[Discussion] 60FPS patches for PSP games that run at 30FPS

[Hot Violet]

Hey. Just wondering if it would be possible to find a 60 FPS code for Pac-Man World Rally?

Loving your work - It's great to play some of these games on a big screen at 60 FPS.

[Lycanphoenix]

Has anyone figured out how to permanently patch an .ISO with a CWCheat, such as the 60 FPS hack? When I try to use CWCheat on WipEout Pulse or WipEout Pure (unmodified .ISOs), it just causes a crash, and the cheats won't even register on .CSO. WipEout Pulse runs at 60 FPS in all modes except the menu, unlike WipEout Pure, and it has a more sophisticated shader model, so I know it isn't a limitation of the hardware (a real PSP, overclocked to 333/111 Megahertz).

Furthermore, any modification of the .ISO will just makes the cheats that much harder to use, which means if I want to add extra content to Pure (I'm trying to force the exclusive Japanese and American DLC into the European version), I'll have to find a whole new 60 FPS cheat, unless I'm able to patch the individual files BEFORE making the modifications.

(01-06-2016 03:22 AM)[Unknown] Wrote:  Well, forcing games to run at 32-bit color on a real PSP may be a feat, unfortunately.

The PSP had 2MB of VRAM, or in other words 2048KB.

A 16-bit color buffer requires 272KB. But a 32-bit one requires 544KB. Additionally, you essentially must double buffer on the PSP, meaning you need two of those buffers. So it's actually 555KB vs 1088KB.

Even more, most games will require a depth buffer to render properly at all. That costs another 272KB.

So you can see that with 32-bit color, you're quickly left with only 2048MB (VRAM) - 272KB (depth) - 1088KB (colors) = 688KB of remaining VRAM.

But you say, "it fits, doesn't it? Is that a problem?" But this VRAM has to be used for other things:

* Textures
* CLUTs
* Other buffers (to create bloom effects, or shadows, etc.)

So many games may have chosen 32-bit color simply due to free space, not even because of bandwidth. You basically double your remaining VRAM by using 16-bit colors, allowing you to do a lot more other effects. So it may have become a decision of more vibrant colors or better shadows, for example.

That being said, it's theoretically possible to relocate textures and CLUTs to regular RAM. There may be a performance penalty, but it might be livable. However, this would definitely mean non-trivial changes to the game's code. So that's why I say it might be an undertaking.

In PPSSPP, we represent the color buffers on your modern device, that might even have > 1GB of VRAM. So 32 bit color, or even double the resolution, is not really a problem to fit in there. We don't have to be limited by the VRAM the PSP had.

-[Unknown]

Would it be possible to set it to "24-Bit" instead of 16 or 32, as a sort of compromise? And by that, I don't mean the standard "24-Bit PNG" type of 24-Bit color with 8 bits per R-G-B channel, but instead only 6 bits per R-G-B-A channel. I don't know if that would actually work, though. (64 colors per channel, for a total of 262,144 colors with 64 levels of transparency).
EDIT: Alternatively, a 20-Bit color space (RGB 565/666* + 4-bit Alpha, and/or RGBA-5555**) might work.
*Same trick used by the Neo Geo, where the lowest bit is shared across all three color channels. No more precision, but slightly greater vibrancy.
**5 bits per RGBA channel, or 32,768 colors with 32 levels of transparency.

On a slightly related note... how much graphics memory would it save if the resolution was reduced from 480 * 272 to 480 * 270? Those extra 2 pixels of height don't do much of anything, and make upscaling to 1080p/2160p slightly more difficult because of the non-standard aspect ratio (it would be 1088p and 2172p, not very pretty). By reducing the size of the image by a total of 960 pixels, that should save some VRAM, shouldn't it? (Not to mention the slightly smaller screenshots saving a lot of space on the Memory Stick in the long-run).
EDIT: After some calculations, shaving off those 960 unnecessary pixels (you can't cram very much information into just two extra pixels of height) will save, at minimum, 1.8 Kilobytes of VRAM in 16-bit color, or at least 3.6 Kilobytes of VRAM in 32-bit color. Death to the useless pixels.

[Kabuto_Kun]

Hey, I've not been that active around here for some time but I actually have 60FPS cheats for several games that I have not posted, some cheats updates, and even some hacks/tweaks to fix some games that are normally broken/buggy in PPSSPP, so they are now fully playable. I'll try to post all these things shortly.

@Lycanphoenix:
I have tested again, in several ways, the posted cheats for WipEout Pure and Pulse: used several PPSSPP versions, booted the games with different languages, changed the PSP model option to 1000 and 2000, and compressed the ISOs in CSOs. The cheats worked every time, and I know these are clean dumps so I don't have an explanation on why they are not working for you. Check if you are using the correct cheat for your game release (Pure has 2 USA releases with different BIN files, v1 and v2, each one has cheats posted). Just to be safe, I updated the cheats with conditional codes to avoid them to be enabled in an incorrect game release, situation that may cause the game to crash/freeze.

It's very easy to permanently patch a game ROM or ISO with a given cheat using any emulator that has a functional disassembly, and the one in PPSSPP is the best I have used. So let's make a tutorial

How to permanently patch a PSP game ISO/BIN file with a CW cheat using PPSSPP

This tutorial can be also used with others emulators that have a disassembly (PCSX2, Dolphin, etc.), but some steps may and will vary (like the conversion between a cheat address and a valid disassembly address, or the endianness change of cheat values).

For this specific example, I will explain how to permanently patch WipEout Pure USA-v2 with the 60 FPS cheat available, this one:

Code:

_S UCUS-98612
_G WipEout Pure [USA]
_C0 60 FPS UMDv2.00 [Always]
_L 0xE001FFFB 0x000652A8
_L 0x200652A8 0x00000000
_C0 60 FPS UMDv2.00 [Ingame only]
_L 0xE0020001 0x0028E390//ingameCond
_L 0xE001FFFB 0x000652A8
_L 0x200652A8 0x00000000
_L 0xE0020000 0x0028E390//ingameCond
_L 0xE0010000 0x000652A8
_L 0x200652A8 0x1480FFFB
_C0 30/60 FPS UMDv2.00 [Default]
_L 0xE0010000 0x000652A8
_L 0x200652A8 0x1480FFFB

You can get the latest version of this cheat (if it has been updated) HERE.

Step 1: Initial considerations.

The 0xE lines are conditional codes for CW cheats only so they are optional (we can't integrate them in the ISO), we need to use the line that actually writes the cheat: the 0x2 line (sometimes we have 0x1 or 0x0 lines, depending on the CW cheat). Remember that CW cheats use the first character as a cheat type identifier, so the real address of the cheat is 7 characters long (ignoring the 2).

But before we start this tutorial, we should know that there are 2 "types" of cheats:
1- Cheats that modify a value/game runtime data.
2- Cheats that modify game code/instructions.

With the first type, we can't follow this tutorial before doing some initial extra steps, this is because the values/data that are used for ingame calculations are not directly saved in the BIN file as is; these are initialized and, most of the time, dynamically changed by game code/instructions while the game is running. If the cheat you want to permanently patch is type 1, start in step 2; if it is a type 2 cheat, go to step 3.

With the cheats disabled boot the game, pause the emulator, click Debug and then click Disassembly... You will see a window like the one below.



Step 2: Getting the instruction/s.

To get a valid PPSSPP disassembly address from a CW cheat, we add 08800000 to the cheat address using a hex calculator: 00652A8 + 08800000 = 088652A8 (disassembly address).

We have to use the disassembly to identify which instruction/s writes this value (yeah, there can be more than one); if you have the address of the value (like a working CW cheat) you can set a write breakpoint to it using the disassembly, reboot the game with it enabled and take note of every instruction that stops the game execution to write values to it while you play the game.

For example, if you are trying to patch an infinite health CW cheat to your game, every time your player gets damaged, the write breakpoint you enabled will stop the execution of the game and show you in the disassembly the exact instruction/line that writes that value; in a case like this, you can replace that line with a NOP (0x00000000 in HEX) to prevent the health value from being overwritten.

Once you have found the needed instruction/s, you will use them for the next steps.

Step 3: Finding the search pattern.

In this case for WipEout Pure USA-v2, I was the user that posted this cheat and I know that it is a type 2 cheat (code/instruction). The default (original game value) hex code 0x1480FFFB from the cheat is the instruction "bne a0,zero,0x08865298" in this game.

Write or paste the disassembly address we calculated above (088652A8) on the Go to textbox and press your Enter key. The highlighted instruction in the colored box is the one affected by the cheat; right click it and click Go to in Memory View. The cursor will be located in the memory view box, and the first highlighted byte you see is the first one of the 4 bytes that this instruction has (in modern consoles, like the PSP, every instruction is 4 bytes/8 characters long).

As you may have noticed (see picture above), in the memory view box we see FBFF8014, which actually is our already known default CW cheat value 1480FFFB inverted in pairs (endianness changed). We must keep/copy this found inverted value and also a couple extra bytes more (doesn't matter how many, but around 12 bytes/24 characters in total should be enough) so we can hex search this pattern in the next step. The hex pattern I copied from the memory view and that we will use in this example is FBFF8014259060021B000010.

Step 4: Patching the game BIN/ISO.

Now we will hex search (not the same as a text search) this pattern using a hex editor within a decrypted BOOT.BIN/EBOOT.BIN file, or even inside the game ISO if we are totally sure that the BIN file inside are already decrypted. AFAIK when you boot a PSP game, it first tries to load the encrypted EBOOT.BIN, even when the BOOT.BIN file (a decrypted copy) is present (however, sometimes this file is just a dummy or it is zero filled).

*Note 1: To avoid problems in the patching process, I recommend to enable the option Dump encrypted EBOOT.BIN on game boot in PPSSPP Developer tools settings, then boot the game, go to PPSSPP-FOLDER\memstick\PSP\SYSTEM\DUMP and use the newly created UCUS98612.BIN (named with the game ID from WipEout Pure USA, the actual example) to replace the BOOT.BIN file (leaving this name) from inside the ISO and relink the file EBOOT.BIN to it (UMDGen is useful for this), so both files point to the same decrypted BIN file.

As a hex editor I use HxD (it's free); load the decrypted file (UCUS98612.BIN) on it and hex search the hex pattern we decided before: FBFF8014259060021B000010. You should get a match (see picture below).



In this case, the shown file UCUS98612.BIN is a clean decrypted BOOT.BIN from WipEout Pure USA-v2, with a size of 3,795,981 bytes and a MD5 76FBD47B2DF2EBBFD0C57C11DC1215E6. The match was found in offset 0x61328 within this BIN file (not inside the ISO). We used a large pattern to avoid false positives in the hex search, and you can visually check that the values around the memory view box in PPSSPP and the values around the match in the BIN file are all the same, so here we are sure that we got the correct result. Remember that according to the CW cheat we have, we must only change the default value 1480FFFB (30FPS) to 00000000 (60FPS, replacing the BNE instruction with a NOP).

Using the hex editor, replace (do NOT add!) the found hex match FBFF8014 with 00000000. Remember that this new value must be reversed from the CW cheat in the same way as the default value already is, but in this case we don't have to reverse all the 0 because it will be the same value anyway .

Now save the edit in the hex editor. If you only edited the BIN file, then rebuild the game ISO using the new BIN file (read Note 1 from above). If you directly edited the game ISO, then just boot the game and check the results.

That's all, the process is easy and not that long in practice, but I tried to give all the details I could. I always update this kind of tutorials so please do not quote this whole post. If you need help or more details, just ask.

[Lycanphoenix]

Thanks. These instructions will need to be modified to use the In-Game Only version of the cheat, though (I kind of don't want the intro cinematic to play at double-speed, even though I do skip it most of the time).

Code:

0xE0020001 0x0028E390
0xE001FFFB 0x000652A8
0x200652A8 0x00000000
0xE0010000 0x0028E390
0x200652A8 0x1480FFFB

The In-Game Only cheat has multiple lines that aren't present in the other two cheats. (It might also not be a bad idea to include download links to the modified .BIN files, for people who aren't as good at following instructions)

While I wait for your response, I am going to try to find a 60 FPS cheat for the Japanese version of Pure, and possibly for W'O" Pure: Stealth Edition (now that I have a copy). WipEout 2048 is going to be a lot harder, since I can't seem to locate it's ISO/ROM, nor can I find any PS Vita emulators.

[Kabuto_Kun]

X-Men Legends 2, ULUS10045.ini / ULES00191.ini and maybe more (read details below)

Code:

_S ULUS-10045/ULES-00191
_G X-Men Legends 2 [USA/SPA]
_C0 60+ FPS [Default]
_L 0x20429DB0 0x34080078
_C0 45 FPS
_L 0x20429DB0 0x3408002D
_C0 40 FPS
_L 0x20429DB0 0x34080028
_C0 30 FPS
_L 0x20429DB0 0x3408001E
_C0 20 FPS
_L 0x20429DB0 0x34080014

*Cheat Status: No issues.
*Extra details:
- The game engine uses custom code to limit/cap its maximum framerate, which is not as efficient as using the built-in PSP functions for it.

The best and better performing way to play this game is to uncap the internal framerate via its game engine (using the default 60+ FPS cheat, which actually has a value for 120FPS) and then the PSP functions will limit the framerate to 60FPS.

- The game already runs at 60FPS by default, even when it's nice having options to choose (30,40 FPS), as explained before you should always use 60+ FPS cheat.
- The game sets the FPS cap only once at boot time, so to make the cheat work you must boot the game with the cheat enabled; you can boot the game, enable the cheat and reset/restart it. If it still doesn't work for you, increase the cheat refresh rate to make sure the value of the cheat is changed before the game runs the FPS capped value.
- I have tested this same cheat with the USA (ULUS-10045) and SPA (ULES-00191) releases and it worked for both because they have the same EBOOT.BIN file. If other releases/regions use the same EBOOT.BIN file aswell then this same cheat should work with all of them.

The Godfather - Mob Wars / El Padrino, ULUS10098.ini / ULES00394.ini / ULES00400.ini, possibly more (again, read details below)

Code:

_S ULUS-10098/ULES-00394/ULES-00400
_G The Godfather - Mob Wars [USA/EUR-Multi3/SPA]
_C0 60 FPS
_L 0x2048F1CC 0x00000001
_C0 30 FPS [Default]
_L 0x2048F1CC 0x00000002

*Cheat Status: No issues.
*Extra details: The same here again. I have tested this cheat with the USA (ULUS-10098), EUR-Multi3 (ULES-00394) and SPA (ULES-00400) releases and it worked for all of them because they have the same BIN file. If other releases/regions use the same BIN file aswell then this same cheat should work with all of them.

Shinobido [EUR], UCES00421.ini

Code:

_S UCES-00421
_G Shinobido [EUR]
_C0 60 FPS
_L 0x2034161C 0x00000001
_C0 30 FPS [Default]
_L 0x2034161C 0x00000002
_C0 20 FPS
_L 0x2034161C 0x00000003

Shinobido Homura [JAP], ULJM05035.ini

Code:

_S ULJM-05035
_G Shinobido Homura [JAP]
_C0 60 FPS
_L 0x2033D61C 0x00000001
_C0 30 FPS [Default]
_L 0x2033D61C 0x00000002
_C0 20 FPS
_L 0x2033D61C 0x00000003

*Cheat Status: No issues.

Pac-Man World 3 [USA], ULUS10055.ini

Code:

_S ULUS-10055
_G Pac-Man World 3 [USA]
_C0 60 FPS
_L 0x215E29B4 0x42700000
_C0 45 FPS
_L 0x215E29B4 0x42340000
_C0 30 FPS [Default]
_L 0x215E29B4 0x41F00000
_C0 20 FPS
_L 0x215E29B4 0x41A00000

Pac-Man World 3 [EUR], ULES00260.ini

Code:

_S ULES-00260
_G Pac-Man World 3 [EUR]
_C0 60 FPS
_L 0x215C5574 0x42700000
_C0 45 FPS
_L 0x215C5574 0x42340000
_C0 30 FPS [Default]
_L 0x215C5574 0x41F00000
_C0 20 FPS
_L 0x215C5574 0x41A00000

*Cheat Status: No issues.

@Hot Violet
I tried with Pac-Man World Rally, but even when I found a working 60 FPS code, the problem is that the AI breaks, and while your own player and its animations run totally perfect, every other NPC just keep running in circles and hitting walls. Weird behavior

Also, user kairukun asked about Tenchu Shadow Assassins: I tried but at 60FPS it runs at double speed and I had no luck with a speed modifier.

@Lycanphoenix
I am not sure if I understand you about using the in-game cheat but, to make it clear, we can't permanently patch CW cheat conditional lines to a game, as their logic is externally handled by its PPSSPP code implementation at runtime, not by the internal PSP game code.

What we can do is write assembly code (MIPS) that replace the actions that a CW cheat does and then inject this assembly following my tutorial (with some variations). This is slightly harder to do than a simple cheat patch, depending on how complex is the original cw cheat and its conditional logic, but can be done

I'd say that 60 FPS for WipEout 2048 is totally out of reach for some time. There are no working PS Vita emulators right know, and even when thanks to the HENkaku exploit we can now play game dumps, AFAIK the available cheat devices and BIN disassemblers are not really polished yet.

I actually tried to buy a PS Vita or PS TV recently but I had no luck with eBay sellers . If I get one I will certainly make some random cheats and whatever .

[Lycanphoenix]

I'm trying to convert the BOOT.BIN file to C++. If I can get my compiler to work, I can turn it back into MIPS r4000. I can probably turn a bunch of other stuff into MIPS r4000 machine code while I'm at it, to (in theory) reduce the game's size and/or overhead since it wouldn't need to interpret the code.

I did some 60 FPS testing on my PSP earlier. The menu looks AMAZING at 60 FPS, it's a subtle change but feels so much better. The intro video seems to drop frames a lot, though, in addition to being too fast, and there are performance issues abound even while overclocked (I think I can see why the game was capped at 30, stuttering and screen-tearing aren't pleasant)

EDIT: So, trying to convert it to C++ just gave me a bunch of raw hexadecimal inside a 20-megabyte "C" file.

[solitarius]

(10-02-2015 06:39 AM)Kabuto_Kun Wrote:  The 3rd Birthday [EUR] BETA, ULES01513.ini

Code:

_S ULES-01513
_G The 3rd Birthday [EUR]
_C0 60FPS v1 [Enable AFTER mission start]
_L 0xE0020002 0x0147140C//condit60fps
_L 0x2041AD64 0x3F000000//speed
_L 0x200158F8 0x00000000//vblank
_L 0xE0020002 0x1147140C//condit30fps
_L 0x200158F8 0x1480FFFA//vblank
_L 0x2041AD64 0x3F800000//speed
_C0 30FPS [Default]
_L 0x200158F8 0x1480FFFA//vblank
_L 0x2041AD64 0x3F800000//speed

Hello
08C3B058 this address holds the static value 3F800000 trough the entire game which acts as speed modifier.
I finished the game without problems and stays the same. So the code bellow works.
0x200158F8 0x00000000
0x2043B058 0x3F000000

[YukiHerz]

Thanks for the shinobido code Kabuto_Kun!
Here i'm hoping someone takes another crack at the MH games.

[Lycanphoenix]

I gave up with trying to extract the C++/C code for the BOOT.BIN file, but I'm now trying to compare the DLC packs for the different versions of WipEout Pure in the hopes of porting content. I don't really like the File Compare in HxD, it only shows the differences between two files, one byte at a time; what I wish it would do instead was show the similarities between two different files, with an option to search for larger or smaller similarities.

[soba_White]

Hello
I tried to serch 60FPScode for Rengoku2 (ULJM-05055-JP,ULUS-10127-US).
I can't find them .I tried searching with use CheatEngine ,R4 in PPSSPP.
If you have a time ,would you please serch Rengoku2 ?

But I find 60FPS code in japan BBS.
code is
_L 0x202B1190 0x00000001 (value 2= 30FPS on psp)
This code is serching on the PSP and worked my PSP, but this code is maked 2x gamespeed.

    [imgur.com/0n1itl9]
I would be glad if you could give me an answer.
I'm sorry my English still isn't good.

[Slightly Apathetic Mio]

Black Rock Shooter [USAb]

Code:

_S NPUH-10126
_G Back Rock Shooter The Game
_C0 60 FPS
_L 0x216060B4 0x00000000
_C0 30 FPS
_L 0x216060B4 0x00000001

The menus (originally 60FPS), battles, and vehicle segments play as normal at 60 FPS. Animations play at double speed during cutscenes and while moving around the levels. Multiple lines of auto-advancing text will cause desync or cut off voice lines.

Tantei Opera Milky Holmes [JPN]

Code:

_S ULJS-00343
_G Tantei Opera Milky Holmes
_C0 60 FPS
_L 0x2016D284 0x00000001
_C0 30 FPS
_L 0x2016D284 0x00000002

Tantei Opera Milky Holmes 2 [JPN]

Code:

_S ULJS-00520
_G Tantei Opera Milky Holmes 2
_C0 60 FPS
_L 0x20173284 0x00000001
_C0 30 FPS
_L 0x20173284 0x00000002

I haven't played this yet (still need to beat the first), but I assume it works as well as the first game.

EDIT: Cheats that are just speedhacks with the easy method: Harvest Moon: Hero of Leaf Valley (ULUS-10458 @ 522B40), Nendoroid Generations (ULJS-00441 @ 2F14A0), Mahou Shoujo Lyrical Nanoha A's Portable: The Gears of Destiny (ULJS-00385 @ 151C74), Bleach Soul Carnival (UCJS-10085 @ 1E51DC), Kenka Bancho: Badass Rumble (ULUS-10442 @ 4A667C), and Gurumin: A Monstrous Adventure (ULUS-10228 @ 4E4C90).

EDIT: Cheats that are just speedhacks with the disassembly method: Higurashi Daybreak Portable Mega Edition (ULJM-0557 @ 4868)

[solitarius]

Code:

_S UCUS-98609
_G Ape Escape On The Loose
_C0 60fps ON
_L 0x2000490C 0x00000000
_L 0x2021FA40 0x3F000000
_C0 60fps OFF
_L 0x2000490C 0x0220F809
_L 0x2021FA40 0x3F800000

[solitarius]

Code:

_S ULUS-10419
_G Tenchu Shadow Assassins
_C0 60fps ON
_L 0x200313D0 0x00000000
_L 0x203D20E4 0x0000003C
_C0 60fps OFF
_L 0x200313D0 0x14A0FFF1
_L 0x203D20E4 0x0000001E

[solitarius]

Code:

_S ULUS-10051
_G Ys Ark Of Napishtim
_C0 60fps ON
_L 0x20108804 0x00000000
_L 0x20158648 0x3F800000
_C0 60fps OFF
_L 0x20108804 0x14600025
_L 0x20158648 0x40000000

[solitarius]

Code:

_S ULUS-10336
_G Crisis Core FF7
_C0 60fps ON
_L 0x200065A0 0x00000000
_L 0x20006644 0x00000000
_L 0x201036E0 0x3C043F00
_C0 60fps OFF
_L 0x200065A0 0x10800015
_L 0x20006644 0x1480FFFB
_L 0x201036E0 0x3C043F80

Voiced cutscene remain @30, gameplay(both exploration and combat) is real 60fps with correct speed, timer in menu is correct too.