PPSSPP写60镇代码的教程

 原帖地址：https://heroesoflegend.org/forums/viewtopic.php?t=276

60fps cheats (Nayuta) + cwCheat Tutorial

josejl figured out:
1) Frame rate controlled by sceDisplayWaitVBlankMultiStart parameter 0x08B925A8 (30fps: 2, 60fps: 1)
2) Game speed controlled by float parameter at 0x8A2F974 (default value 0.99)

It could easily be part of the patch. But this is not fully working so it will not be part of patch just yet. Some animations are played at double speed and I don't know how to fix it or research fixing it.

How cwcheat codes work:
http://raing3.gshi.org/psp-utilities/page/PSP/CodeTypes

The last thing you need to know about cwcheat: The base address is 0x08800000. So when you say address 0x0 it really means address 0x08800000.

The above info about cwCheat is very hard to find from Google searching so it bears repeating.

First study the above resource.
We also need 32-bit floating point calculator to succeed: http://www.h-schmidt.net/FloatConverter/IEEE754.html

Okay, now onto the meat of this tutorial. The goal here will be to make cheats that do this for Nayuta. Finding the addresses and values you want is outside the scope of this tutorial. I'm assuming you already know those. There are other tutorials out there if you don't know the values.
_S NPJH-50625 <- Some cheat tools need this but PPSSPP doesn't, specify game ID (see by UMDgen)
_G Nayuta: Endless Trails <- Some cheat tools need this but PPSSPP doesn't (doesn't make a difference)
_C0 60 FPS Name of this cheat. Cheats can be activated separately and should be named for their function.
Need the *sceDisplayWaitVBlankMultiStart* parameter address in cwcheat format. In python at the prompt, do: hex(0x08B925A8 - 0x8800000)
You get 0x3925a8. 
We want to write a word (4 bytes), so the start code is 0x2 per the resource above. From there, we fill zeros and our address.
The value we want to write is 1. Just need to fill zeros until we have a word.
_L 0x203925A8 0x00000001
Next, we want to adjust the game speed parameter. hex(0x8A2F974 - 0x8800000) = 0x22f974
Per josejl's note below, the value we want is 0.495. We need hex, so to get that, use the 32-bit floating point calculator. And you get 0x3efd70a4 for the value. Again we want to write a word, so our start code is 0x2. So our next line is:
_L 0x2022F974 0x3EFD70A4

We can add stability by adding 0xD or 0xE (conditional) starting codes. Basically we would want to change 0x08B925A8 to 1 if the value was 2 and we would want to change 0x8A2F974 if the value was 0.99. This way, our cheats won't get in the way of the game's loading routine which might need this memory (it's not touched when the game is running). So our start code is 0xD and the cwCheat-formatted address i 0x3925A8 from previous steps. The format needs to be this:
Type 0x0E 8-bit Equal To
E1ZZYYYY 0XXXXXXX Checks if YY == (byte at [XXXXXXX]). If not, the next ZZ are not executed (ie. execution status is set to false for ZZ lines). Normally you would use a word conditional. But this is not possible with cwCheat or I can't figure out how to do it.
So our code is:
_L 0xE1020002 0x003925A8 #If 0x08B925A8 is equal to 2, do the next two lines (otherwise skip them)

The way this game is set up, the 60FPS code will be hit only once during the entire runtime. It means cwCheat will execute faster because it needs to modify values only once, rather than on every cycle.

We need a cheat for putting it back to 30FPS. We can just use the addresses from before. And we need to get the value 0.99 from the 32-bit float calculator. Because many animations go at double speed at 60FPS.
_C0 30 FPS
_L 0x203925A8 0x00000002
_L 0x2022F974 0x3F7D70A4

Our final codes:
_S NPJH-50625
_G Nayuta: Endless Trails
_C0 60 FPS
_L 0xE1020002 0x003925A8
_L 0x203925A8 0x00000001
_L 0x2022F974 0x3EFD70A4
_C0 30 FPS
_L 0xE1020001 0x003925A8
_L 0x203925A8 0x00000002
_L 0x2022F974 0x3F7D70A4

Tested and working  For both patched and unpatched versions.

Oh,I completely forgot about this stuff. I'll try to get back to it soon, seeing that I'm currently stuck at Celceta's improvements.

Looking at Celceta, I don't think it'll be possible to not have any issues,but at least it should be able to get the cutscenes playing at normal speed.
The menus and UI are hardcoded at 30 fps, so those will run at twice the speed, unless everything is rewritten, which I don't think is really worth it.

I think I made some CWCheat for Ys vs Sora too,I'll have to look it up as well. I think it only worked on actual gameplay. Presumably the same can apply to Seven given the similarities.

ZnK and Ao use a completely different timing system, which is a lot easier to mess with, but I don't think I wrote down the addresses. The same system applies to ZnK PC,so I've got 60 fps working there quite nicely.

I didn't want to bother you. Take your time. I'll ask you again about it in 6 months to a year. I certainly wouldn't want to be bothered for updates too often.

I needed to "learn" cwCheat. Then I could make these cheats and release them. That was the point of this post.
Once fully working it I can test on a real PSP to see if it'll work there. And if so then we can roll it into the patch.

If you wanted to work on something, I suggest Celceta PC. It sounded like you made a lot of good progress: http://www.heroesoflegend.org/forums/vi ... 2304#p2304

Oh, apparently cwCheat has a function where cheats can be activated if you press certain buttons. This set of cheats is a good target for it so I will have new cheats up shortly.

The one you want is called the "joker code" at the above resource.

Type 0x0D Joker Code
D00000YY 1XXXXXXX Checks if (ctrl & XXXXXXX) == XXXXXXX. If not, the next YY+1 lines are not executed (ie. execution status is set to false for YY+1 lines).
CTRL is a system value that specifies which buttons are currently being pushed. Sorry, I don't know where it is in the memory but apparently cwCheat does know. Anyway, look at this table:
User Mode Buttons
Button Code
PSP_CTRL_SELECT 0x00000001
PSP_CTRL_START 0x00000008
PSP_CTRL_UP 0x00000010
PSP_CTRL_RIGHT 0x00000020
PSP_CTRL_DOWN 0x00000040
PSP_CTRL_LEFT 0x00000080
PSP_CTRL_LTRIGGER 0x00000100
PSP_CTRL_RTRIGGER 0x00000200
PSP_CTRL_TRIANGLE 0x00001000
PSP_CTRL_CIRCLE 0x00002000
PSP_CTRL_CROSS 0x00004000
PSP_CTRL_SQUARE 0x00008000

So if we wanted to activate our cheat on START+LTRIGGER, then the right value is 0x108 (add the values together).
I want to try making a "toggle" cheat. Here goes nothing!

_L 0xD0000001 0x10004100 #If X+L is not pushed, skip next 2 lines
_L 0xD0000001 0x10004200 #If X+R is not pushed, skip next 2 lines

The full thing:
_S NPJH-50625
_G Nayuta: Endless Trails
_C0 60 FPS Toggle (X+R: On, X+L, Off)
_L 0xD0000001 0x10004100
_L 0x203925A8 0x00000002
_L 0x2022F974 0x3F7D70A4
_L 0xD0000001 0x10004200
_L 0x203925A8 0x00000001
_L 0x2022F974 0x3EFD70A4

Tested and working