[Discussion] 60FPS patches for PSP games that run at 30FPS

[Kabuto_Kun]

Introduction.

After I found FPS unlocking cheats for some games, I noticed a pattern, probably derived from common practices from game developers. A lot of the games I tested have an address somewhere in RAM that sets the game FPS with only a single value, think about it like it's an internal frameskip, where if the game is running at 60 FPS the value of such address is 1 (60/1=60), 2 for 30 FPS (60/2=30), 3 for 20 FPS (60/3=20) and so on, so this is the first thing I try with a game to unlock its framerate. Another common pattern to consider is 0 as a value when the game is running at 60 FPS and 1 when it runs at 30 FPS, probably a boolean value for an ON/OFF framelimit.

The problem is that sometimes even when the games are unlocked, they run at double speed and need some extra fixes to be played at normal speed, like combining these FPS cheats with slowmotion/gamespeed codes, which generally are FLOAT values, like 1.0 (0x3F800000 as hex) or fractions (like 0.5, 0x3F000000 as hex) that we have already available for a lot of games, just search them on Google.

However, not all games need these extra speed fixes and just by finding this frameskip address we can perfectly unlock its FPS. I have even used this tutorial with games from other consoles (PS1, PS2, N64, Dreamcast, Gamecube, Wii) and it have worked with some games from each of them, so it's widely useful not just for PSP games if you know how to adapt this tutorial.

This is how I find the 60 FPS codes for these "easy" games, so let's call it "easy method"; for this specific example for the tutotial, I am using the PSP version of NFS Undercover in its EUR region (ULES-01145).

Tutorial.
Part 1: PPSSPP steps.

Run PPSSPP (x86 version is a LOT better option for this tutorial), go to options, set Show FPS counter to Both (to see the internal FPS as reported by PPSSPP), set the PSP model to PSP1000 and disable Fast memory (this change is very important, if you keep this option enabled PPSSPP will crash a lot while you use Cheat Engine).

Now the first thing we need is the PSP memory range for Cheat Engine. Boot the game you want to try and then quickly pause emulation (you can press F8), enable the PPSSPP debug console (you must enable debug logging to be able to use it) and one of the first lines you can see on its window looks like this:

Code:

20:34:158 MemMap.cpp:328 I[MM]: Memory system initialized. RAM at *08E20000* (mirror at 0 @ 10C00000, uncached @ 10C00000)

To that first RAM address I hightlighted with the *, add 800000 to it as hex (you can use any hexadecimal calculator for this, windows calculator can do it). For this example the result is: 08E20000 + 800000 = 09620000 (this is the PSP game memory start address for cheat engine). To this address then we add 1800000 (equivalent to 24MB, PSP1000 RAM size), now the result is: 09620000 + 1800000 = 0AE20000 (this is the PSP game memory end address, the stop address for cheat engine).

Keep PPSSPP open and now proceed to Cheat Engine.

Part 2: Cheat Engine steps.

Important: In Cheat Engine you must go to Edit > Settings > Scan settings, then enable the MEM_MAPPED option, otherwise the memory scans will not work with PPSSPP.

   

In Cheat Engine, select the PPSSPP process by clicking the red/green colored button (the one with a PC icon).

See closely the image of Cheat Engine above and read the next descriptions for each field according to the numbers shown on the screenshot:

1- We write here the value equivalent to the FPS that the game is running at the moment when we press the search button:
- For the internal frameskip pattern: 60(FPS)= 1 (< value for Cheat Engine), 30=2, 20=3 ...
- For the framelimit ON/OFF pattern: 60(FPS)= 0 (< value), 30= 1.
NFS Undercover uses the internal frameskip pattern, so as the game always runs at 30 FPS then it has a value of "2", we will search it.

2- We write the addresses we calculated above from PPSSPP, start and stop.

3- Let the game running (unpause it) and do your first search with "New Scan", then a few times more with "Next Scan" while playing the game for some minutes at different places so we can decrease the results (use Unchanged value as Scan type if the FPS keeps being the same while you search, like in the example for this tutorial; or use Changed value too when it changes to different FPS between searches). After some minutes, I finally decided to stop when I had 6170 results.
Now we select a bunch of these results, right click them and click "add selected addresses to the addresslist", then they will be in the address list (down). After this, we can delete the addresses from the upper list so we decrease the list size while testing.

4- I recommend to save a savestate for the game before you start testing and load it frequently if you notice the game starts showing any kind of problem, instability or graphical glitches. Now we start to change the values in groups but beware, the game may freeze with all the random value changes we are doing, that's why we must disable Fast memory in PPSSPP, but if it still freezes we need to know what addresses we changed to continue from there, read the Useful Tip if this happens to you, if not then just go to step 5 from here.

Useful Tip: PPSSPP has dynamic memory addresses so it changes the PSP RAM start address every time you boot a game. You can calculate an offset so when you need to close the emulator (or it freezes) you can continue later from there without having to start over, for example:

*Your start address is 0AD70000 (1st Cheat Engine start) at you first try with a game, then after some changes the game freezes and the last address you changed a value in CE was around 0B570201. When you start the game for a second time, after doing again the steps of the tutorial now your new initial start address is 09620000 (2nd time CE start); you can subtract the smaller start address from the larger: 0AD70000 – 09620000 = 1750000(this is the offset) and then you subtract this offset from the last address you changed before the freeze: 0B570201 - 1750000 = 09E20201 (this would be your start address for Cheat engine if you want to continue from where you were before the freeze, and your stop address would be the usual, 09620000+1800000, based on your 2nd time CE start).*

5- Keep changing the values from "2" (30FPS) to "1" (60FPS, see next image) until we see the green FPS counter in PPSSPP change to 60 FPS.

   

6- When you see the green FPS counter in PPSSPP changing to 60FPS while changing a group of values, keep testing them in smaller groups until you identify the exact address that is changing the game FPS. In this example it was the address 09EAC03C as shown in Cheat Engine. We decrease this one by the game memory start address: 09EAC03C - 09620000 = 0088C03C (this is the CW cheat address, which MUST be 8 characters long and if it's not, then add zeroes on the left until it is).

When we put this adjusted address on the .ini file for PPSSPP, we must replace the first of the 8 characters with a "2" (always this same number for 32bits/4 bytes writes, check CW CHEAT code types for more info), so in this case our final address is 2088C03C.

Now, this is how our final CW CHEAT .ini file should look like:

Code:

_S ULES-01145
_G Need For Speed Undercover [EUR]
_C0 60 FPS
_L 0x2088C03C 0x00000001
_C0 30 FPS [Default]
_L 0x2088C03C 0x00000002

_S: Game ID (optional line, but recommended).
_G: Game name (optional line, but recommended).
_C0: Cheat label/title.
_L: Cheat line. The first part is the address we calculated above and the second part is the value for it (1 for 60 FPS). Both parts MUST be 8 characters long so add zeroes on the left (if needed) until they both are.
You should include a cheat containing the original values too, so it can be used to disable the cheat anytime, which can be specially helpful with not so perfect codes.

That's all you need to do, not that hard right?

Please don't quote this post, I will edit it later. I hope it is easy enough to understand, but if you have any questions just post them here.