[Discussion] 60FPS patches for PSP games that run at 30FPS

[Kabuto_Kun]

I wanted to post some of this before but I accidentally deleted my post while writing it, let's try again

Warriors Orochi 1, [USA] / [EUR-Eng], ULUS10341.ini / ULES01054.ini

Code:

_S ULUS-10341 / ULES-01054 _G Warriors Orochi [USA]/[EUR-Eng] _C0 60 FPS _L 0xE0070001 0x10003704 _L 0x20004F58 0x0A200DC0 _L 0x20003700 0x3C040001 _L 0x20003704 0x24050001 _L 0x20003708 0xAC850160 _L 0x2000370C 0x3C053F80 _L 0x20003710 0x0A2013BD _L 0x20003714 0xAC850164 _C0 30 FPS [Default] _L 0xE0070002 0x10003704 _L 0x20004F58 0x0A200DC0 _L 0x20003700 0x3C040001 _L 0x20003704 0x24050002 _L 0x20003708 0xAC850160 _L 0x2000370C 0x3C054000 _L 0x20003710 0x0A2013BD _L 0x20003714 0xAC850164 _C0 20 FPS _L 0xE0070003 0x10003704 _L 0x20004F58 0x0A200DC0 _L 0x20003700 0x3C040001 _L 0x20003704 0x24050003 _L 0x20003708 0xAC850160 _L 0x2000370C 0x3C054040 _L 0x20003710 0x0A2013BD _L 0x20003714 0xAC850164

*Cheat Status: No issues(?).

Warriors Orochi 2, [USA] / [EUR-Multi2], ULUS10423.ini / ULES01261.ini

Code:

_S ULUS-10423 / ULES-01261 _G Warriors Orochi 2 [USA]/[EUR-Multi2] _C0 60 FPS _L 0xE0070001 0x10003704 _L 0x20004E00 0x0A200DC0 _L 0x20003700 0x3C040001 _L 0x20003704 0x24050001 _L 0x20003708 0xAC850160 _L 0x2000370C 0x3C053F80 _L 0x20003710 0x0A201367 _L 0x20003714 0xAC850164 _C0 30 FPS [Default] _L 0xE0070002 0x10003704 _L 0x20004E00 0x0A200DC0 _L 0x20003700 0x3C040001 _L 0x20003704 0x24050002 _L 0x20003708 0xAC850160 _L 0x2000370C 0x3C054000 _L 0x20003710 0x0A201367 _L 0x20003714 0xAC850164 _C0 20 FPS _L 0xE0070003 0x10003704 _L 0x20004E00 0x0A200DC0 _L 0x20003700 0x3C040001 _L 0x20003704 0x24050003 _L 0x20003708 0xAC850160 _L 0x2000370C 0x3C054040 _L 0x20003710 0x0A201367 _L 0x20003714 0xAC850164

*Cheat Status:
- The cheat works great in most game modes, but the "Steeple Chase" mode (horse racing) is broken with it.
- For both games, the same cheats are working with the mentioned USA/EUR regions (even when theirs EBOOT.BIN's MD5 don't match); maybe the same cheats work for other game releases but I didn't test the others.

I found these cheats a long time ago but I just could use them with Cheat Engine because the FPS/speed addresses are located at an offset out of the typical range of CW CHEATs. They are around 0x00010160 (scratchpad?), and CW CHEATS starts at 0x08800000 (see the big difference), so I had to insert some assembly code on some empty area to change the values at runtime

- - -

@[Unknown]
Thank you very much for your explanation, as always.
Indeed, I went too far by thinking that forcing 32 bit color on a REAL PSP would be as easy as changing a couple of hex values. I managed to do it with some simple homebrew samples, but even if I identify the equivalent code on a retail game that doesn't mean that a REAL PSP would be able to handle it anyway, or as you say, that a simple change like this won't be enough.

@Mills
Are you trying with the same Mercury game I already posted? If you want to take a look and learn from it, just go to the address from the cheat I posted using the disassembly and see what I did.


_G Archer Maclean's Mercury [EUR]
_C0 60 FPS
_L 0x20058CCC 0x00000000


20058CCC is the RAM address, but you have to remove the first number (the number 2) because this is the code type identifier for CW CHEAT (2 means that it's a 32bit/4 bytes cheat constant write), it's not part of the address.

00058CCC is the real RAM address, but CW CHEAT starts at offset 0 and PSP/PPSSPP starts at 08800000 (hex), you can read the last part of LunaMoo's tutorial or the one I posted for info on this, so if you want convert the address from PPPSSPP to CW CHEAT, you have to decrease it by 08800000 (hex), and to convert from CW CHEAT to PPSSPP, add 08800000 (hex).

00058CCC + 08800000 = 08858CCC
When you go to this address with the dissassembly, it will be a BNE instruction (branch on not equal) that always branch to run the *vblank, which makes the game run at 30 FPS. NOP'ing this address (replace it with zeroes) is enough to perfectly unlock the framerate with this one.

Anyway, I tried with the second game Mercury Meltdown, all I got was 40 FPS or something like that, and it needed a speed modifier because the game speed was affected but I didn't found one, bad luck with this one
- - -

Now, I will explain what I did before about my dithering tests, maybe it's useful.

After some binary comparisons of compiled samples from the PSPSDK with the dither effect, when it is enabled in code there's a li a0,0x6 close to the sceGuEnable function, which is a 06000424 in HEX.
- 06: According to what I read in the pspgu.h file from PSPSDK, as part of States, #define GU_DITHER (6).
- 04: a0 register, I am not sure if this can be one of the other registers (a0=04, a1=05, a2=06 or a3=07).
- 24: li instruction, it might be a 34 in some games as I could see with IDA PRO.

I replaced those HEX patterns on the DECRYPTED binary of some games. In PPSSPP, enable the option "Dump decrypted EBOOT.BIN on game boot" from developers tools menu, then boot your game and a decrypted BIN file named as the game ID will be at \memstick\PSP\SYSTEM\DUMP.

After replacing the HEX patterns, rebuild the ISO of the game (better if you have a backup of the original) with the modified BIN file with the name EBOOT.BIN, on \PSP_GAME\SYSDIR, replacing the original EBOOT.BIN and deleting the BOOT.BIN.

I had to rebuild ISOs and test a lot to identify the exact value needed to disable the effect in the games I did managed to disable it, as these changes can't be used as CW CHEATs because the code is executed at the moment a game boots, leaving no time to CW cheats to have any effect.

- Puzzle Bobble JAP, ULJM-05011: located at 0xB6B within decrypted BIN with a CRC32 DA0BF8C0, replace 06000424 with 00000000.
- Metal Gear Solid Peace Walker USA DEMO, NPUH-90066 or NPHH-00145: located at 0x533E4 within decrypted BIN with a CRC32 62D2AAB5, replace 06000424 with 00000000.
- Metal Gear Solid Peace Walker USA, ULUS-10509: located at 0x7AFB8 within decrypted BIN with a CRC32 47BC4CEB, replace 06000424 with 00000000.

However, the games look awful in a REAL PSP with the dither effect disabled. If you want to see in PPSSPP how they would look, set "TrueColor = False" in ppsspp.ini file from \memstick\PSP\SYSTEM.

I will edit this post later with extra info.