c.nge f0,f20) and returns somewhere above likely repeating all that code again. You could just right click on that branch choose assemble opcode and type in "nop" which will replace it with no opcode so basically remove it effectively making it work as it was always returning false;p. But it would probably be better to check first what values are stored in f0 and f20 when it compares them and see if it always returns true/false or alternate between the two. If it doesn't alternate it might not be frameskip, but if a game runs at different fps in different places this might as well check what is current mode and then apply skip or not in which case it would be nice checking.
Or just do it the risky(stupid ~ but well - fast) way and just "nop" the "jal zz_sceDisplayWaitVblankStartCB" hoping that it unlock 60fps. Worst that can happen is game will freeze or crash, not a big deal with savestates and if it doesn't do anything there are probably other places where this syscall is called or it doesn't use it at all to skip frames;3.



You should probably read some stuff about mips or at least check what opcodes do for example from this pdf or just google for something more specific. You don't need to memorize every opcode or anything like that, but it will help if you recognize what more common ones are doing so you can get the idea what's happening by just looking at it which is always nice.

Also get used to ppsspp disassembly, it's small(and sometimes not soo stable;c), but powerfull tool. After finding your function from the list, you should click again on "regs" because values of registers is something interesting to stare at most of the time when you use breakpoints or stepping through some code. Registers also divide on GPR/FPU and VFPU, which can be accessed at regs list althrough VFPU actually have a completely separate window activated from vfpu button anyway since there are more of them. Some other thing, pressing "TAB"(on keyboard) when the main disassembly window that shows everything is active will switch the view from showing opcodes as hex and showing function names which can be usefull when searching things with ctrl+f/s or simply by prefference you choose one over the other. There are also memory breakpoints which you can set by right clicking in breakpoint list which are usefull when you find some variables by cheat engine and want to find what code is accessing it.

[GamerzHell9137]

You got some mad brain skills LunaMoo. (Mean in a positive way lol)
So i did what you said and nop'ed 0x08908cfc and it actually changed the FPS to 60 but the game is double speed. Sound is same speed thou.

Now about this part " But it would probably be better to check first what values are stored in f0 and f20 when it compares them and see if it always returns true/false or alternate between the two "
Uhhh F's? Where are the F's? Can't see any F's here lol

[LunaMoo]

Click "regs" to open register list, and then at the top of that list click FPU(it doesn't look like button, but it kind of is) there if you set a breakpoint where it compares the two you should see values on the list.

Also since as you say it's double speed, you would be really lucky if you find a place where you can see on the fpu register list one that has a value of 2.0 since some games simply double the speed by multiplying by 2 after skipping frames, could be using different value or do it completely differently, multiplying by 2.0 is just kind of common from my experience. But that's nothing sure and can be anywhere so I don't have any advice for that. It's as I said;p, unlocking 60 fps itself is usually very easy, but when game needs more to work properly that's where it has potential to get problematic and time consuming:|.

[GamerzHell9137]

I see, well i can't really do anything if i don't know how it works. Thanks for trying to explain thou, i appreciate it

[Goshorai]

Sad story:

After a while of not coming to this thread, I decided to visit it. And awesomesauce, so many new codes! Had to try some of them and they worked like a charm. Thanks to everyone's hard work.


I later saw Luna's tutorial so I decided to have a go at it with the PSP SAO game. Some tiring hours later of NOPing stuff that resulted in Double Speed, variable frame cap and gameplay-speed being reduced to 90% for some reason, I found the correct adress. The game was running at 60fps and everything was working fine.

But I ddidn't know how to make a CWCheat Cheat...so Genius Me decided to restart the emulation and the game went back to 30fps. >_<.

And worst part is that apparently I broke something, as the the emulator's Disassembly is now showing all the NOPs I put. Which is weird because they used to go back to their original er...value? After closing and restarting the emulator. But not anymore.



Those few minutes with 60fps were glorious though.

[LunaMoo]

@Goshorai not soo sad, since I have SAO as well:

Code:

_S NPJH-50701
_G Sword Art Online
_C0 60 fps
_L 0xE0010002 0x00015CB4
_L 0x20015CB4 0x24040001
//note: restart emulation with the cheat activated
_C0 Optional frameskip kill
_L 0xE0024682 0x00015C28
_L 0x20015B0C 0x00000000
_L 0x20015C28 0x3C014702
//requires the above, increased psp cpu clock(I think 444 is enough) and restart as well;3
_C0 60 fps [Disable]
_L 0x20015CB4 0x24040002
_L 0x20015B0C 0x0E30BDD2
_L 0x20015C28 0x3C014682

Have to restart the emulation and load from normal save to actually apply it, I could do it differently by just patching the variable that's set by this code, but I find that more elegant and safer for the game:3.
Edit: Added an optional code to kill the framelimit when too many characters are on the screen. the downside is it requires increased psp cpu clock to actually keep the 60fps and messes up with a bit more code, not tested much since it's hard to see amount of npc's that triggered it anyway.

[GamerzHell9137]

Ohh hey, i've done it. How do i make a cwcheat of it now?

[LunaMoo]

Another one, half of it is pretty much same as from the first post, but I fixed it for 60 fps:

Code:

_S NPJH-50588
_G Digimon World ReDigitize
_C0 60 fps
_L 0xE0024F84 0x001D3D10
_L 0x201D3D10 0x00000000
_L 0x2032BE34 0x00000000
_C0 60 fps [Disable]
_L 0x201D3D10 0x0E274F84
_L 0x2032BE34 0x0E2CC39F

----------------------

@GamerzHell9137 copy address of each line you need to change and changed instructions then you can follow this template:
_C0 name of the cheat
_L 0x2aaaaaaa 0xbbbbbbbb
with as many _L lines as you need
where:
aaaaaaa = address_from_disassembly - 8800000(you can use standard windows calculator in programmer mode after setting "hex" if you can't do it in memory.
bbbbbbbb = value you want to write, for nop that would be 00000000

That's pretty much all you need for asm cheats, I also add 0xE type code to stop them from refreshing, but it's really not important with short cheats. You can see different code types for example in here under cw cheat.

[GamerzHell9137]

Was a bad call, the animations are double but the game and sound plays the same speed and the gameplay plays in 60FPS.

Code:

_S ULUS-10207
_G GITAROO MAN Lives!
_C0 60FPS Alpha
_L 0x2014F50C 0x00000000
_C1 Disable 60FPS
_L 0x2014F50C 0x1440FFFB

Known issues: Double speed animations; In Stage 4 and Stage 10 drops to 30FPS
Its gonna stay in Alpha state cause idk anything about ASM hacking

I'll play more around the game and see if i can do anything.




Must watch video in 720p cause only 720p+ videos support 60FPS

EDIT: About FPU, on the other game i checked it but it had numbers like 30.00000 and 59.XXX (can't remember the numbers). I think that i'm searching the wrong place maybe?

[AvonSenpai]

(03-18-2015 08:53 AM)LunaMoo Wrote:  Another one, half of it is pretty much same as from the first post, but I fixed it for 60 fps:

Code:

_S NPJH-50588
_G Digimon World ReDigitize
_C0 60 fps
_L 0xE0024F84 0x001D3D10
_L 0x201D3D10 0x00000000
_L 0x2032BE34 0x00000000
_C0 60 fps [Disable]
_L 0x201D3D10 0x0E274F84
_L 0x2032BE34 0x0E2CC39F

----------------------

@GamerzHell9137 copy address of each line you need to change and changed instructions then you can follow this template:
_C0 name of the cheat
_L 0x2aaaaaaa 0xbbbbbbbb
with as many _L lines as you need
where:
aaaaaaa = address_from_disassembly - 8800000(you can use standard windows calculator in programmer mode after setting "hex" if you can't do it in memory.
bbbbbbbb = value you want to write, for nop that would be 00000000

That's pretty much all you need for asm cheats, I also add 0xE type code to stop them from refreshing, but it's really not important with short cheats. You can see different code types for example in here under cw cheat.

U Know which games i have without i telling u and making 60 fps patches for it Arigato Luna-Chan

[LunaMoo]

I was one to say such patches are not to be mass produced, heh ~ another one:

Code:

_S ULUS-10528
_G Gladiator Begins
_C0 60 fps
_L 0xE00708A6 0x00044B34
_L 0x2000FE68 0x00000000
_L 0x20044B34 0x3C023C89
_L 0x20044B3C 0x0A200800
_L 0x20002000 0x2442893B
_L 0x20002004 0x44821000
_L 0x20002008 0x0A2112D1
_L 0x2000200C 0xE4620774
_C0 60 fps [Disable]
_L 0x2000FE68 0x0E281A43
_L 0x20044B34 0x3C0208A6
_L 0x20044B3C 0xC4420774
_L 0x20260774 0x3D088889

;p

Edit: and another... ;3

Code:

_S NPJH-50686
_G Digimon Adventures
_C0 60 fps
_L 0xE0011880 0x000A907C
_L 0x200A907C 0x34040001
_C0 60 fps [Disable]
_L 0x200A907C 0x8C841880