[Discussion] 60FPS patches for PSP games that run at 30FPS

[solitarius]

This is an example, there is no universal methods.
I'm guessing you set your breakpoint @sceDisplayWaitVblankStartMultiCB. After the break watch the ra(return address) register on the left. Hit GO button a few times to make sure that ra doesn't get modified(routines(functions) can be called from multiple places). When you press the RA button it just simply takes you to the address which is in the ra register.
At this point simply replacing sceDisplayWaitVblankStartMultiCB with sceDisplayWaitVblankStart or simply nop-ing it would unlock the framerate, but I wanted to see if there is an address that controls the framerate.
If you look at the registers you notice that a0 has value 02, this is suspicious because (60/2=30), so let's see what happens to a0.
@088BB1C0 you see move a0,s0 which means s0 holds that 02(looking at the registers values this is correct).
So now we investigate s0. @088BB1A4 we see move s0,a0. But @088BB1B8 there is jal to a routine which could modify s0. Set a breakpoint @088BB1B8, we step trough it but s0 does not get modified, so be are back to @088BB1A4 move s0,a0.
Three lines above @088BB198 we see the start of the routine, which means that a0 is already set to 02 before we arrive at this routine, so we set a breakpoint @088BB198. Hit go a few times, because the routine could be called from multiple places. We are lucky, it gets called from a single location so hit the RA button.
We arrive @08804698 so again we work backwards and we set a breakpoint @08804690. @08804694 you see li a0,0 but don't get fooled by that because as you probably know MIPS have branch delay slot, which means that an instruction immediately after a branch is executed before the branch is taken.
So we break @08804690 and step trough the code with the StepInto button, you will see a small routine and @088BB270 you get lw a0,0x4908(v0). At this point v0 is 08970000 so a0 gets loaded with the value @09874908. We go to this location and see the 02, we modify it to 01 and the frame is 60.
Sometime is good to look for these values in RAM because there are rare occasions when they influence the speed too besides the framerate. I think one of the Ape Escapes is like that, in the sense that if you the vsync trick the game runs at double speed, but if you modify the ram value it will run @60 with correct timings.

Regarding speed modifiers. 3D graphics involves a lot of math(multiplications, divisions). Modern hardware(including PSP) deals with floating values, older hardware without FPU units we using fixed point values.
Anyway, people usually look for 3f800000(1.0 in float) values in RAM cause you know speed x1. Some time you can search for 4000000(2.0 float). Other time you search for 1/30(3d088889) or 1/60(3c888888 or 3c888889). or 30(41f00000),60(42700000). Some times they are integer form in RAM like 30(1E) or 3C(60) and are converted to float.
Sometimes they are not in RAM and gets loaded directly in registers, example lui at,3F80 then a mtc1 at,f1, this loads at with 3F800000 and then copy it to float register f1.
You should read through the thread, Luna and Kabuto explained these things.

In the case of the akuma hunters I found 8950984 holds a 3F80000, if you modify it to 3F000000(0.5 float) the main character will cover(traverse) distances at normal speed(in 60fps mode), but everything else remains double speed. So probably is worth inspecting which instructions loads this value, maybe you can make a working code.
Good luck.