Loading...
Description
CWCheat by weltall was the first universal cheat device for the PSP. Inspired by the PS2 Action Replay code types and user suggestions this cheat device supports an array of code types and also supports native PS1 Action Replay codes and homebrew software.
Code Types
Type Description
Constant RAM Writes
Type 0x00
8-bit
0XXXXXXX YYYYYYYY
Writes byte YY to [XXXXXXX].
Type 0x01
16-bit
1XXXXXXX 0000YYYY
Writes halfword YYYY to [XXXXXXX].
Type 0x02
32-bit
2XXXXXXX 000000YY
Writes word YYYYYYYY to [XXXXXXX].
Increment and Decrement Code Types
Type 0x03
8-bit Increment
301000YY XXXXXXXX
Adds YY to the byte stored at [XXXXXXXX].
Type 0x03
16-bit Increment
3030YYYY XXXXXXXX
Adds YYYY to the halfword stored at [XXXXXXXX].
Type 0x03
32-bit Increment
30500000 XXXXXXXX
YYYYYYYY 000000000
Adds YYYYYYYY to the word stored at [XXXXXXXX].
Type 0x03
8-bit Decrement
302000YY XXXXXXXX
Subtracts YY from the byte stored at [XXXXXXXX].
Type 0x03
16-bit Decrement
3040YYYY XXXXXXXX
Subtracts YYYY from the halfword stored at [XXXXXXXX].
Type 0x03
32-bit Decrement
30600000 XXXXXXXX
YYYYYYYY 000000000
Subtracts YYYYYYYY from the word stored at [XXXXXXXX].
Conditional Code Types
Type 0x0D
8-bit Equal To
DXXXXXXX 200000YY
Checks if YY == (byte at [XXXXXXX]).
If not, the following line is not executed (ie. execution status is set to false for 1 line).
Type 0x0D
8-bit Not Equal To
DXXXXXXX 201000YY
Checks if YY != (byte at [XXXXXXX]).
If not, the following line is not executed (ie. execution status is set to false for 1 line).
Type 0x0D
8-bit Less Than
DXXXXXXX 202000YY
Checks if YY < (byte at [XXXXXXX]).
If not, the following line is not executed (ie. execution status is set to false for 1 line).
Type 0x0D
8-bit Greater Than
DXXXXXXX 203000YY
Checks if YY > (byte at [XXXXXXX]).
If not, the following line is not executed (ie. execution status is set to false for 1 line).
Type 0x0D
16-bit Equal To
DXXXXXXX 0000YYYY
Checks if YYYY == (halfword at [XXXXXXX]).
If not, the following line is not executed (ie. execution status is set to false for 1 line).
Type 0x0D
16-bit Not Equal To
DXXXXXXX 0010YYYY
Checks if YYYY != (halfword at [XXXXXXX]).
If not, the following line is not executed (ie. execution status is set to false for 1 line).
Type 0x0D
16-bit Less Than
DXXXXXXX 0020YYYY
Checks if YYYY < (halfword at [XXXXXXX]).
If not, the following line is not executed (ie. execution status is set to false for 1 line).
Type 0x0D
16-bit Greater Than
DXXXXXXX 0030YYYY
Checks if YYYY > (halfword at [XXXXXXX]).
If not, the following line is not executed (ie. execution status is set to false for 1 line).
Multiple Skip Conditional Code Types
Type 0x0E
8-bit Equal To
E1ZZYYYY 0XXXXXXX
Checks if YY == (byte at [XXXXXXX]).
If not, the next ZZ are not executed (ie. execution status is set to false for ZZ lines).
Type 0x0E
8-bit Not Equal To
E1ZZYYYY 1XXXXXXX
Checks if YY != (byte at [XXXXXXX]).
If not, the next ZZ are not executed (ie. execution status is set to false for ZZ lines).
Type 0x0E
8-bit Less Than
E1ZZYYYY 2XXXXXXX
Checks if YY < (byte at [XXXXXXX]).
If not, the next ZZ are not executed (ie. execution status is set to false for ZZ lines).
Type 0x0E
8-bit Greater Than
E1ZZYYYY 3XXXXXXX
Checks if YY > (byte at [XXXXXXX]).
If not, the next ZZ are not executed (ie. execution status is set to false for ZZ lines).
Type 0x0E
16-bit Equal To
EZZZYYYY 0XXXXXXX
Checks if YYYY == (halfword at [XXXXXXX]).
If not, the next ZZZ are not executed (ie. execution status is set to false for ZZZ lines).
Type 0x0E
16-bit Not Equal To
EZZZYYYY 1XXXXXXX
Checks if YYYY != (halfword at [XXXXXXX]).
If not, the next ZZZ are not executed (ie. execution status is set to false for ZZZ lines).
Type 0x0E
16-bit Less Than
EZZZYYYY 2XXXXXXX
Checks if YYYY < (halfword at [XXXXXXX]).
If not, the next ZZZ are not executed (ie. execution status is set to false for ZZZ lines).
Type 0x0E
16-bit Greater Than
EZZZYYYY 3XXXXXXX
Checks if YYYY > (halfword at [XXXXXXX]).
If not, the next ZZZ are not executed (ie. execution status is set to false for ZZZ lines).
Address Conditional Code Types
Type 0x0D
Address Equal To
DXXXXXXX 4YYYYYYY
ZZZZZZZZ 0000000W
Checks if value at [XXXXXXX] == value at [YYYYYYY].
If not, the next ZZZZZZZZ lines are not executed (ie. execution status is set to false for ZZZ lines).
W = Address type; 0 - 8-bit, 1 - 16-bit, 2 - 32-bit
Type 0x0D
Address Not Equal To
DXXXXXXX 5YYYYYYY
ZZZZZZZZ 0000000W
Checks if value at [XXXXXXX] != value at [YYYYYYY].
If not, the next ZZZZZZZZ lines are not executed (ie. execution status is set to false for ZZZ lines).
W = Address type; 0 - 8-bit, 1 - 16-bit, 2 - 32-bit
Type 0x0D
Address Less Than
DXXXXXXX 6YYYYYYY
ZZZZZZZZ 0000000W
Checks if value at [XXXXXXX] < value at [YYYYYYY].
If not, the next ZZZZZZZZ lines are not executed (ie. execution status is set to false for ZZZ lines).
W = Address type; 0 - 8-bit, 1 - 16-bit, 2 - 32-bit
Type 0x0D
Address Greater Than
DXXXXXXX 7YYYYYYY
ZZZZZZZZ 0000000W
Checks if value at [XXXXXXX] > value at [YYYYYYY].
If not, the next ZZZZZZZZ lines are not executed (ie. execution status is set to false for ZZZ lines).
W = Address type; 0 - 8-bit, 1 - 16-bit, 2 - 32-bit
Boolean Code Types
Type 0x07
8-bit OR
7XXXXXXX 000000YY
Writes byte (byte at [XXXXXXX] OR YY) to [XXXXXXX].
Type 0x07
8-bit AND
7XXXXXXX 000200YY
Writes byte (byte at [XXXXXXX] AND YY) to [XXXXXXX].
Type 0x07
8-bit XOR
7XXXXXXX 000400YY
Writes byte (byte at [XXXXXXX] XOR YY) to [XXXXXXX].
Type 0x07
16-bit OR
7XXXXXXX 000100YY
Writes halfword (halfword at [XXXXXXX] OR YYYY) to [XXXXXXX].
Type 0x07
16-bit AND
7XXXXXXX 000300YY
Writes halfword (halfword at [XXXXXXX] AND YYYY) to [XXXXXXX].
Type 0x07
16-bit XOR
7XXXXXXX 000500YY
Writes halfword (halfword at [XXXXXXX] XOR YYYY) to [XXXXXXX].
Pointer Code Types
Type 0x06
8-bit
...
TODO...
Miscellaneous Code Types
Type 0x0D
Joker Code
D00000YY 1XXXXXXX
Checks if (ctrl & XXXXXXX) == XXXXXXX.
If not, the next YY+1 lines are not executed (ie. execution status is set to false for YY+1 lines).
Type 0x0D
Inverse Joker Code
D00000YY 3XXXXXXX
Checks if (ctrl & XXXXXXX) != XXXXXXX.
If not, the next YY+1 lines are not executed (ie. execution status is set to false for YY+1 lines).
Type 0x05
Copy Bytes
5XXXXXXX ZZZZZZZZ
0YYYYYYY 0000000
Copies ZZZZZZZZ bytes from [XXXXXXX] to [YYYYYYY].
Type 0x04
32-bit Multi Write
4XXXXXXX YYYYZZZZ
VVVVVVVV WWWWWWWW
Starting at address [XXXXXXX], this code will loop YYYY times.
The next address is determined by the incrementing the current address by (ZZZZ * 4).
The value written to the address is specified by VVVVVVVV+(WWWWWWWW * loop count).
Type 0x0B
Pause
B0000000 XXXXXXXX
Delays the code engine for XXXXXXXX cycles. Will delay the application of all following code lines.
Simply performs sceKernelDelayThread(XXXXXXXX), hopefully this is what CWCheat does when this code type is encountered.
Type 0x0C
32-bit Equal To
CXXXXXXX YYYYYYYY
Checks if YYYYYYYY == (word at [XXXXXXX]).
If not, the remainder of the code is not executed (ie. execution status is set to false until the next cheat is reached).
Description
PSP Action Replay (also known as PSPAR) is the first commercial cheat device for the PSP. The first PSPAR (released October 2008) used the Pandora exploit to launch the software on PSP-1000 and early PSP-2000 consoles. A new version was later released in December of 2009 which is installed in the UPDATE folder and launched directly from the XMB. It is speculated that this was the result of reverse engineering the PSP's encryption engine (KIRK) to sign their EBOOT/PRX's. As of the 6.30 PSP firmware update Sony changed the process of which kernel mode PRXs are validated breaking support for PSPAR. It was not until months later that Datel released an update which worked on firmware 6.30 and higher.
Code Types
Type Description
Constant RAM Writes
Type 0x00
32-bit
0XXXXXXX YYYYYYYY
Writes word YYYYYYYY to [XXXXXXX+offset].
Type 0x01
16-bit
1XXXXXXX 0000YYYY
Writes halfword YYYY to [XXXXXXX+offset].
Type 0x02
8-bit
2XXXXXXX 000000YY
Writes byte YY to [XXXXXXX+offset].
Conditional 32-bit Code Types
Type 0x03
Greater Than
3XXXXXXX YYYYYYYY
Checks if YYYYYYYY > (word at [XXXXXXX] or [offset] if [XXXXXXX] is 0)
If not, the code(s) following this one are not executed (ie. execution status is set to false) until a code type D0 or D2 is encountered, or until the end of thecode list is reached.
Type 0x04
Less Than
4XXXXXXX YYYYYYYY
Checks if YYYYYYYY < (word at [XXXXXXX] or [offset] if [XXXXXXX] is 0)
If not, the code(s) following this one are not executed (ie. execution status is set to false) until a code type D0 or D2 is encountered, or until the end of thecode list is reached.
Type 0x05
Equal To
5XXXXXXX YYYYYYYY
Checks if YYYYYYYY == (word at [XXXXXXX] or [offset] if [XXXXXXX] is 0)
If not, the code(s) following this one are not executed (ie. execution status is set to false) until a code type D0 or D2 is encountered, or until the end of thecode list is reached.
Type 0x06
Not Equal To
6XXXXXXX YYYYYYYY
Checks if YYYYYYYY != (word at [XXXXXXX] or [offset] if [XXXXXXX] is 0)
If not, the code(s) following this one are not executed (ie. execution status is set to false) until a code type D0 or D2 is encountered, or until the end of thecode list is reached.
Conditional 16-bit + Masking Code Types
Type 0x07
Greater Than
7XXXXXXX ZZZZYYYY
Checks if (YYYY) > (not (ZZZZ) < halfword at [XXXXXXX] or [offset] if [XXXXXXX] is 0).
If not, the code(s) following this one are not executed (ie. execution status is set to false) until a code type D0 or D2 is encountered, or until the end of the code list is reached.
Type 0x08
Less Than
8XXXXXXX ZZZZYYYY
Checks if (YYYY) < (not (ZZZZ) < halfword at [XXXXXXX] or [offset] if [XXXXXXX] is 0).
If not, the code(s) following this one are not executed (ie. execution status is set to false) until a code type D0 or D2 is encountered, or until the end of the code list is reached.
Type 0x09
Equal To
9XXXXXXX ZZZZYYYY
Checks if (YYYY) == (not (ZZZZ) < halfword at [XXXXXXX] or [offset] if [XXXXXXX] is 0).
If not, the code(s) following this one are not executed (ie. execution status is set to false) until a code type D0 or D2 is encountered, or until the end of the code list is reached.
Type 0x0A
Not Equal To
AXXXXXXX ZZZZYYYY
Checks if (YYYY) != (not (ZZZZ) < halfword at [XXXXXXX] or [offset] if [XXXXXXX] is 0).
If not, the code(s) following this one are not executed (ie. execution status is set to false) until a code type D0 or D2 is encountered, or until the end of the code list is reached.
Offset Codes
Type 0x0B
Load Offset
BXXXXXXX 00000000
Loads the 32-bit value into the 'offset'.
Offset = word at [XXXXXXX+offset].
Type 0xC4
Safe Data Store
C4000000 XXXXXXXX
Sets the offset value to point to the first word of this code. Storing data at offset+0x4 will save over the top of XXXXXXXX.
Type 0xC6
Write Offset
C6000000 XXXXXXXX
Writes the offset value to [XXXXXXXX].
Type 0xD3
Set Offset
D3000000 XXXXXXXX
Sets the offset value to XXXXXXXX.
Type 0xDC
Add Offset
DC000000 XXXXXXXX
Adds XXXXXXXX to the current offset (Dual Offset).
Loop Codes
Type 0x0C
C0000000 YYYYYYYY
This sets the 'Dx repeat value' to YYYYYYYY and saves the 'Dx nextcode to be executed' and the 'Dx execution status'. Repeat will be executed when a D1/D2 code is encountered.
When repeat is executed, the AR reloads the 'next code to be executed' and the 'execution status' from the Dx registers.
Terminator Codes
Type 0xD0
Terminator
D0000000 00000000
Loads the previous execution status. If none exists, the execution status stays at 'execute codes'.
Type 0xD1
Loop Execute Variant
D1000000 00000000
Executes the next block of codes 'n' times (specified by the 0x0C codetype), but doesn't clear the Dx register upon completion.
Type 0xD2
Loop Execute Variant/ Full Terminator
D2000000 00000000
Executes the next block of codes 'n' times (specified by the 0x0C codetype), and clears all temporary data. (i.e. execution status, offsets, code C settings, etc.)
This code can also be used as a full terminator, giving the same effects to any block of code.
Data Register Codes
Type 0xD4
Add Value
D4000000 XXXXXXXX
Adds XXXXXXXX to the 'Dx data register'.
Type 0xD5
Set Value
D5000000 XXXXXXXX
Set XXXXXXXX to the 'Dx data register'.
Type 0xD6
32-bit Incrementive Write
D6000000 XXXXXXXX
Writes the 'Dx data register' word to [XXXXXXXX+offset], and increments the offset by 4.
Type 0xD7
16-bit Incrementive Write
D7000000 XXXXXXXX
Writes the 'Dx data register' halfword to [XXXXXXXX+offset], and increments the offset by 2.
Type 0xD8
8-bit Incrementive Write
D8000000 XXXXXXXX
Writes the 'Dx data register' byte to [XXXXXXXX+offset], and increments the offset by 1.
Type 0xD9
32-bit Load
D9000000 XXXXXXXX
Loads the word at [XXXXXXXX+offset] and stores it in the'Dx data register'.
Type 0xDA
16-bit Load
DA000000 XXXXXXXX
Loads the halfword at [XXXXXXXX+offset] and stores it in the'Dx data register'.
Type 0xDB
8-bit Load
DB000000 XXXXXXXX
Loads the byte at [XXXXXXXX+offset] and stores it in the'Dx data register'.
Miscellaneous Codes
Type 0x0E
Patch Code
EXXXXXXX YYYYYYYY
Copies YYYYYYYY bytes from directly after the 0xE code line to [XXXXXXXX+offset].
Type 0x0F
Memory Copy Code
FXXXXXXX YYYYYYYY
Copy YYYYYYYY bytes from offset to XXXXXXXX (XXXXXXX is fixed, no offsets are added to it).
Folder/Comment Codes
Type 0xCF
Single Select Folder
CF000000 XXXXXXXX
Sets the cheat as a single select folder and the next XXXXXXXX items (codes, folders and comments) will be subitems of the current item.
Type 0xCF
Comment
CF000001 XXXXXXXX
Sets the cheat as a comment and the next XXXXXXXX items will also be treated as comments.
Type 0xCF
Multi Select Folder
CF000002 XXXXXXXX
Sets the cheat as a folder and the next XXXXXXXX items (codes, folders and comments) will be subitems of the current item.
Description
TempAR by raing3 is a mod of NitePR which was updated to support PSPAR and CWCheat code types. This mod also features a number of other improvements and features including a faster memory searcher, folder support, a rewritten database parser and additional code types inspired by NitroHax for the DS.
Code Types
Type Description
Conditional 32-bit Code Types
Type 0x03
Greater Than
3XXXXXXX YYYYYYYY
Same as PSPAR engine except if lowest bit of address is set the offset is added to the address.
Type 0x04
Less Than
4XXXXXXX YYYYYYYY
Same as PSPAR engine except if lowest bit of address is set the offset is added to the address.
Type 0x05
Equal To
5XXXXXXX YYYYYYYY
Same as PSPAR engine except if lowest bit of address is set the offset is added to the address.
Type 0x06
Not Equal To
6XXXXXXX YYYYYYYY
Same as PSPAR engine except if lowest bit of address is set the offset is added to the address.
Conditional 16-bit + Masking Code Types
Type 0x07
Greater Than
7XXXXXXX ZZZZYYYY
Same as PSPAR engine except if lowest bit of address is set the offset is added to the address.
Type 0x08
Less Than
8XXXXXXX ZZZZYYYY
Same as PSPAR engine except if lowest bit of address is set the offset is added to the address.
Type 0x09
Equal To
9XXXXXXX ZZZZYYYY
Same as PSPAR engine except if lowest bit of address is set the offset is added to the address.
Type 0x0A
Not Equal To
AXXXXXXX ZZZZYYYY
Same as PSPAR engine except if lowest bit of address is set the offset is added to the address.
Data Register Codes
Type 0xD4
Dx Data Operation
D400000Y XXXXXXXX
Sets the 'Dx data register' to Data = ? XXXXXXXX where ? is determined by Y as follows:
0 - add
1 - or
2 - and
3 - xor
4 - logical shift left
5 - logical shift right
6 - rotate right
7 - arithmetic shift right
8 - multiply
Miscellaneous Codes
Type 0xC1
Call Function with Arguments
C100000Y XXXXXXXX
AAAAAAAA BBBBBBBB
CCCCCCCC DDDDDDDD
Performs a jal to the function at XXXXXXXX. The number of arguments to pass to the function is specified by Y.
a0 = 0xAAAAAAAA
a1 = 0xBBBBBBBB
a2 = 0xCCCCCCCC
a3 = 0xDDDDDDDD.
Type 0xC2
Run Code From Cheat List
C2000000 XXXXXXXX
Performs a jal to the function directly after the 0xC2 code line. The length of function is specified by XXXXXXXX.
Type 0xC5
Counter
C5000000 ZZZZYYYY
Checks if (YYYY) == (not (ZZZZ) < cheat apply count).
If not, the code(s) following this one are not executed (ie. execution status is set to false) until a code type D0 or D2 is encountered, or until the end of the code list is reached.
Useful Links
Description
NitePR by SANiK is widely known for it's online cheating capabilities and open source license. NitePR supports a very limited set of code types and has a number of downfalls in comparison to other cheat devices.
Code Types
Type Description
Constant RAM Writes
32-bit
0XXXXXXX YYYYYYYY
Writes word YYYYYYYY to [XXXXXXX+offset].
16-bit
0XXXXXXX YYYY
Writes halfword YYYY to [XXXXXXX+offset].
8-bit
0XXXXXXX YY
Writes byte YY to [XXXXXXX+offset].
Pointer Code Types
Type 0xFFFFFFFF
Load Offset
FFFFFFFF 0XXXXXXX
Loads the 32-bit value into the 'offset'.
Offset = word at [XXXXXXX].
Description
MKUltra by RedHate is a mod of NitePR which features a number of changes including register highlighting for the disassembler, POPS support, improved copier, configurable colours, support for more MIPS opcodes and an additional code type.
Code Types
Type Description
Button Press Code Types
Type 0xFF
Button Press
FFYYYYYY 0XXXXXXX
Checks if (YYYYYY) == (value at [XXXXXXX] & (YYYYYY)).
If not, the code(s) following this one are not executed.
User Mode Buttons
Button Code
PSP_CTRL_SELECT 0x00000001
PSP_CTRL_START 0x00000008
PSP_CTRL_UP 0x00000010
PSP_CTRL_RIGHT 0x00000020
PSP_CTRL_DOWN 0x00000040
PSP_CTRL_LEFT 0x00000080
PSP_CTRL_LTRIGGER 0x00000100
PSP_CTRL_RTRIGGER 0x00000200
PSP_CTRL_TRIANGLE 0x00001000
PSP_CTRL_CIRCLE 0x00002000
PSP_CTRL_CROSS 0x00004000
PSP_CTRL_SQUARE 0x00008000
Kernel Mode Buttons
Button Code
PSP_CTRL_HOME 0x00010000
PSP_CTRL_HOLD 0x00020000
PSP_CTRL_NOTE 0x00800000
PSP_CTRL_SCREEN 0x00400000
PSP_CTRL_VOLUP 0x00100000
PSP_CTRL_VOLDOWN 0x00200000
PSP_CTRL_WLAN_UP 0x00040000
PSP_CTRL_REMOTE 0x00080000
PSP_CTRL_DISC 0x01000000
PSP_CTRL_MS 0x02000000
PSP_CTRL_SLIDE 0x20000000 (PSPgo only)