<?xml version="1.0" encoding="utf-8"?>

<CheatTable CheatEngineTableVersion="18">

<CheatEntries>

<CheatEntry>

<ID>0</ID>

<Description>"KH HD 1.5 60FPS"</Description>

<LastState Value="??" Activated="0" RealAddress="1020D1017"/>

<Color>80000008</Color>

<VariableType>Byte</VariableType>

<Address>1020D1017</Address>

</CheatEntry>

<CheatEntry>

<ID>1</ID>

<Description>"map change fix"</Description>

<LastState Activated="1"/>

<Color>80000008</Color>

<VariableType>Auto Assembler Script</VariableType>

<AssemblerScript>{ Game : rpcs3.exe

Version:

Date : 2018-09-11

Author : NavanBethrax

This script removes the 30 FPS Cap from Kingdom Hearts 1.5 Final Mix [BLUS31212] Emulated with RPCS3 [v0.0.5-7321-52377791]

The Pointer isn't from me but the patches are. First change Value to 0 then activate both fixes. Now your fps stay uncapped after you switch the map or open the menu.

}

define(address,101602B7)

define(bytes,C7 80 14 10 0D 02 00 00 00 01)

[ENABLE]

//code from here to '[DISABLE]' will be used to enable the cheat

assert(address,bytes)

alloc(newmem,$1000,101602B7)

label(code)

label(return)

newmem:

code:

mov [rax+rpcs3.exe+20C1014],0

jmp return

address:

jmp code

nop

nop

nop

nop

nop

return:

[DISABLE]

//code from here till the end of the code will be used to disable the cheat

address:

db bytes

// mov [rax+rpcs3.exe+20C1014],rpcs3.hid_write_control+D67CB0

dealloc(newmem)

{

// ORIGINAL CODE - INJECTION POINT: 101602B7

10160278: E9 D1 1E 05 00 - jmp 101B214E

1016027D: 0F 1F 00 - nop [rax]

10160280: 83 79 1C 00 - cmp dword ptr [rcx+1C],00

10160284: 75 4B - jne 101602D1

10160286: 48 8B 05 73 FD 08 00 - mov rax,[101F0000]

1016028D: 48 C7 41 38 00 00 0D 02 - mov [rcx+38],rpcs3.exe+20C0000

10160295: 48 C7 41 40 00 00 00 00 - mov [rcx+40],00000000

1016029D: 48 C7 41 48 00 00 0D 02 - mov [rcx+48],rpcs3.exe+20C0000

101602A5: 48 C7 81 18 01 00 00 01 00 00 00 - mov [rcx+00000118],00000001

101602B0: C6 80 D4 80 0C 02 00 - mov byte ptr [rax+rpcs3.exe+20B80D4],00

// ---------- INJECTING HERE ----------

101602B7: C7 80 14 10 0D 02 00 00 00 01 - mov [rax+rpcs3.exe+20C1014],rpcs3.exe+FF0000

// ---------- DONE INJECTING ----------

101602C1: 48 C7 81 60 04 00 00 40 50 04 00 - mov [rcx+00000460],rpcs3.exe+35040

101602CC: E9 9F 62 00 00 - jmp 10166570

101602D1: BA 24 50 04 00 - mov edx,rpcs3.exe+35024

101602D6: E9 81 1E 05 00 - jmp 101B215C

101602DB: 0F 1F 44 00 00 - nop [rax+rax+00]

101602E0: 83 79 1C 00 - cmp dword ptr [rcx+1C],00

101602E4: 75 10 - jne 101602F6

101602E6: 48 C7 81 60 04 00 00 48 50 04 00 - mov [rcx+00000460],rpcs3.exe+35048

101602F1: E9 74 1E 05 00 - jmp 101B216A

101602F6: BA 40 50 04 00 - mov edx,rpcs3.exe+35040

}

</AssemblerScript>

</CheatEntry>

<CheatEntry>

<ID>2</ID>

<Description>"start menu fix"</Description>

<LastState Activated="1"/>

<Color>80000008</Color>

<VariableType>Auto Assembler Script</VariableType>

<AssemblerScript>{ Game : rpcs3.exe

Version:

Date : 2018-09-11

Author : NavanBethrax

This script does blah blah blah

}

define(address,10107BEC)

define(bytes,C7 80 14 10 0D 02 00 00 00 01)

[ENABLE]

//code from here to '[DISABLE]' will be used to enable the cheat

assert(address,bytes)

alloc(newmem,$1000,10107BEC)

label(code)

label(return)

newmem:

code:

mov [rax+rpcs3.exe+20C1014],0

jmp return

address:

jmp code

nop

nop

nop

nop

nop

return:

[DISABLE]

//code from here till the end of the code will be used to disable the cheat

address:

db bytes

// mov [rax+rpcs3.exe+20C1014],rpcs3.hid_write_control+D67CB0

dealloc(newmem)

{

// ORIGINAL CODE - INJECTION POINT: 10107BEC

10107BB3: 01 00 - add [rax],eax

10107BB5: 00 BA 1C FC 02 00 - add [rdx+rpcs3.exe+1FC1C],bh

10107BBB: E9 FA AA 09 00 - jmp 101A26BA

10107BC0: 83 79 1C 00 - cmp dword ptr [rcx+1C],00

10107BC4: 75 48 - jne 10107C0E

10107BC6: 48 8B 05 33 84 0E 00 - mov rax,[101F0000]

10107BCD: 48 C7 41 48 01 00 00 00 - mov [rcx+48],00000001

10107BD5: 48 C7 41 50 00 00 02 00 - mov [rcx+50],rpcs3.exe+10000

10107BDD: 48 C7 41 40 B0 0D 38 00 - mov [rcx+40],rpcs3.exe+370DB0

10107BE5: C6 81 7A 04 00 00 00 - mov byte ptr [rcx+0000047A],00

// ---------- INJECTING HERE ----------

10107BEC: C7 80 14 10 0D 02 00 00 00 01 - mov [rax+rpcs3.exe+20C1014],rpcs3.exe+FF0000

// ---------- DONE INJECTING ----------

10107BF6: 48 C7 41 38 45 E6 02 00 - mov [rcx+38],rpcs3.exe+1E645

10107BFE: 48 C7 81 60 04 00 00 5C FC 02 00 - mov [rcx+00000460],rpcs3.exe+1FC5C

10107C09: E9 BA AA 09 00 - jmp 101A26C8

10107C0E: BA 3C FC 02 00 - mov edx,rpcs3.exe+1FC3C

10107C13: E9 BE AA 09 00 - jmp 101A26D6

10107C18: 0F 1F 84 00 00 00 00 00 - nop [rax+rax+00000000]

10107C20: 83 79 1C 00 - cmp dword ptr [rcx+1C],00

10107C24: 75 52 - jne 10107C78

10107C26: C5 FC - lds edi,esp

10107C28: 28 05 D2 D3 F4 FF - sub [10055000],al

}

</AssemblerScript>

</CheatEntry>

</CheatEntries>

<CheatCodes>

<CodeEntry>

<Description>Change of mov [rax+rpcs3.exe+20C1014],0</Description>

<Address>101602B7</Address>

<ModuleName/>

<ModuleNameOffset>0</ModuleNameOffset>

<Before>

<Byte>D4</Byte>

<Byte>80</Byte>

<Byte>0C</Byte>

<Byte>02</Byte>

<Byte>00</Byte>

</Before>

<Actual>

<Byte>C7</Byte>

<Byte>80</Byte>

<Byte>14</Byte>

<Byte>10</Byte>

<Byte>0D</Byte>

<Byte>02</Byte>

<Byte>00</Byte>

<Byte>00</Byte>

<Byte>00</Byte>

<Byte>01</Byte>

</Actual>

<After>

<Byte>48</Byte>

<Byte>C7</Byte>

<Byte>81</Byte>

<Byte>60</Byte>

<Byte>04</Byte>

</After>

</CodeEntry>

</CheatCodes>

<UserdefinedSymbols/>