new PSX/PS2 selfboot thread

I hate to come into this as a spectator, however adrew makes a very valid point.

Although it is quite amusing, perhaps conceived as a half truth to some extent ; or a brush up on the developer documents.

Some of what djmcclintick's statements are rumors that have been posted on the internet for years.

I'm not attacking him in any way, but in some form or another this redundant information has appeared in other mediums. Someone always knows someone else with a magical console or burner that masters discs without a chip, yet doesnt have a disc for you to see upfront and in person.

Considering the amount of homebrew teams out for playstation, playstation II you would figure that by now there would be no need for a chip or an alternative method. Well its 2004, there is yet to be a burnable disc that allows you to run games modless. Personally i find that atleast looking back at Sam's progress (not to mention the other contributors) you can honestly say that this is indeed one of the few times individuals who are not just end users are actually out there to figure something out.

Surely if someone could put out one of these 'mastered' images, perhaps with trial and error individuals may actually be able to produce a bootable disc.

Until then its just a something to think about.

Andrewm

I just noticed you post from the 15th.

The use of an extra photo diode for receiving the SCEx signal in earlier PSX's is odd:
1) You would think that it would be easier to use the tracking signal, as used on the later models.
2) How can a single photo diode discriminate between side to side wobble, and a signal intensity wobble?

Are we sure that the SCEx isn't carried by a signal intensity wobble? If it is there may be very different sensitivities to ATIP wobble between early and late modles of the PSX. Also a signal intensity wobble should be a lot easier to add.

@Blame

I think the earlier PSX using a seperate signal to the tracking is just a lack of integration.

I imagine the Copy-Protection was developed by different boffins at sony from the CD-DSP which was different guys from the sound-chip which was different guys from the GPU.

When the first model came out - it was just all the little parts glued together.

Later on - when they had a chance to integrate everything into a few big chips - they did.

I am not sure what you mean by "intensity". Do you mean the amount of IR light returned to the photo diode ? Do you think that maybe instead of a side-side wobble they increase the spot size ?

One way to test this would be to do some summing of the voltages on E+F. See if the are in phase or out of phase.

I will build a current amp NEXT weekend if I have spare time and parts on hand.

I dont know enough about the AGC for the photo diode amps (if they have any) to know if 20Khz is inside or outside its loop. Suppose its a trial and error test

andrewm.

Yes, The amount of light returned. The wobble could have been created by varying the power to the burning laser.

However you have a point. An up/down wobble is also possible. That would wobble effective laser spot size.

Still, I'm not sure that there would be much difference in the effective result between these 2 possibilities.

Summing E+F should do the trick.

What is AGC?

@Blame

AGC = Automatic gain control.

I am certainly not an expert on the finer workings of CDs - but I would imagine that there might be an AGC somewhere in the diode amplifiers.

I know that the CD-RF signal is close to (or ment to be close to) DC because of the EFM encoding. This may eliviate the need for an AGC but I just dont know enough to say for sure.

Excuse me if that post shouldnt be that extremly well-structured, but I'd like to say it this time that way:


0. Sorry for not answering other stuff, I had to find, sort, re-organize and backup GBytes of data the last days.

1. Its wonderful, our "Mystic Hitec Quest" now again is exciting like a Thriller ! ;-)



@ djmcclintick
2. Thanks for all of your answers and the jpg. Sorry, I'm still distrustful against all your claims but dont take this personally. We're here almost one & a 3/4 year and our "wisdom-pool" about the PSX-protection contains alot knowledge, of course still even near enough we really need! But we have to proof and test any new info, because thats the professional praxis.


btw. please can you explain to us a few suspicious things, "Sherlock Holmes" has some additional questions: *eggg*
------------------------------------------------------------

I can hardly believe that all your friends have UNCHIPPED Playstations! Not these days! Fine, I'm shure now you wanna tell us, all their PSXs are unchipped because they got from you every "selfbootable"-backup they want, but I dont believe this.

How do you wanna supply them with all their needs? If some of them sees a fancy game at the Video-4-Rent Shop, I'm shure they wanna "backup" *eg* it fast and easily by theirselfes instead of waiting for weeks / or / getting the message: "Sorry friend, but that game for the moment we dont have in our production row / sortiment and also not available in one of our archives!"


* Next point: Afaik we made it clear the "22khz always on signals" came from the wobble background noise which is behind the whole "data-track" all over the CD-R. In earlier times we (or better I ;-)thought the burned track itself is very slightly wobbled. So anyway, how we wanna burn away that background noise ever ?!?!
I'm shure also an "anti-wobble sector" wont work, because if its background noise its vague and hazy enough "coming from the neigbouring track", nevertheless!

Even an up/down or pitvisibilityfull/pitvisiblitylow track wont balance that backround noise out to zero. OK, if the tracking coil/diodes just wanna hear a little difference in volume, then of course its no problem.


* You are talking about errors and that the SCEx gets added in the middle of a bunch of "free" sectors. As far as I can remember the conversation Andrew - Barubary in the year 2000, (B., which had coded a little tool for reading out the whole! CD), he didnt found any unusually. So where are those sectors - at the leadin ?!?!

* Why you dont send Adrew one single selfbooting CD-R ?!! He isnt that paranoid (like myself *ggg*), I'm shure he will give you some PO Box Adress *gg* from Australia where you can send a simple letter containing one of your "Miracle Disx"! So please dont complain yourself if he doesnt believe you and makes a few jokes about the whole stuff, if something that easily could be made clear once and for all! And I'm shure he even would pay you for your effords.


* Last but not least: Can you find out the exactly 10th "birthday" of the PSX (simply ask your Boss ;-), because it must be in one of these days coming up soon, and we have to celebrate the "10 Year SCEx protection" anniversary! ;-)





@ Andrew:
Well, I share your suspicions, and I have to laugh myself to death about your cool jokes all the time! *gggggg* I just love them, simply perfect. So dont hesitate, always shout out some satiric, ironic, black humor etc. stuff inbetween that "headache causing" scientific hitec considerations, or we will die with this selfboot maniac stuff sometimes, buried alive below 100s of nonselfbooting CD-Rs! ;-) *ggg*

So please tell us more about quote: "hot horney bisexual catwalk models" - are they doing there business in front of Tokyo's Sony Headquater? ;-) (sorry, that was mean) I thought Japan is full already by "Schoolgirls", Gothic-Nymphs and Sailor-Chicks"! ;-))
(thats nothing against you, djmcclintick or Sony at all, I just love that kind of fun, and its good Andrew is a little bit suspicious about your "unbelievable" new infos)




@ Blame:
Sorry, I cant help you with photo-diode stuff etc. 4 the moment, but I made an other DIODE or better LED discovery:

If I switch off the chip AND dont use the SCEx-keycard, I can watch exactly whats goin' on at that Modpin6 "SCEx for CPU bootloader" line.
Well, as expected, LED on all the time with CD-Rs, LED off all the time with pressed Audio CDs and for a very short time blinking if PSXch2 or orig. PSX CD is in use.

So far everyting "fine", but latly I checked alot of my testburns and backup-stuff CD-Rs and really found 3 burns, which are able "switching" off the LED for short impulses! Yes, at SCEx search time! They do this by causing spin-speed variations/ (or seek errors?!).

I'm still certain those "interrups" arent short enough to create any 4msec "offs", but when I have time the next days I'll record and analyse that "LED" outputs exactly.

However the result is, and I dont wanna desillusionate you, but the problem is: We wont get alot information about how I did burn that CD-Rs. Simply because for the moment I cant read the Lead-In as RAW track, AND: I guess some of those disx are "real overburns", I overburned the weak Litey lead-in track with the Mitsumi 1x drive (after hardware swap trick etc).

Either this causes that "speed-control" errors or perhaps thats the result of some skip lead-in patterns - I dont know any more! But as I predicted, we always will have a chance by "speed-out" the wobble.



CU, Sam

Dont take me bad , but i think i read somewere that on twinpeak disks we canot read the atip animore !!!!
I hink that twinpeak will cause "pauses" in the wobble !!
Just a suppsition !!

@ death-heaven ,

Can't read ATIP is because of the flaw at the software level, i.e. the protection code itself. Not the hardware level. The twin peaks fooled the software into thinking it is a pressed CD and it figured that it didn't need to read the ATIP.

If you take the twin peaks CDs and read them with a software capable of reading ATIPs it will work (also providing you don't use any tray ATIP hiding software). I tried this already.

So it is impossible to create selfbootable PSX/PS2 games, unless you have a special CD/DVD burner. Or have I missunderstood the thread?

So is the self bootable PSX/PS2 project over now. Or are there still researchers trying to find a way to do it?

---

Last edited by The Lillster; 25-01-2004 at 18:20.

Ok, im a newbie but have been interested in this topic and lurking since the first psx thread. I don't know if you guys have discounted the possibility that the software referred to by others and the right drive will create a playable cd-r, but on the off chance that it does, I'll post my idea/question.

I was wondering if there was a way to create in effect a virtual cd writer that could be mounted like other virtual cd's(and you could use regular drivers to emulate a specific model) and you could select whatever software you want to use to burn a cd and the virtual cd writer would create some sort of image file.

If this was possible could we not then analyze that image file and look for the protection scheme that way?

Just a suggestion. I also think that a tool like this could be very useful in a variety of environments, especially large networks.

@djmcclintick (not existing anymore ?), I'm really very disappointed of you!


First playing with our "hopes and dreams" *ggg*, and after that vanishing in thin air. Did you eat some electrified toadstools ??? *eg*

I knew it that Andrews precautions didnt came from nothing. It was already very suspicous, you came in here with the S*ny brand and playing the big insider imployee. Now where are you, to proof that you're claims are true?

That fact above was the first "bad sign" *eg*, 2nd we had already information that those CD/DVD Gen. supporting S*ny burners wont add any "country-wobble"!
Bad luck, comrade.

Sorry, we really dont need any second "ThaExperts" !
If we or some of us really should did you wrong, forgive me, but defend and prove your statements to us here, otherwise: See ya in hell! *eg*


btw I know already self the "PSXs birth dates":

December 2nd 1994 Release date in Japan (ca. 400 dollar)


http://consoledatabase.retrofaction....nyplaystation/




So if he cant proof anything, I will do it instead:
---------------------------------------------------------



http://the8ball.50megs.com/proofed.htm



This are true!! recordings, snaps and pix from one of my PSX test CD-Rs!

As you can see and "hear", it will produce very fast on/off patterns! I recorded the wavs from the already "digitalisized" Mod Pin6 line.
To me it looks like that disc will produce a "brute-force session" on their own, because it wont stop spinning and "pulsing" for about 2-3 Minutes!

Those test was made of course with everything SCEx producing chips set to off!

OK, thats the proof its possible to BURN something which causes very fast 22khz interrupts, and makes any continous wobble stuff undetectable!


About the disc:
It looks like a weak track is between some better burned Leadin - Leadout tracks. The disc gets recognised fine by the PSX on the very first verification, but fails to boot, even with mod on or with orig PSXch2.

I couldnt check out hows the (not booting) data track looks like, not even with hardware swaptrick (perhaps I wrote some CDDA track there but visually I guess its a data track), but its useless anyway, because the big secret must be hidden in the leadin.

Wait: Isobuster in conjunction with my new Litey DVDRW 411S (Hi, 41, bye 40 *eg* ;-) @firm FS0H shows up a 6737920bytes long CDDA/CDROM track, but fails completly to extract it.


btw it is just an usual recordable:
-----------------------------------

Manufacturer : SKC Co., Ltd.
Code : 97m 26s 26f
Disc Type : CD-R
Usage : General
Recording Layer : Dye Type 6: Short Strategy (Phthalocyanine)
Recording Speed : n/a
Capacity : 79:59.73, 702.83 MB, LBA 359848
Additional Capacity : n/a

Atleast I could read the ATIP info.


No matter how fantastic successful this new test now has been, we must discover what special burn action did the trick!

It has to be something which causes heavy CD-speed-synch-problems.
Seems alot new test-coasters could wait...
At least if we dont find a nice way how to check out the boot behaviour systematically.

Halt:
As far as I can remember this disc could have been a Trumans Tool skip pattern DAO style burned test CD, which the Litey 32s has burned at 4x very weak, so the Mitsumi thought its still an complete empty CD and wrote something additional to the disc, at least some standard leadin / leadout. I'm relative shure it must have been one of those tests. Well, so it seems now there are crazy pits/lands pattern at the lead-in which confuse the PSX.

Remember, the PSX really searches for about 3 minutes! for that SCEx, logically, because it really reads and gets very similar "SCEx style" digital pulses from there. Even if those pulses are just caused by the CD spin problems, they have the range of millisecond small lenght we need, and thats absolute great.


Just how create intentional matching SCEx "errors"?!

Is there a way (command) burning the track intentional ultra weak / stronger??

Thats the big problem. Perhaps we can create some kind of "Random Generator", within 2 minutes we could get about 1000s of different pattern-tries as such you can see on the new webpage; though I dont love that random-games that much.

However, my tests finally now did made it clear:
-------------------------------------------------
YES, it is possible!
Not by leadin skip, not by Audiotrick, not by silly claims from guys who wanna confuse the SCEnE since 1995, but by modifying the lead-in, messing up the speed settings the PSX is used to.


CU, Sam

Nice job sam.

Sam

That 2'nd sample looks wonderful. Regular and just the right sort of pulse lengths.

If only you knew how you got it!

Your very, very, close now.

Is it ok if I can have a go at testing this stuff?

Could you please give me a list of things, Sam? Which I need to burn SCEX stuff like u?

Ok sorry for double posting, but I needed two different subjects.

I was wandering if anyone knows why my PS2 will read a DVD-R Closed disk sesion as "Disc read Error". And an open session as a none Ps2/PSX disc? Maybe that is why your CD-R does not boot fully, beause it is a closed session by the looks of it on that disc anyway.

Like on an open session you can't see where the data has been burned, however on a closed disc session you can .

i think @djmcclintick works for sony to make us go the wrong way knowing that we are close to know what is the real protection !!!
DAMN U FREAK !!!

@SAM

Sorry to rain on your parade, but I think those pictures of the digital SCEx line are caused by the spindle and hub motors.

The digital SCEx line goes off/on in an uncontrollable fashion when the motors are being changed.

THOUGH I am WAY interested in the fact that you said the disc speeds up and slows down. That certainly gives hope to the fact that the PSX is like a normal CD drive in that it uses the period of T (or 12T) to set speed.

Even if running the risk of sounding like John Travolta or Olivia Newton-John I am going to say

Wella wella wella ah,
tell me more tell me more
did the disc go real fast.
Tell me more tell me more
did it seek back and forth.

IF you can duplicate that strange burn sequence, I would appreciate if you could send me one so I can see what the extra magic photo diode is doing through this.

i am still arround but no one listens and i did manage to help others burn the psx format cds but wil not share cause of the critsism on this board and will not defend my self because there is no need also for all those overseas people sony has signed a international contract with the un preventing any country from breaking their contracts so have fun i gave trumanhi a link to a nsa backboard cd reverse engineering acadmy info site that could help cracking the cd protection ask him for the link also there are reverse engineering source codes and programs there but now i will futher my self from this because of legal disputes

Thx for all your new replies and complim's, its great to know everyone is still here! ;-)


Sorry I havent time now for answer to all the new posts,

But I was successfully burning a new "Bootpattern CD-R", now intentionally!

As I thought, its an overburning style. I wrote down the detailed information how to burn it and upped the needed files here:


http://the8ball.50megs.com/itworkedagain.htm


Njoy!


Thx The Lillster for your new support, you now can also can testburn with the given info 4 us.

I will answer later to any important other new questions and suggestions, for the moment just a little answer to:



djmcclintick,
**********

dont you get the point?!


Sometimes you have to be very cautious and distrustful, at least if you saw dozens of wrong protection claims and after going mad about them.

1. no one listens - false
2. will not defend my self because there is no need - false
3. criticism - false
4. preventing any country from breaking their contracts - hmm
5. Why so shy?


1. We listened very well, the problem was the general and easy misunderstandable amount of info you provided to us. But thats here a very technical board, so either "good", indeep going info or better no info.


2. Perhaps from your side of view, ok, but dont you understand we had to defeat already alot wrong claims, and sometimes it was hard work and did costs alot coasters. And therefore noone fools us again and we have to proof all new info's very conscientious. So dont feel your self attacked personally.


3. If Andrew did react very "funny" on you it was just because of his own experiences at his special wobble-tests. I dont defend him, I'm shure he do this on his own if needed. But I'm shure he tried very hard "getting" away that wobble and then you come in and claim its that simple by a modified firmware, but leaving us alow without any needed and understandable technical details. Do you really understand how big the CD-R wobble issue really is?


4. We are not "any country", this is for technical education and personal interrest, only. And anyway, believe me, in 1 or 2 years everybody cares about the old PSX games the same like SNES emulation, nothing which really would harm anybody anylonger! Who buys 33mhz processors if he easily can get powerful 3 Gigahz ones?! Not to mention, that in fact, this whole discussion here is an unwanted, but still big free advertisment for Sony! But of course we dont wanna make this thread any longer than needed!


5. I dont understand your "privacy management": If Sony really reads here, dont you think they could recognise the name McClintick if you are really one of their employees? (plus telling full name on your hp). If you decide to help us and start posting here, wouldnt it more logical using some different name and mail so you can help us without geting panic for being discovered?



CU, Sam

Thanks Sam for letting me help, however I don't think I can quite help fully yet because the Trumans CD tool only works with CD-R and I have only have DVD-R's atm. Another thing, is the SCEE pattern for PSX games in Europe the same as the SCEE code for PS2 games in Europe? Because I only have PS2 games atm for testing and burning. But I could always get some CD-R's when Iv got some money.

@BuriedAlive

>the virtual cd writer would create some sort of image file
>analyze that image file and look for the protection scheme

Far too cumbersome. See the PSX as an unity without any PC-connections, exchanged drives, modchips, special bootdisx etc.
The only nice way would be flashing the PSXs firmware by CD like its possible with some DVD-players.
But I doubt its possible.



@ The Lillster
Thats here for PSX only, yet. Its enough complicated for now. If you dont even have any PSX nor any CD-R or PSX disx better forget helping for now. And please dont quote my whole text! ;-)



@Blame & Andrew @ all

>If only you knew how you got it!
Thx Blame, and for luck this problem is solved, but will it help us !?


Lets think about it:

For the moment we only have:
-------------------------------
-11000 to -7000: usual data leadin
-7000 to -151: "doubled" leadin sectors
-150 t0 -1: usual data pregap
0 to 599: usual PsXch2 data
600 to ca. 5100: usual leadout


At least we know the PSX searches somewhere from -7000 to -151 for the SCEx, finds some messed up pit-land structure, tries to set matching speed or tracking, fails, but at least creates randomly the needed "end product".

btw. the data track now is readable with Trumans CD Tool, but still wont boot with orig. Xch2 or chip. Another problem I have to solve first.


Well Andrew, thx for you nice song *ggg*, I hope already you could burn such testCD on your own and made some tests, sorry, I cant send you some, but about your question:

That CD accelerates and slows down in some not to wide range, perhaps also alot tracking errors occure.


I guess the speed is between 0,5x and 1x when this happens.

But as you said correctly, its only in an uncontrollable fashion, so its not of big use to us. btw does somebody has the exact value how often the bootloader needs the SCEx string??? Because if we get for 1 time the random SCEx sequence coincindentionally its a big difference compared with two times needed in sequence!

OK, what shall we do now?!

I could "halven out" the overburned space until I get the absolutly exact location where the PSX searches for the SCEx. But this would produce alot coasters, as far as I cant burn any multisessions with Trumans CD Tool.

Another problem we have: Not everybody, in fact just a very few people have the equipment to swap and "overburn" the same track.


So what remains is burning of edited leadin ISOs, and check out what happens. First step would be achieving the same "tracking errors" like we got by overburn. Next step coordinating those until we can create some SCEx near pattern as wanted.


The beginning would be very easy:

Just hexedit some Trumans CD Tool.DAO file and mess up the leadin sectors until getting some significant changes in boot behaviour.

Better we could edit that leadin iso systematically, but unfortunatly til now we still have no editors or something else like I suggested.


But first lets make some inventury:
--------------------------------------
Who's able here listening to Modpin6 line, by LED, Osci or Soundcard ?!?!
That important for analysing any results!

If its nobody, it seems all the whole burning, editing, testing stuff and work again all remains just for me. ;-) ;-(

But it wouldnt be very hard for anybody out there soldering some wire onto the Modchip Pin6 and a second wire onto PSXs ground and attaching outside some LED or audio jack! This would raise the speed to success alot. Well, its your turn.


However, at least we can got some working method, until we get some modified firmwares, maybe.... I wonder if they'd work at 4x speed, and almost all uptodate drives dont support 1x write speed anymore, another big "compatibility" problem.

So lets discover how to create matching lead-in errors, at least some "snap, crackle & pop's". Another big success if we can get them just by a "single written track".


CU, Sam

Sam

This is a classic case of needing stereo input. You have the pulses. Now you need to find out what causes them.

If they are caused by misstracking then I doubt they can be controlled, but your previous tests suggested misstracking can't produce periods of "wobble off" as long as you have now. There is the hope that something else is happening here.

There is plenty of evidence that the PSX only needs one clear sample of SCEx to load.

Ok NP Sam, I have however been doing some research on this project. And I was wandering if a programme which can set the speed and spindown, and tollerence of the writer, would help?

I have found one program whice can even set your writer to 1x speed like you wanted right?

Once you get a bootable PSX game, will you be working on a selfbootable PS2 game? after all the title of the thread is "new PSX/PS2 selfboot thread".

hey sam i tried to do the test disk but wont work
i wrote the smal dao file with truman tool but now the cd is no more recognized as empty so i can write the second file on it !!!
can you please put some more explications how you did it ?
anyway CONGRATS on youre sucess !

Sam, if you could develope an overburn guide which doesn't require me to leave my CD/DVD-RW cover open, that would be great.

EDIT: I have found this document on the internet about a mod chip and how it works with SCEX, it might be useful. Here is the link: http://www.telecable.es/personales/c...2decompile.txt

---

Last edited by The Lillster; 06-02-2004 at 01:19.