├── .gitignore
├── README.md
├── cheat-devices
    ├── cwcheat.md
    ├── mkultra.md
    ├── nitepr.md
    ├── pspar.md
    └── tempar.md
├── guides
    └── ppsspp
    │   ├── creating-cheats-with-ppsspp
    │       ├── assets
    │       │   ├── cheat-engine-determine-cheat-address.png
    │       │   ├── cheat-engine-determine-user-memory-offset.png
    │       │   ├── cheat-engine-memmapped.png
    │       │   ├── cheat-engine-open-process.png
    │       │   ├── ppsspp-breakpoint-hit.png
    │       │   ├── ppsspp-determine-user-memory-offset.png
    │       │   ├── ppsspp-dumping-user-memory.png
    │       │   ├── ppsspp-rewriting-the-game-logic.png
    │       │   ├── ppsspp-setting-a-breakpoint.png
    │       │   └── ps2dis-load-memory-dump.png
    │       └── creating-cheats-with-ppsspp.md
    │   └── introduction.md
└── other
    └── button-activators.md


/.gitignore:
--------------------------------------------------------------------------------
1 | .idea
2 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | ## PSP cheat documentation
 2 | 
 3 | ### Cheat devices
 4 | 
 5 |  * [CWCheat](cheat-devices/cwcheat.md)
 6 |  * [MKUltra](cheat-devices/mkultra.md)
 7 |  * [NitePR](cheat-devices/nitepr.md)
 8 |  * [PSP Action Replay (PSPAR)](cheat-devices/pspar.md)
 9 |  * [TempAR](cheat-devices/tempar.md)
10 |  
11 | ### Other
12 | 
13 |  * [Button activators](other/button-activators.md) 
14 | 
15 | ### Guides
16 | 
17 | #### PPSSPP
18 | 
19 |  * [Introduction](guides/ppsspp/introduction.md)
20 |  * [Creating Cheats with PPSSPP](guides/ppsspp/creating-cheats-with-ppsspp/creating-cheats-with-ppsspp.md)
21 | 


--------------------------------------------------------------------------------
/cheat-devices/cwcheat.md:
--------------------------------------------------------------------------------
  1 | ## CWCheat
  2 | 
  3 | ### Description
  4 | 
  5 | CWCheat by weltall was the first universal cheat device for the PSP. Inspired by the PS2 Action Replay code types
  6 | this cheat device also supports native PS1 Action Replay codes and homebrew software.
  7 | 
  8 | ### Code types
  9 | 
 10 | <table>
 11 |     <tr>
 12 |         <th>Type</th>
 13 |         <th>Description</th>
 14 |     </tr>
 15 |     <tr><th colspan="2">Constant RAM Writes</th></tr>
 16 |     <tr>
 17 |         <td>
 18 |             <code>Type 0x00</code><br />
 19 |             <code>8-bit</code><br />
 20 |             <code>0XXXXXXX YYYYYYYY</code>
 21 |         </td>
 22 |         <td>Writes byte <code>YY</code> to <code>[XXXXXXX]</code>.</td>
 23 |     </tr>
 24 |     <tr>
 25 |         <td>
 26 |             <code>Type 0x01</code><br />
 27 |             <code>16-bit</code><br />
 28 |             <code>1XXXXXXX 0000YYYY</code>
 29 |         </td>
 30 |         <td>Writes halfword <code>YYYY</code> to <code>[XXXXXXX]</code>.</td>
 31 |     </tr>
 32 |     <tr>
 33 |         <td>
 34 |             <code>Type 0x02</code><br />
 35 |             <code>32-bit</code><br />
 36 |             <code>2XXXXXXX 000000YY</code>
 37 |         </td>
 38 |         <td>Writes word <code>YYYYYYYY</code> to <code>[XXXXXXX]</code>.</td>
 39 |     </tr>
 40 |     <tr><th colspan="2">Increment and Decrement Code Types</th></tr>
 41 |     <tr>
 42 |         <td>
 43 |             <code>Type 0x03</code><br />
 44 |             <code>8-bit Increment</code><br />
 45 |             <code>301000YY XXXXXXXX</code>
 46 |         </td>
 47 |         <td>Adds <code>YY</code> to the byte stored at <code>[XXXXXXXX]</code>.</td>
 48 |     </tr>
 49 |     <tr>
 50 |         <td>
 51 |             <code>Type 0x03</code><br />
 52 |             <code>16-bit Increment</code><br />
 53 |             <code>3030YYYY XXXXXXXX</code>
 54 |         </td>
 55 |         <td>Adds <code>YYYY</code> to the halfword stored at <code>[XXXXXXXX]</code>.</td>
 56 |     </tr>
 57 |     <tr>
 58 |         <td>
 59 |             <code>Type 0x03</code><br />
 60 |             <code>32-bit Increment</code><br />
 61 |             <code>30500000 XXXXXXXX</code><br />
 62 |             <code>YYYYYYYY 000000000</code>
 63 |         </td>
 64 |         <td>Adds <code>YYYYYYYY</code> to the word stored at <code>[XXXXXXXX]</code>.</td>
 65 |     </tr>
 66 |     <tr>
 67 |         <td>
 68 |             <code>Type 0x03</code><br />
 69 |             <code>8-bit Decrement</code><br />
 70 |             <code>302000YY XXXXXXXX</code>
 71 |         </td>
 72 |         <td>Subtracts <code>YY</code> from the byte stored at <code>[XXXXXXXX]</code>.</td>
 73 |     </tr>
 74 |     <tr>
 75 |         <td>
 76 |             <code>Type 0x03</code><br />
 77 |             <code>16-bit Decrement</code><br />
 78 |             <code>3040YYYY XXXXXXXX</code>
 79 |         </td>
 80 |         <td>Subtracts <code>YYYY</code> from the halfword stored at <code>[XXXXXXXX]</code>.</td>
 81 |     </tr>
 82 |     <tr>
 83 |         <td>
 84 |             <code>Type 0x03</code><br />
 85 |             <code>32-bit Decrement</code><br />
 86 |             <code>30600000 XXXXXXXX</code><br />
 87 |             <code>YYYYYYYY 000000000</code>
 88 |         </td>
 89 |         <td>Subtracts <code>YYYYYYYY</code> from the word stored at <code>[XXXXXXXX]</code>.</td>
 90 |     </tr>
 91 |     <tr><th colspan="2">Conditional Code Types</th></tr>
 92 |     <tr>
 93 |         <td>
 94 |             <code>Type 0x0D</code><br />
 95 |             <code>8-bit Equal To</code><br />
 96 |             <code>DXXXXXXX 200000YY</code>
 97 |         </td>
 98 |         <td>Checks if <code>YY</code> == (byte at <code>[XXXXXXX]</code>).<br />If not, the following line is not executed (ie. execution status is set to false for 1 line).</td>
 99 |     </tr>
100 |     <tr>
101 |         <td>
102 |             <code>Type 0x0D</code><br />
103 |             <code>8-bit Not Equal To</code><br />
104 |             <code>DXXXXXXX 201000YY</code>
105 |         </td>
106 |         <td>Checks if <code>YY</code> != (byte at <code>[XXXXXXX]</code>).<br />If not, the following line is not executed (ie. execution status is set to false for 1 line).</td>
107 |     </tr>
108 |     <tr>
109 |         <td>
110 |             <code>Type 0x0D</code><br />
111 |             <code>8-bit Less Than</code><br />
112 |             <code>DXXXXXXX 202000YY</code>
113 |         </td>
114 |         <td>Checks if <code>YY</code> < (byte at <code>[XXXXXXX]</code>).<br />If not, the following line is not executed (ie. execution status is set to false for 1 line).</td>
115 |     </tr>
116 |     <tr>
117 |         <td>
118 |             <code>Type 0x0D</code><br />
119 |             <code>8-bit Greater Than</code><br />
120 |             <code>DXXXXXXX 203000YY</code>
121 |         </td>
122 |         <td>Checks if <code>YY</code> > (byte at <code>[XXXXXXX]</code>).<br />If not, the following line is not executed (ie. execution status is set to false for 1 line).</td>
123 |     </tr>
124 |     <tr>
125 |         <td>
126 |             <code>Type 0x0D</code><br />
127 |             <code>16-bit Equal To</code><br />
128 |             <code>DXXXXXXX 0000YYYY</code>
129 |         </td>
130 |         <td>Checks if <code>YYYY</code> == (halfword at <code>[XXXXXXX]</code>).<br />If not, the following line is not executed (ie. execution status is set to false for 1 line).</td>
131 |     </tr>
132 |     <tr>
133 |         <td>
134 |             <code>Type 0x0D</code><br />
135 |             <code>16-bit Not Equal To</code><br />
136 |             <code>DXXXXXXX 0010YYYY</code>
137 |         </td>
138 |         <td>Checks if <code>YYYY</code> != (halfword at <code>[XXXXXXX]</code>).<br />If not, the following line is not executed (ie. execution status is set to false for 1 line).</td>
139 |     </tr>
140 |     <tr>
141 |         <td>
142 |             <code>Type 0x0D</code><br />
143 |             <code>16-bit Less Than</code><br />
144 |             <code>DXXXXXXX 0020YYYY</code>
145 |         </td>
146 |         <td>Checks if <code>YYYY</code> < (halfword at <code>[XXXXXXX]</code>).<br />If not, the following line is not executed (ie. execution status is set to false for 1 line).</td>
147 |     </tr>
148 |     <tr>
149 |         <td>
150 |             <code>Type 0x0D</code><br />
151 |             <code>16-bit Greater Than</code><br />
152 |             <code>DXXXXXXX 0030YYYY</code>
153 |         </td>
154 |         <td>Checks if <code>YYYY</code> > (halfword at <code>[XXXXXXX]</code>).<br />If not, the following line is not executed (ie. execution status is set to false for 1 line).</td>
155 |     </tr>
156 |     <tr><th colspan="2">Multiple Skip Conditional Code Types</th></tr>
157 |     <tr>
158 |         <td>
159 |             <code>Type 0x0E</code><br />
160 |             <code>8-bit Equal To</code><br />
161 |             <code>E1ZZYYYY 0XXXXXXX</code>
162 |         </td>
163 |         <td>Checks if <code>YY</code> == (byte at <code>[XXXXXXX]</code>).<br />If not, the next <code>ZZ</code> are not executed (ie. execution status is set to false for <code>ZZ</code> lines).</td>
164 |     </tr>
165 |     <tr>
166 |         <td>
167 |             <code>Type 0x0E</code><br />
168 |             <code>8-bit Not Equal To</code><br />
169 |             <code>E1ZZYYYY 1XXXXXXX</code>
170 |         </td>
171 |         <td>Checks if <code>YY</code> != (byte at <code>[XXXXXXX]</code>).<br />If not, the next <code>ZZ</code> are not executed (ie. execution status is set to false for <code>ZZ</code> lines).</td>
172 |     </tr>
173 |     <tr>
174 |         <td>
175 |             <code>Type 0x0E</code><br />
176 |             <code>8-bit Less Than</code><br />
177 |             <code>E1ZZYYYY 2XXXXXXX</code>
178 |         </td>
179 |         <td>Checks if <code>YY</code> < (byte at <code>[XXXXXXX]</code>).<br />If not, the next <code>ZZ</code> are not executed (ie. execution status is set to false for <code>ZZ</code> lines).</td>
180 |     </tr>
181 |     <tr>
182 |         <td>
183 |             <code>Type 0x0E</code><br />
184 |             <code>8-bit Greater Than</code><br />
185 |             <code>E1ZZYYYY 3XXXXXXX</code>
186 |         </td>
187 |         <td>Checks if <code>YY</code> > (byte at <code>[XXXXXXX]</code>).<br />If not, the next <code>ZZ</code> are not executed (ie. execution status is set to false for <code>ZZ</code> lines).</td>
188 |     </tr>
189 |     <tr>
190 |         <td>
191 |             <code>Type 0x0E</code><br />
192 |             <code>16-bit Equal To</code><br />
193 |             <code>EZZZYYYY 0XXXXXXX</code>
194 |         </td>
195 |         <td>Checks if <code>YYYY</code> == (halfword at <code>[XXXXXXX]</code>).<br />If not, the next <code>ZZZ</code> are not executed (ie. execution status is set to false for <code>ZZZ</code> lines).</td>
196 |     </tr>
197 |     <tr>
198 |         <td>
199 |             <code>Type 0x0E</code><br />
200 |             <code>16-bit Not Equal To</code><br />
201 |             <code>EZZZYYYY 1XXXXXXX</code>
202 |         </td>
203 |         <td>Checks if <code>YYYY</code> != (halfword at <code>[XXXXXXX]</code>).<br />If not, the next <code>ZZZ</code> are not executed (ie. execution status is set to false for <code>ZZZ</code> lines).</td>
204 |     </tr>
205 |     <tr>
206 |         <td>
207 |             <code>Type 0x0E</code><br />
208 |             <code>16-bit Less Than</code><br />
209 |             <code>EZZZYYYY 2XXXXXXX</code>
210 |         </td>
211 |         <td>Checks if <code>YYYY</code> < (halfword at <code>[XXXXXXX]</code>).<br />If not, the next <code>ZZZ</code> are not executed (ie. execution status is set to false for <code>ZZZ</code> lines).</td>
212 |     </tr>
213 |     <tr>
214 |         <td>
215 |             <code>Type 0x0E</code><br />
216 |             <code>16-bit Greater Than</code><br />
217 |             <code>EZZZYYYY 3XXXXXXX</code>
218 |         </td>
219 |         <td>Checks if <code>YYYY</code> > (halfword at <code>[XXXXXXX]</code>).<br />If not, the next <code>ZZZ</code> are not executed (ie. execution status is set to false for <code>ZZZ</code> lines).</td>
220 |     </tr>
221 |     <tr><th colspan="2">Address Conditional Code Types</th></tr>
222 |     <tr>
223 |         <td>
224 |             <code>Type 0x0D</code><br />
225 |             <code>Address Equal To</code><br />
226 |             <code>DXXXXXXX 4YYYYYYY</code><br />
227 |             <code>ZZZZZZZZ 0000000W</code>
228 |         </td>
229 |         <td>Checks if value at <code>[XXXXXXX]</code> == value at <code>[YYYYYYY]</code>.<br />If not, the next <code>ZZZZZZZZ</code> lines are not executed (ie. execution status is set to false for <code>ZZZ</code> lines).<br /><code>W</code> = Address type; 0 - 8-bit, 1 - 16-bit, 2 - 32-bit</td>
230 |     </tr>
231 |     <tr>
232 |         <td>
233 |             <code>Type 0x0D</code><br />
234 |             <code>Address Not Equal To</code><br />
235 |             <code>DXXXXXXX 5YYYYYYY</code><br />
236 |             <code>ZZZZZZZZ 0000000W</code>
237 |         </td>
238 |         <td>Checks if value at <code>[XXXXXXX]</code> != value at <code>[YYYYYYY]</code>.<br />If not, the next <code>ZZZZZZZZ</code> lines are not executed (ie. execution status is set to false for <code>ZZZ</code> lines).<br /><code>W</code> = Address type; 0 - 8-bit, 1 - 16-bit, 2 - 32-bit</td>
239 |     </tr>
240 |     <tr>
241 |         <td>
242 |             <code>Type 0x0D</code><br />
243 |             <code>Address Less Than</code><br />
244 |             <code>DXXXXXXX 6YYYYYYY</code><br />
245 |             <code>ZZZZZZZZ 0000000W</code>
246 |         </td>
247 |         <td>Checks if value at <code>[XXXXXXX]</code> < value at <code>[YYYYYYY]</code>.<br />If not, the next <code>ZZZZZZZZ</code> lines are not executed (ie. execution status is set to false for <code>ZZZ</code> lines).<br /><code>W</code> = Address type; 0 - 8-bit, 1 - 16-bit, 2 - 32-bit</td>
248 |     </tr>
249 |     <tr>
250 |         <td>
251 |             <code>Type 0x0D</code><br />
252 |             <code>Address Greater Than</code><br />
253 |             <code>DXXXXXXX 7YYYYYYY</code><br />
254 |             <code>ZZZZZZZZ 0000000W</code>
255 |         </td>
256 |         <td>Checks if value at <code>[XXXXXXX]</code> > value at <code>[YYYYYYY]</code>.<br />If not, the next <code>ZZZZZZZZ</code> lines are not executed (ie. execution status is set to false for <code>ZZZ</code> lines).<br /><code>W</code> = Address type; 0 - 8-bit, 1 - 16-bit, 2 - 32-bit</td>
257 |     </tr>
258 |     <tr><th colspan="2">Boolean Code Types</th></tr>
259 |     <tr>
260 |         <td>
261 |             <code>Type 0x07</code><br />
262 |             <code>8-bit OR</code><br />
263 |             <code>7XXXXXXX 000000YY</code>
264 |         </td>
265 |         <td>Writes byte (byte at <code>[XXXXXXX]</code> OR <code>YY</code>) to <code>[XXXXXXX]</code>.</td>
266 |     </tr>
267 |     <tr>
268 |         <td>
269 |             <code>Type 0x07</code><br />
270 |             <code>8-bit AND</code><br />
271 |             <code>7XXXXXXX 000200YY</code>
272 |         </td>
273 |         <td>Writes byte (byte at <code>[XXXXXXX]</code> AND <code>YY</code>) to <code>[XXXXXXX]</code>.</td>
274 |     </tr>
275 |     <tr>
276 |         <td>
277 |             <code>Type 0x07</code><br />
278 |             <code>8-bit XOR</code><br />
279 |             <code>7XXXXXXX 000400YY</code>
280 |         </td>
281 |         <td>Writes byte (byte at <code>[XXXXXXX]</code> XOR <code>YY</code>) to <code>[XXXXXXX]</code>.</td>
282 |     </tr>
283 |     <tr>
284 |         <td>
285 |             <code>Type 0x07</code><br />
286 |             <code>16-bit OR</code><br />
287 |             <code>7XXXXXXX 000100YY</code>
288 |         </td>
289 |         <td>Writes halfword (halfword at <code>[XXXXXXX]</code> OR <code>YYYY</code>) to <code>[XXXXXXX]</code>.</td>
290 |     </tr>
291 |     <tr>
292 |         <td>
293 |             <code>Type 0x07</code><br />
294 |             <code>16-bit AND</code><br />
295 |             <code>7XXXXXXX 000300YY</code>
296 |         </td>
297 |         <td>Writes halfword (halfword at <code>[XXXXXXX]</code> AND <code>YYYY</code>) to <code>[XXXXXXX]</code>.</td>
298 |     </tr>
299 |     <tr>
300 |         <td>
301 |             <code>Type 0x07</code><br />
302 |             <code>16-bit XOR</code><br />
303 |             <code>7XXXXXXX 000500YY</code>
304 |         </td>
305 |         <td>Writes halfword (halfword at <code>[XXXXXXX]</code> XOR <code>YYYY</code>) to <code>[XXXXXXX]</code>.</td>
306 |     </tr>
307 |     <tr><th colspan="2">Pointer Code Types</th></tr>
308 |     <tr>
309 |         <td>
310 |             <code>Type 0x06</code><br />
311 |             <code>8-bit</code><br />
312 |             <code>...</code>
313 |         </td>
314 |         <td>TODO... well the TODO has been here since at least 2011... I don't know if I'm ever going to do it at this point.</td>
315 |     </tr>
316 |     <tr><th colspan="2">Miscellaneous Code Types</th></tr>
317 |     <tr>
318 |         <td>
319 |             <code>Type 0x0D</code><br />
320 |             <code>Button Press</code><br />
321 |             <code>D00000YY 1XXXXXXX</code>
322 |         </td>
323 |         <td>Checks if <code>ctrl & XXXXXXX</code> == <code>XXXXXXX</code>.<br />If not, the next <code>YY+1</code> lines are not executed (ie. execution status is set to false for <code>YY+1</code> lines). See <a href="../other/button-activators.md">button activators</a> for possible values.</td>
324 |     </tr>
325 |     <tr>
326 |         <td>
327 |             <code>Type 0x0D</code><br />
328 |             <code>Inverse Button Press</code><br />
329 |             <code>D00000YY 3XXXXXXX</code>
330 |         </td>
331 |         <td>Checks if <code>ctrl & XXXXXXX</code> != <code>XXXXXXX</code>.<br />If not, the next <code>YY+1</code> lines are not executed (ie. execution status is set to false for <code>YY+1</code> lines). See <a href="../other/button-activators.md">button activators</a> for possible values.</td>
332 |     </tr>
333 |     <tr>
334 |         <td>
335 |             <code>Type 0x05</code><br />
336 |             <code>Copy Bytes</code><br />
337 |             <code>5XXXXXXX ZZZZZZZZ</code><br />
338 |             <code>0YYYYYYY 0000000</code>
339 |         </td>
340 |         <td>Copies <code>ZZZZZZZZ</code> bytes from <code>[XXXXXXX]</code> to <code>[YYYYYYY]</code>.</td>
341 |     </tr>
342 |     <tr>
343 |         <td>
344 |             <code>Type 0x04</code><br />
345 |             <code>32-bit Multi Write</code><br />
346 |             <code>4XXXXXXX YYYYZZZZ</code><br />
347 |             <code>VVVVVVVV WWWWWWWW</code>
348 |         </td>
349 |         <td>Starting at address <code>[XXXXXXX]</code>, this code will loop <code>YYYY</code> times.<br />The next address is determined by the incrementing the current address by (ZZZZ * 4).<br />The value written to the address is specified by <code>VVVVVVVV+(WWWWWWWW * loop count)</code>.</td>
350 |     </tr>
351 |     <tr>
352 |         <td>
353 |             <code>Type 0x0B</code><br />
354 |             <code>Pause</code><br />
355 |             <code>B0000000 XXXXXXXX</code>
356 |         </td>
357 |         <td>Delays the code engine for <code>XXXXXXXX</code> cycles. Will delay the application of all following code lines.<br />Simply performs <code>sceKernelDelayThread(XXXXXXXX)</code>, hopefully this is what CWCheat does when this code type is encountered.</td>
358 |     </tr>
359 |     <tr>
360 |         <td>
361 |             <code>Type 0x0C</code><br />
362 |             <code>32-bit Equal To</code><br />
363 |             <code>CXXXXXXX YYYYYYYY</code>
364 |         </td>
365 |         <td>Checks if <code>YYYYYYYY</code> == (word at <code>[XXXXXXX]</code>).<br />If not, the remainder of the code is not executed (ie. execution status is set to false until the next cheat is reached).</td>
366 |     </tr>
367 | </table>
368 | 


--------------------------------------------------------------------------------
/cheat-devices/mkultra.md:
--------------------------------------------------------------------------------
 1 | ## MKUltra
 2 | 
 3 | ### Description
 4 | 
 5 | MKUltra by RedHate is a mod of NitePR which features a number of changes including register highlighting for the
 6 | disassembler, POPS support, improved copier, configurable colours, support for more MIPS opcodes and an additional
 7 | code type.
 8 | 
 9 | ### Code types
10 | 
11 | Supports the same code types as [NitePR](nitepr.md) in addition to the below.
12 | 
13 | <table>
14 |     <tr>
15 |         <th>Type</th>
16 |         <th>Description</th>
17 |     </tr>
18 |     <tr><th colspan="2">Button Press Code Types</th></tr>
19 |     <tr>
20 |         <td>
21 |             <code>Type 0xFF</code><br />
22 |             <code>Button Press</code><br />
23 |             <code>FFYYYYYY 0XXXXXXX</code>
24 |         </td>
25 |         <td>Checks if <code>YYYYYY</code> == <code>(value at [XXXXXXX]) & YYYYYY</code>.<br />If not, the code(s) following this one are not executed.</td>
26 |     </tr>
27 | </table>
28 | 


--------------------------------------------------------------------------------
/cheat-devices/nitepr.md:
--------------------------------------------------------------------------------
 1 | ## NitePR
 2 | 
 3 | ### Description
 4 | 
 5 | NitePR by SANiK is widely known for its online cheating capabilities and open source license. NitePR supports a
 6 | very limited set of code types.
 7 | 
 8 | ### Code types
 9 | 
10 | <table>
11 |     <tr>
12 |         <th>Type</th>
13 |         <th>Description</th>
14 |     </tr>
15 |     <tr><th colspan="2">Constant RAM Writes</th></tr>
16 |     <tr>
17 |         <td>
18 |             <code>32-bit</code><br />
19 |             <code>0XXXXXXX YYYYYYYY</code>
20 |         </td>
21 |         <td>Writes word <code>YYYYYYYY</code> to <code>[XXXXXXX+offset]</code>.</td>
22 |     </tr>
23 |     <tr>
24 |         <td>
25 |             <code>16-bit</code><br />
26 |             <code>0XXXXXXX YYYY</code>
27 |         </td>
28 |         <td>Writes halfword <code>YYYY</code> to <code>[XXXXXXX+offset]</code>.</td>
29 |     </tr>
30 |     <tr>
31 |         <td>
32 |             <code>8-bit</code><br />
33 |             <code>0XXXXXXX YY</code>
34 |         </td>
35 |         <td>Writes byte <code>YY</code> to <code>[XXXXXXX+offset]</code>.</td>
36 |     </tr>
37 |     <tr><th colspan="2">Pointer Code Types</th></tr>
38 |     <tr>
39 |         <td>
40 |             <code>Type 0xFFFFFFFF</code><br />
41 |             <code>Load Offset</code><br />
42 |             <code>FFFFFFFF 0XXXXXXX</code>
43 |         </td>
44 |         <td>Loads the 32-bit value into the <code>offset</code>.<br /><code>offset</code> = word at <code>[XXXXXXX]</code>.</td>
45 |     </tr>
46 | </table>
47 | 


--------------------------------------------------------------------------------
/cheat-devices/pspar.md:
--------------------------------------------------------------------------------
  1 | ## PSP Action Replay (PSPAR)
  2 | 
  3 | ### Description
  4 | 
  5 | PSP Action Replay is the first commercial cheat device for the PSP. The first PSPAR (released October 2008) used the
  6 | Pandora exploit to launch the software on PSP-1000 and early PSP-2000 consoles. A newer version released in
  7 | December 2009 used a signed binary installed in the UPDATE folder and launched directly from the XMB.
  8 | 
  9 | ### Code types
 10 | 
 11 | <table>
 12 |     <tr>
 13 |         <th>Type</th>
 14 |         <th>Description</th>
 15 |     </tr>
 16 |     <tr><th colspan="2">Constant RAM Writes</th></tr>
 17 |     <tr>
 18 |         <td>
 19 |             <code>Type 0x00</code><br />
 20 |             <code>32-bit</code><br />
 21 |             <code>0XXXXXXX YYYYYYYY</code>
 22 |         </td>
 23 |         <td>Writes word <code>YYYYYYYY</code> to <code>[XXXXXXX+offset]</code>.</td>
 24 |     </tr>
 25 |     <tr>
 26 |         <td>
 27 |             <code>Type 0x01</code><br />
 28 |             <code>16-bit</code><br />
 29 |             <code>1XXXXXXX 0000YYYY</code>
 30 |         </td>
 31 |         <td>Writes halfword <code>YYYY</code> to <code>[XXXXXXX+offset]</code>.</td>
 32 |     </tr>
 33 |     <tr>
 34 |         <td>
 35 |             <code>Type 0x02</code><br />
 36 |             <code>8-bit</code><br />
 37 |             <code>2XXXXXXX 000000YY</code>
 38 |         </td>
 39 |         <td>Writes byte <code>YY</code> to <code>[XXXXXXX+offset]</code>.</td>
 40 |     </tr>
 41 |     <tr><th colspan="2">Conditional 32-bit Code Types</th></tr>
 42 |     <tr>
 43 |         <td>
 44 |             <code>Type 0x03</code><br />
 45 |             <code>Greater Than</code><br />
 46 |             <code>3XXXXXXX YYYYYYYY</code>
 47 |         </td>
 48 |         <td>Checks if <code>YYYYYYYY</code> > (word at <code>[XXXXXXX]</code> or <code>[offset]</code> if <code>[XXXXXXX]</code> is 0)<br />If not, the code(s) following this one are not executed (ie. execution status is set to false) until a code type <code>D0</code> or <code>D2</code> is encountered, or until the end of thecode list is reached.</td>
 49 |     </tr>
 50 |     <tr>
 51 |         <td>
 52 |             <code>Type 0x04</code><br />
 53 |             <code>Less Than</code><br />
 54 |             <code>4XXXXXXX YYYYYYYY</code>
 55 |         </td>
 56 |         <td>Checks if <code>YYYYYYYY</code> < (word at <code>[XXXXXXX]</code> or <code>[offset]</code> if <code>[XXXXXXX]</code> is 0)<br />If not, the code(s) following this one are not executed (ie. execution status is set to false) until a code type <code>D0</code> or <code>D2</code> is encountered, or until the end of thecode list is reached.</td>
 57 |     </tr>
 58 |     <tr>
 59 |         <td>
 60 |             <code>Type 0x05</code><br />
 61 |             <code>Equal To</code><br />
 62 |             <code>5XXXXXXX YYYYYYYY</code>
 63 |         </td>
 64 |         <td>Checks if <code>YYYYYYYY</code> == (word at <code>[XXXXXXX]</code> or <code>[offset]</code> if <code>[XXXXXXX]</code> is 0)<br />If not, the code(s) following this one are not executed (ie. execution status is set to false) until a code type <code>D0</code> or <code>D2</code> is encountered, or until the end of thecode list is reached.</td>
 65 |     </tr>
 66 |     <tr>
 67 |         <td>
 68 |             <code>Type 0x06</code><br />
 69 |             <code>Not Equal To</code><br />
 70 |             <code>6XXXXXXX YYYYYYYY</code>
 71 |         </td>
 72 |         <td>Checks if <code>YYYYYYYY</code> != (word at <code>[XXXXXXX]</code> or <code>[offset]</code> if <code>[XXXXXXX]</code> is 0)<br />If not, the code(s) following this one are not executed (ie. execution status is set to false) until a code type <code>D0</code> or <code>D2</code> is encountered, or until the end of thecode list is reached.</td>
 73 |     </tr>
 74 |     <tr><th colspan="2">Conditional 16-bit + Masking Code Types</th></tr>
 75 |     <tr>
 76 |         <td>
 77 |             <code>Type 0x07</code><br />
 78 |             <code>Greater Than</code><br />
 79 |             <code>7XXXXXXX ZZZZYYYY</code>
 80 |         </td>
 81 |         <td>Checks if <code>YYYY</code> > (not <code>ZZZZ</code> < halfword at <code>[XXXXXXX]</code> or <code>[offset]</code> if <code>[XXXXXXX]</code> is 0).<br />If not, the code(s) following this one are not executed (ie. execution status is set to false) until a code type <code>D0</code> or <code>D2</code> is encountered, or until the end of the code list is reached.</td>
 82 |     </tr>
 83 |     <tr>
 84 |         <td>
 85 |             <code>Type 0x08</code><br />
 86 |             <code>Less Than</code><br />
 87 |             <code>8XXXXXXX ZZZZYYYY</code>
 88 |         </td>
 89 |         <td>Checks if <code>YYYY</code> < (not <code>ZZZZ</code> < halfword at <code>[XXXXXXX]</code> or <code>[offset]</code> if <code>[XXXXXXX]</code> is 0).<br />If not, the code(s) following this one are not executed (ie. execution status is set to false) until a code type <code>D0</code> or <code>D2</code> is encountered, or until the end of the code list is reached.</td>
 90 |     </tr>
 91 |     <tr>
 92 |         <td>
 93 |             <code>Type 0x09</code><br />
 94 |             <code>Equal To</code><br />
 95 |             <code>9XXXXXXX ZZZZYYYY</code>
 96 |         </td>
 97 |         <td>Checks if <code>YYYY</code> == (not <code>ZZZZ</code> < halfword at <code>[XXXXXXX]</code> or <code>[offset]</code> if <code>[XXXXXXX]</code> is 0).<br />If not, the code(s) following this one are not executed (ie. execution status is set to false) until a code type <code>D0</code> or <code>D2</code> is encountered, or until the end of the code list is reached.</td>
 98 |     </tr>
 99 |     <tr>
100 |         <td>
101 |             <code>Type 0x0A</code><br />
102 |             <code>Not Equal To</code><br />
103 |             <code>AXXXXXXX ZZZZYYYY</code>
104 |         </td>
105 |         <td>Checks if <code>YYYY</code> != (not <code>ZZZZ</code> < halfword at <code>[XXXXXXX]</code> or <code>[offset]</code> if <code>[XXXXXXX]</code> is 0).<br />If not, the code(s) following this one are not executed (ie. execution status is set to false) until a code type <code>D0</code> or <code>D2</code> is encountered, or until the end of the code list is reached.</td>
106 |     </tr>
107 |     <tr><th colspan="2">Offset Codes</th></tr>
108 |     <tr>
109 |         <td>
110 |             <code>Type 0x0B</code><br />
111 |             <code>Load Offset</code><br />
112 |             <code>BXXXXXXX 00000000</code>
113 |         </td>
114 |         <td>Loads the 32-bit value into the 'offset'.<br />Offset = word at <code>[XXXXXXX+offset]</code>.</td>
115 |     </tr>
116 |     <tr>
117 |         <td>
118 |             <code>Type 0xC4</code><br />
119 |             <code>Safe Data Store</code><br />
120 |             <code>C4000000 XXXXXXXX</code>
121 |         </td>
122 |         <td>Sets the offset value to point to the first word of this code. Storing data at offset+0x4 will save over the top of <code>XXXXXXXX</code>.</td>
123 |     </tr>
124 |     <tr>
125 |         <td>
126 |             <code>Type 0xC6</code><br />
127 |             <code>Write Offset</code><br />
128 |             <code>C6000000 XXXXXXXX</code>
129 |         </td>
130 |         <td>Writes the offset value to <code>[XXXXXXXX]</code>.</td>
131 |     </tr>
132 |     <tr>
133 |         <td>
134 |             <code>Type 0xD3</code><br />
135 |             <code>Set Offset</code><br />
136 |             <code>D3000000 XXXXXXXX</code>
137 |         </td>
138 |         <td>Sets the offset value to <code>XXXXXXXX</code>.</td>
139 |     </tr>
140 |     <tr>
141 |         <td>
142 |             <code>Type 0xDC</code><br />
143 |             <code>Add Offset</code><br />
144 |             <code>DC000000 XXXXXXXX</code>
145 |         </td>
146 |         <td>Adds <code>XXXXXXXX</code> to the current offset (Dual Offset).</td>
147 |     </tr>
148 |     <tr><th colspan="2">Loop Codes</th></tr>
149 |     <tr>
150 |         <td>
151 |             <code>Type 0x0C</code><br />
152 |             <code>C0000000 YYYYYYYY</code>
153 |         </td>
154 |         <td>This sets the 'Dx repeat value' to <code>YYYYYYYY</code> and saves the 'Dx nextcode to be executed' and the 'Dx execution status'. Repeat will be executed when a <code>D1</code>/<code>D2</code> code is encountered.<br />When repeat is executed, the AR reloads the 'next code to be executed' and the 'execution status' from the Dx registers.</td>
155 |     </tr>
156 |     <tr><th colspan="2">Terminator Codes</th></tr>
157 |     <tr>
158 |         <td>
159 |             <code>Type 0xD0</code><br />
160 |             <code>Terminator</code><br />
161 |             <code>D0000000 00000000</code>
162 |         </td>
163 |         <td>Loads the previous execution status. If none exists, the execution status stays at 'execute codes'.</td>
164 |     </tr>
165 |     <tr>
166 |         <td>
167 |             <code>Type 0xD1</code><br />
168 |             <code>Loop Execute Variant</code><br />
169 |             <code>D1000000 00000000</code>
170 |         </td>
171 |         <td>Executes the next block of codes 'n' times (specified by the <code>0x0C</code> codetype), but doesn't clear the Dx register upon completion.</td>
172 |     </tr>
173 |     <tr>
174 |         <td>
175 |             <code>Type 0xD2</code><br />
176 |             <code>Loop Execute Variant / Full Terminator</code><br />
177 |             <code>D2000000 00000000</code>
178 |         </td>
179 |         <td>Executes the next block of codes 'n' times (specified by the <code>0x0C</code> codetype), and clears all temporary data. (i.e. execution status, offsets, code C settings, etc.)<br />This code can also be used as a full terminator, giving the same effects to any block of code.</td>
180 |     </tr>
181 |     <tr><th colspan="2">Data Register Codes</th></tr>
182 |     <tr>
183 |         <td>
184 |             <code>Type 0xD4</code><br />
185 |             <code>Add Value</code><br />
186 |             <code>D4000000 XXXXXXXX</code>
187 |         </td>
188 |         <td>Adds <code>XXXXXXXX</code> to the 'Dx data register'.</td>
189 |     </tr>
190 |     <tr>
191 |         <td>
192 |             <code>Type 0xD5</code><br />
193 |             <code>Set Value</code><br />
194 |             <code>D5000000 XXXXXXXX</code>
195 |         </td>
196 |         <td>Set <code>XXXXXXXX</code> to the 'Dx data register'.</td>
197 |     </tr>
198 |     <tr>
199 |         <td>
200 |             <code>Type 0xD6</code><br />
201 |             <code>32-bit Incrementive Write</code><br />
202 |             <code>D6000000 XXXXXXXX</code>
203 |         </td>
204 |         <td>Writes the 'Dx data register' word to <code>[XXXXXXXX+offset]</code>, and increments the offset by 4.</td>
205 |     </tr>
206 |     <tr>
207 |         <td>
208 |             <code>Type 0xD7</code><br />
209 |             <code>16-bit Incrementive Write</code><br />
210 |             <code>D7000000 XXXXXXXX</code>
211 |         </td>
212 |         <td>Writes the 'Dx data register' halfword to <code>[XXXXXXXX+offset]</code>, and increments the offset by 2.</td>
213 |     </tr>
214 |     <tr>
215 |         <td>
216 |             <code>Type 0xD8</code><br />
217 |             <code>8-bit Incrementive Write</code><br />
218 |             <code>D8000000 XXXXXXXX</code>
219 |         </td>
220 |         <td>Writes the 'Dx data register' byte to <code>[XXXXXXXX+offset]</code>, and increments the offset by 1.</td>
221 |     </tr>
222 |     <tr>
223 |         <td>
224 |             <code>Type 0xD9</code><br />
225 |             <code>32-bit Load</code><br />
226 |             <code>D9000000 XXXXXXXX</code>
227 |         </td>
228 |         <td>Loads the word at <code>[XXXXXXXX+offset]</code> and stores it in the'Dx data register'.</td>
229 |     </tr>
230 |     <tr>
231 |         <td>
232 |             <code>Type 0xDA</code><br />
233 |             <code>16-bit Load</code><br />
234 |             <code>DA000000 XXXXXXXX</code>
235 |         </td>
236 |         <td>Loads the halfword at <code>[XXXXXXXX+offset]</code> and stores it in the'Dx data register'.</td>
237 |     </tr>
238 |     <tr>
239 |         <td>
240 |             <code>Type 0xDB</code><br />
241 |             <code>8-bit Load</code><br />
242 |             <code>DB000000 XXXXXXXX</code>
243 |         </td>
244 |         <td>Loads the byte at <code>[XXXXXXXX+offset]</code> and stores it in the'Dx data register'.</td>
245 |     </tr>
246 |     <tr><th colspan="2">Miscellaneous Codes</th></tr>
247 |     <tr>
248 |         <td>
249 |             <code>Type 0x0E</code><br />
250 |             <code>Patch Code</code><br />
251 |             <code>EXXXXXXX YYYYYYYY</code>
252 |         </td>
253 |         <td>Copies <code>YYYYYYYY</code> bytes from directly after the <code>0xE</code> code line to <code>[XXXXXXXX+offset]</code>.</td>
254 |     </tr>
255 |     <tr>
256 |         <td>
257 |             <code>Type 0x0F</code><br />
258 |             <code>Memory Copy Code</code><br />
259 |             <code>FXXXXXXX YYYYYYYY</code>
260 |         </td>
261 |         <td>Copy <code>YYYYYYYY</code> bytes from offset to <code>XXXXXXX</code> (<code>XXXXXXX</code> is fixed, no offsets are added to it).</td>
262 |     </tr>
263 |     <tr><th colspan="2">Folder/Comment Codes</th></tr>
264 |     <tr>
265 |         <td>
266 |             <code>Type 0xCF</code><br />
267 |             <code>Single Select Folder</code><br />
268 |             <code>CF000000 XXXXXXXX</code>
269 |         </td>
270 |         <td>Sets the cheat as a single select folder and the next <code>XXXXXXXX</code> items (codes, folders and comments) will be subitems of the current item.</td>
271 |     </tr>
272 |     <tr>
273 |         <td>
274 |             <code>Type 0xCF</code><br />
275 |             <code>Comment</code><br />
276 |             <code>CF000001 XXXXXXXX</code>
277 |         </td>
278 |         <td>Sets the cheat as a comment and the next <code>XXXXXXXX</code> items will also be treated as comments.</td>
279 |     </tr>
280 |     <tr>
281 |         <td>
282 |             <code>Type 0xCF</code><br />
283 |             <code>Multi Select Folder</code><br />
284 |             <code>CF000002 XXXXXXXX</code>
285 |         </td>
286 |         <td>Sets the cheat as a folder and the next <code>XXXXXXXX</code> items (codes, folders and comments) will be subitems of the current item.</td>
287 |     </tr>
288 | </table>
289 | 


--------------------------------------------------------------------------------
/cheat-devices/tempar.md:
--------------------------------------------------------------------------------
  1 | ## TempAR
  2 | 
  3 | ### Description
  4 | 
  5 | TempAR by raing3 is a mod of NitePR which was updated to support PSPAR and CWCheat code types as well as additional
  6 | code types inspired by NitroHax for the DS.
  7 | 
  8 | ### Code types
  9 | 
 10 | <table>
 11 |     <tr>
 12 |         <th>Type</th>
 13 |         <th>Description</th>
 14 |     </tr>
 15 |     <tr><th colspan="2">Conditional 32-bit Code Types</th></tr>
 16 |     <tr>
 17 |         <td>
 18 |             <code>Type 0x03</code><br />
 19 |             <code>Greater Than</code><br />
 20 |             <code>3XXXXXXX YYYYYYYY</code>
 21 |         </td>
 22 |         <td>Same as PSPAR engine except if lowest bit of address is set the offset is added to the address.</td>
 23 |     </tr>
 24 |     <tr>
 25 |         <td>
 26 |             <code>Type 0x04</code><br />
 27 |             <code>Less Than</code><br />
 28 |             <code>4XXXXXXX YYYYYYYY</code>
 29 |         </td>
 30 |         <td>Same as PSPAR engine except if lowest bit of address is set the offset is added to the address.</td>
 31 |     </tr>
 32 |     <tr>
 33 |         <td>
 34 |             <code>Type 0x05</code><br />
 35 |             <code>Equal To</code><br />
 36 |             <code>5XXXXXXX YYYYYYYY</code>
 37 |         </td>
 38 |         <td>Same as PSPAR engine except if lowest bit of address is set the offset is added to the address.</td>
 39 |     </tr>
 40 |     <tr>
 41 |         <td>
 42 |             <code>Type 0x06</code><br />
 43 |             <code>Not Equal To</code><br />
 44 |             <code>6XXXXXXX YYYYYYYY</code>
 45 |         </td>
 46 |         <td>Same as PSPAR engine except if lowest bit of address is set the offset is added to the address.</td>
 47 |     </tr>
 48 |     <tr><th colspan="2">Conditional 16-bit + Masking Code Types</th></tr>
 49 |     <tr>
 50 |         <td>
 51 |             <code>Type 0x07</code><br />
 52 |             <code>Greater Than</code><br />
 53 |             <code>7XXXXXXX ZZZZYYYY</code>
 54 |         </td>
 55 |         <td>Same as PSPAR engine except if lowest bit of address is set the offset is added to the address.</td>
 56 |     </tr>
 57 |     <tr>
 58 |         <td>
 59 |             <code>Type 0x08</code><br />
 60 |             <code>Less Than</code><br />
 61 |             <code>8XXXXXXX ZZZZYYYY</code>
 62 |         </td>
 63 |         <td>Same as PSPAR engine except if lowest bit of address is set the offset is added to the address.</td>
 64 |     </tr>
 65 |     <tr>
 66 |         <td>
 67 |             <code>Type 0x09</code><br />
 68 |             <code>Equal To</code><br />
 69 |             <code>9XXXXXXX ZZZZYYYY</code>
 70 |         </td>
 71 |         <td>Same as PSPAR engine except if lowest bit of address is set the offset is added to the address.</td>
 72 |     </tr>
 73 |     <tr>
 74 |         <td>
 75 |             <code>Type 0x0A</code><br />
 76 |             <code>Not Equal To</code><br />
 77 |             <code>AXXXXXXX ZZZZYYYY</code>
 78 |         </td>
 79 |         <td>Same as PSPAR engine except if lowest bit of address is set the offset is added to the address.</td>
 80 |     </tr>
 81 |     <tr><th colspan="2">Data Register Codes</th></tr>
 82 |     <tr>
 83 |         <td>
 84 |             <code>Type 0xD4</code><br />
 85 |             <code>Dx Data Operation</code><br />
 86 |             <code>D400000Y XXXXXXXX</code>
 87 |         </td>
 88 |         <td>Sets the 'Dx data register' to Data = <code>? XXXXXXXX</code> where ? is determined by <code>Y</code> as follows:<br />0 - add<br />1 - or<br />2 - and<br />3 - xor<br />4 - logical shift left<br />5 - logical shift right<br />6 - rotate right<br />7 - arithmetic shift right<br />8 - multiply</td>
 89 |     </tr>
 90 |     <tr><th colspan="2">Miscellaneous Codes</th></tr>
 91 |     <tr>
 92 |         <td>
 93 |             <code>Type 0xC1</code><br />
 94 |             <code>Call Function with Arguments</code><br />
 95 |             <code>C100000Y XXXXXXXX</code><br />
 96 |             <code>AAAAAAAA BBBBBBBB</code><br />
 97 |             <code>CCCCCCCC DDDDDDDD</code>
 98 |         </td>
 99 |         <td>Performs a jal to the function at <code>XXXXXXXX</code>. The number of arguments to pass to the function is specified by <code>Y</code>.<br />a0 = <code>0xAAAAAAAA</code><br />a1 = <code>0xBBBBBBBB</code><br />a2 = <code>0xCCCCCCCC</code><br />a3 = <code>0xDDDDDDDD</code>.</td>
100 |     </tr>
101 |     <tr>
102 |         <td>
103 |             <code>Type 0xC2</code><br />
104 |             <code>Run Code From Cheat List</code><br />
105 |             <code>C2000000 XXXXXXXX</code>
106 |         </td>
107 |         <td>Performs a jal to the function directly after the <code>0xC2</code> code line. The length of function is specified by <code>XXXXXXXX</code>.</td>
108 |     </tr>
109 |     <tr>
110 |         <td>
111 |             <code>Type 0xC5</code><br />
112 |             <code>Counter</code><br />
113 |             <code>C5000000 ZZZZYYYY</code>
114 |         </td>
115 |         <td>Checks if <code>YYYY</code> == (not <code>ZZZZ</code> < cheat apply count).<br />If not, the code(s) following this one are not executed (ie. execution status is set to false) until a code type <code>D0</code> or <code>D2</code> is encountered, or until the end of the code list is reached.</td>
116 |     </tr>
117 | </table>
118 | 
119 | ### Fake addresses
120 | 
121 | Fake address are used to return system information which either can't be accessed from memory or does not have a
122 | static address. These are intended to simplify the process of cheat creation / conversion from other cheat devices.
123 | 
124 | Presently these addresses can only be accessed using the exact address listed
125 | (ie. no 8/16-bit retrieval of the upper return bits).
126 | 
127 | <table>
128 |     <tr>
129 |         <th>Address</th>
130 |         <th>Return Value</th>
131 |     </tr>
132 |     <tr>
133 |         <td>0x0A000000</td>
134 |         <td>Pressed buttons. See <a href="../other/button-activators.md">button activators</a> for possible values.</td>
135 |     </tr>
136 |     <tr>
137 |         <td>0x0A000004</td>
138 |         <td>X-axis of analog nub.</td>
139 |     </tr>
140 |     <tr>
141 |         <td>0x0A000008</td>
142 |         <td>Y-axis of analog nub.</td>
143 |     </tr>
144 | </table>


--------------------------------------------------------------------------------
/guides/ppsspp/creating-cheats-with-ppsspp/assets/cheat-engine-determine-cheat-address.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/raing3/psp-cheat-documentation/e1d9e12fb30ab7d1410f5bfebc1e1d862bfe264f/guides/ppsspp/creating-cheats-with-ppsspp/assets/cheat-engine-determine-cheat-address.png


--------------------------------------------------------------------------------
/guides/ppsspp/creating-cheats-with-ppsspp/assets/cheat-engine-determine-user-memory-offset.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/raing3/psp-cheat-documentation/e1d9e12fb30ab7d1410f5bfebc1e1d862bfe264f/guides/ppsspp/creating-cheats-with-ppsspp/assets/cheat-engine-determine-user-memory-offset.png


--------------------------------------------------------------------------------
/guides/ppsspp/creating-cheats-with-ppsspp/assets/cheat-engine-memmapped.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/raing3/psp-cheat-documentation/e1d9e12fb30ab7d1410f5bfebc1e1d862bfe264f/guides/ppsspp/creating-cheats-with-ppsspp/assets/cheat-engine-memmapped.png


--------------------------------------------------------------------------------
/guides/ppsspp/creating-cheats-with-ppsspp/assets/cheat-engine-open-process.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/raing3/psp-cheat-documentation/e1d9e12fb30ab7d1410f5bfebc1e1d862bfe264f/guides/ppsspp/creating-cheats-with-ppsspp/assets/cheat-engine-open-process.png


--------------------------------------------------------------------------------
/guides/ppsspp/creating-cheats-with-ppsspp/assets/ppsspp-breakpoint-hit.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/raing3/psp-cheat-documentation/e1d9e12fb30ab7d1410f5bfebc1e1d862bfe264f/guides/ppsspp/creating-cheats-with-ppsspp/assets/ppsspp-breakpoint-hit.png


--------------------------------------------------------------------------------
/guides/ppsspp/creating-cheats-with-ppsspp/assets/ppsspp-determine-user-memory-offset.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/raing3/psp-cheat-documentation/e1d9e12fb30ab7d1410f5bfebc1e1d862bfe264f/guides/ppsspp/creating-cheats-with-ppsspp/assets/ppsspp-determine-user-memory-offset.png


--------------------------------------------------------------------------------
/guides/ppsspp/creating-cheats-with-ppsspp/assets/ppsspp-dumping-user-memory.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/raing3/psp-cheat-documentation/e1d9e12fb30ab7d1410f5bfebc1e1d862bfe264f/guides/ppsspp/creating-cheats-with-ppsspp/assets/ppsspp-dumping-user-memory.png


--------------------------------------------------------------------------------
/guides/ppsspp/creating-cheats-with-ppsspp/assets/ppsspp-rewriting-the-game-logic.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/raing3/psp-cheat-documentation/e1d9e12fb30ab7d1410f5bfebc1e1d862bfe264f/guides/ppsspp/creating-cheats-with-ppsspp/assets/ppsspp-rewriting-the-game-logic.png


--------------------------------------------------------------------------------
/guides/ppsspp/creating-cheats-with-ppsspp/assets/ppsspp-setting-a-breakpoint.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/raing3/psp-cheat-documentation/e1d9e12fb30ab7d1410f5bfebc1e1d862bfe264f/guides/ppsspp/creating-cheats-with-ppsspp/assets/ppsspp-setting-a-breakpoint.png


--------------------------------------------------------------------------------
/guides/ppsspp/creating-cheats-with-ppsspp/assets/ps2dis-load-memory-dump.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/raing3/psp-cheat-documentation/e1d9e12fb30ab7d1410f5bfebc1e1d862bfe264f/guides/ppsspp/creating-cheats-with-ppsspp/assets/ps2dis-load-memory-dump.png


--------------------------------------------------------------------------------
/guides/ppsspp/creating-cheats-with-ppsspp/creating-cheats-with-ppsspp.md:
--------------------------------------------------------------------------------
  1 | ## Requirements
  2 | 
  3 |  * PPSSPP: https://www.ppsspp.org/downloads.html
  4 |  * Cheat Engine: http://www.cheatengine.org/downloads.php
  5 |  * ps2dis: http://www.codemasters-project.net/portal-english/apportal/download.php?view.23
  6 | 
  7 | ## Limitations
  8 | 
  9 | PPSSPP is an emulator and does not perfectly emulate games.
 10 | 
 11 | This can lead to cases where memory may be mapped to a different address in the emulator vs. where it would be mapped to on a physical PSP. The address may also shift over time with new releases of the emulator.
 12 | 
 13 | This issue is limited to 
 14 | 
 15 | ## Assumptions
 16 | 
 17 | This guide assumes the following knowledge:
 18 |  * An understanding of common cheat related terms.
 19 |  * How to use search tools to find the address of a value you want to modify.
 20 |  * An understanding of the basic MIPS instructions.
 21 | 
 22 | ## Steps
 23 | 
 24 | ### 1. Launch the game
 25 | 1. Launch PPSSPP and open the game you want to make cheats for.
 26 | 
 27 | ### 2. Attaching Cheat Engine to PPSSPP
 28 | 1. Launch Cheat Engine.
 29 | 2. Click the open process button.
 30 | 3. Select the PPSSPP process from the list.
 31 | 4. Click the "Open" button.
 32 | 5. Ensure the "MEM_MAPPED" setting is enabled in the settings.
 33 | 
 34 | ![Open Process](assets/cheat-engine-open-process.png)
 35 | 
 36 | ![MEM_MAPPED Setting](assets/cheat-engine-memmapped.png)
 37 | 
 38 | ### 3. Determining the PSP user memory offset
 39 | 1. Open the PPSSPP Memory Viewer (Debug > Memory Viewer).
 40 | 2. Navigate to the start of user memory by double clicking on the "0x08800000 (User Memory)".
 41 | 3. Set the first 4 bytes of the user memory to something you can easily search for in PPSSPP.
 42 | 4. Search for the value in Cheat Engine.
 43 | 5. Repeat the above 2 steps until you are able to filter the address down to a single result in Cheat Engine the address of this result is where the user memory starts.
 44 | 
 45 | ![PPSSPP Determine User Memory Offset](assets/ppsspp-determine-user-memory-offset.png)
 46 | 
 47 | ![Cheat Engine Determine User Memory Offset](assets/cheat-engine-determine-user-memory-offset.png)
 48 | 
 49 | In the above example the user memory starts at 0x01540000 in the process memory.
 50 | 
 51 | ### 4. Use Cheat Engine to find the address of the variable you want to modify
 52 | 1. Set the memory scan start address to the address where the user memory starts.
 53 | 2. Use the search options in Cheat Engine to find a list of potential addresses. Try to reduce the search results to as small a number as possible.
 54 | 3. Determine the address in user memory where the value is located by subtracting the offset where user memory starts in the PC process and then adding 0x08800000.
 55 | 4. Filter down any remaining results by changing the value in PPSSPP using the memory viewer mentioned above and determining to see which address is the source of truth.
 56 | 
 57 | ![PPSSPP Determine User Memory Offset](assets/ppsspp-determine-user-memory-offset.png)
 58 | 
 59 | In the above example the search results have been filtered to 2 possible addresses. The user memory starts at offset 0x01540000 in the process memory. This gives the following 2 potential PSP memory addresses for the variable:
 60 | 
 61 |  * 0x08B4A8D0 (= 0x1574A8D0 - 0x15400000 + 0x08800000) ** this address is the source of truth in this case.
 62 |  * 0x0960237C (= 0x1620237C - 0x15400000 + 0x08800000)
 63 | 
 64 | ### 5. Use the disassembly tool to determine what code changes the value.
 65 | 
 66 | Because the offsets of data addresses may not be consistent across emulator versions and physical hardware it makes our job a little harder.
 67 | 
 68 | Rather than using the cheat engine to set the value direct it the compatibility of the cheat can be increased by instead rewriting the logic of the game.
 69 | 
 70 | For example, when making an infinite health cheat there are a couple of ways to accomplish this:
 71 |  * Jump to a subroutine created by the cheat when the value is read from (in this case we would set a read breakpoint). Typically 0x08802000 is unused by games and is safe for writing custom logic to.
 72 |  * No-op the logic responsible for decreasing the health value (in this case we would set a write breakpoint).
 73 | 
 74 | 1. Open the PPSSPP Disassembler (Debug > Disassembly...).
 75 | 2. Click the "Breakpoint" button, enter the address of the value found in step 4 and configure the conditions under which the breakpoint should be triggered.
 76 | 3. Play the game to trigger the condition for the breakpoint to be hit. The game will often read/write to an address in a number of different functions. To avoid the breakpoint being hit in unwanted cases it may be necessary to continue past these using the debugger (by clicking the "Go" button) or nop out/change the address these functions similar to what is described below.
 77 | 
 78 | ![PPSSPP Setting a Breakpoint](assets/ppsspp-setting-a-breakpoint.png)
 79 | 
 80 | ![PPSSPP Breakpoint Hit](assets/ppsspp-breakpoint-hit.png)
 81 | 
 82 | The above screenshots show a write breakpoint being set and how the debugger looks when it is hit.
 83 | 
 84 | In the example above a write breakpoint has been set and the instruction at 0x0883F114 is responsible for writing to that address. From the logic around that area the following can be observed:
 85 |  * The value stored in the a0 register is writen to the address we set our breakpoint to.
 86 |  * The value in the a0 register is loaded from the same address it is written to and then incremented by the value in the s3 register being being stored.
 87 |  * In our case the value in the s3 register is set to 1 at 0x0883F0B0.
 88 | 
 89 | The following step will be looking at rewriting the logic which sets this value.
 90 | 
 91 | ### 6. Re-writing the games logic
 92 | 
 93 | This is where things get quite tedious. The memory editor of PPSSPP is very restrictive and doesn't offer a method of converting a MIPS instruction to its hexadecimal representation. Fortunately ps2dis can be used to work around this limitation but adds additional steps to the process.
 94 | 
 95 | 1. Create a memory dump of the user memory by opening the memory viewer once again. Right click on the hex view and click the "Dump..." menu item. In this case a memory dump of any other game will do, or even a file full of nothing. This file is just needed so that we have something to load into ps2dis.
 96 | 2. Open ps2dis and load your memory dump. Enter "08800000" in the "Address From" text box when prompted.
 97 | 3. Navigate to an empty space of the file. There is often a sufficient empty space around "0x08802000" which is perfect for injecting your subroutines.
 98 | 4. Start writing the instructions you want to inject into the game. You can edit the value of an address by double clicking on it.
 99 | 
100 | ![PPSSPP Dumping User Memory](assets/ppsspp-dumping-user-memory.png)
101 | 
102 | ![ps2dis Load Memory Dump](assets/ps2dis-load-memory-dump.png)
103 | 
104 | The above example shows that the instruction "addiu s3, zero, $0064" translates to a value of 0x24130064. This value will be injected into the game in the next step to influence the final value of the a0 register. Rather than incrementing by 1 each time the breakpoint is hit the register will instead be increased by 100 (0x64).
105 | 
106 | ### 7. Injecting your new logic
107 | 
108 | Again, because the memory editing capabilities of PPSSPP are quite limited this step can also be quite tedious.
109 | 
110 | 1. Navigate to the address you want to edit in either the disassembler or memory viewer. If in the disassembler you can quickly navigate to an address displayed in the disassembler by right clicking on it and selecting "Go to in Memory View".
111 | 2. Insert your updated logic into the appropriate addresses in the memory editor. Ensure you enter the bytes of each instruction in reverse order.
112 | 
113 | ![PPSSPP Rewriting the Game Logic](assets/ppsspp-rewriting-the-game-logic.png)
114 | 
115 | ### 7. Test your changes
116 | 
117 | Almost done. Resume the game and test the changes work as expected. If the changes work as expected all that is needed is to convert them to CWCheat format so they can be used by everyone.
118 | 
119 | ### 8. Convert the cheat to CWCheat format
120 | 
121 | This step is much simpler, in our case all of the instructions we change will follow the following format:
122 | 
123 | ```
124 | _S GAME-ID (eg. NPEZ-00044)
125 | _G Game Name
126 | _C0 Cheat Name
127 | _L 0x2AAAAAAA 0xBBBBBBBB
128 | _L 0x2AAAAAAA 0xBBBBBBBB
129 | ...
130 | ```
131 | 
132 | In the above example:
133 |  * AAAAAAA should be substituted with the address(es) you wrote to (minus 0x08800000 as CWCheat uses 0x08800000 as a base address)
134 |  * BBBBBBBB should be substituted with the hex value of the instruction.
135 | 
136 | Continuing from the example above, the cheat code would be as follows:
137 | 
138 | ```
139 | _S NPEZ-00044
140 | _G Jetpack Joyride
141 | _C0 Coin Multiplier
142 | _L 0x2003F0B0 0x24130064
143 | ```
144 | 


--------------------------------------------------------------------------------
/guides/ppsspp/introduction.md:
--------------------------------------------------------------------------------
 1 | ## Introduction
 2 | 
 3 | PPSSPP is a multi-platform opensource PSP emulator by Henrik Rydgård.
 4 | 
 5 | The emulator has a fully functional debugger and is compatible with CWCheat format codes.
 6 | 
 7 | ## Guides
 8 | 
 9 |  * [Creating Cheats with PPSSPP](creating-cheats-with-ppsspp/creating-cheats-with-ppsspp.md)
10 | 
11 | ## Useful Links
12 | 
13 |  * [Project Home Page](https://www.ppsspp.org/)
14 |  * [Github Page](https://www.github.com/hrydgard/ppsspp)
15 | 


--------------------------------------------------------------------------------
/other/button-activators.md:
--------------------------------------------------------------------------------
  1 | ## Button activators
  2 | 
  3 | ### Description
  4 | 
  5 | The PSP offers various `sceCtrl*` functions for reading the state of the buttons. These functions provide the button
  6 | state as a single integer bit mask.
  7 | 
  8 | Depending on the cheat device being used the following options may be available for reading the button state:
  9 | 
 10 |  * Use a code type (or similar) specifically provided by the cheat device to read button state.
 11 |  * Identify the memory address where the game writes button state to and use the condition types or assembly to
 12 |    toggle the cheat.
 13 | 
 14 | ### Button bit flags
 15 | 
 16 | The following table shows the possible values of the controller button data. Note that the kernel mode flags will
 17 | **NOT** be available when using button data that has been read by the game. 
 18 | 
 19 | <table>
 20 |     <tr>
 21 |         <th>Button</th>
 22 |         <th>Code</th>
 23 |     </tr>
 24 |     <tr>
 25 |         <th colspan="2">User mode flags</th>
 26 |     </tr>
 27 |     <tr>
 28 |         <td>PSP_CTRL_SELECT</td>
 29 |         <td>0x00000001</td>
 30 |     </tr>
 31 |     <tr>
 32 |         <td>PSP_CTRL_START</td>
 33 |         <td>0x00000008</td>
 34 |     </tr>
 35 |     <tr>
 36 |         <td>PSP_CTRL_UP</td>
 37 |         <td>0x00000010</td>
 38 |     </tr>
 39 |     <tr>
 40 |         <td>PSP_CTRL_RIGHT</td>
 41 |         <td>0x00000020</td>
 42 |     </tr>
 43 |     <tr>
 44 |         <td>PSP_CTRL_DOWN</td>
 45 |         <td>0x00000040</td>
 46 |     </tr>
 47 |     <tr>
 48 |         <td>PSP_CTRL_LEFT</td>
 49 |         <td>0x00000080</td>
 50 |     </tr>
 51 |     <tr>
 52 |         <td>PSP_CTRL_LTRIGGER</td>
 53 |         <td>0x00000100</td>
 54 |     </tr>
 55 |     <tr>
 56 |         <td>PSP_CTRL_RTRIGGER</td>
 57 |         <td>0x00000200</td>
 58 |     </tr>
 59 |     <tr>
 60 |         <td>PSP_CTRL_TRIANGLE</td>
 61 |         <td>0x00001000</td>
 62 |     </tr>
 63 |     <tr>
 64 |         <td>PSP_CTRL_CIRCLE</td>
 65 |         <td>0x00002000</td>
 66 |     </tr>
 67 |     <tr>
 68 |         <td>PSP_CTRL_CROSS</td>
 69 |         <td>0x00004000</td>
 70 |     </tr>
 71 |     <tr>
 72 |         <td>PSP_CTRL_SQUARE</td>
 73 |         <td>0x00008000</td>
 74 |     </tr>
 75 |     <tr>
 76 |         <th colspan="2">Kernel mode flags</th>
 77 |     </tr>
 78 |     <tr>
 79 |         <td>PSP_CTRL_HOME</td>
 80 |         <td>0x00010000</td>
 81 |     </tr>
 82 |     <tr>
 83 |         <td>PSP_CTRL_HOLD</td>
 84 |         <td>0x00020000</td>
 85 |     </tr>
 86 |     <tr>
 87 |         <td>PSP_CTRL_NOTE</td>
 88 |         <td>0x00800000</td>
 89 |     </tr>
 90 |     <tr>
 91 |         <td>PSP_CTRL_SCREEN</td>
 92 |         <td>0x00400000</td>
 93 |     </tr>
 94 |     <tr>
 95 |         <td>PSP_CTRL_VOLUP</td>
 96 |         <td>0x00100000</td>
 97 |     </tr>
 98 |     <tr>
 99 |         <td>PSP_CTRL_VOLDOWN</td>
100 |         <td>0x00200000</td>
101 |     </tr>
102 |     <tr>
103 |         <td>PSP_CTRL_WLAN_UP</td>
104 |         <td>0x00040000</td>
105 |     </tr>
106 |     <tr>
107 |         <td>PSP_CTRL_REMOTE</td>
108 |         <td>0x00080000</td>
109 |     </tr>
110 |     <tr>
111 |         <td>PSP_CTRL_DISC</td>
112 |         <td>0x01000000</td>
113 |     </tr>
114 |     <tr>
115 |         <td>PSP_CTRL_MS</td>
116 |         <td>0x02000000</td>
117 |     </tr>
118 | </table>


--------------------------------------------------------------------------------