Tracking coil modulation & wobble deletion

hydro…iam not shure, but if i understand, what you want: you cannot (!!!) avoid the “wobble” on a cd-r, simply because its part of the production process. the stamper puts colour on the pressed “blank” cd, but there is a timing information needed, to use such a thing later in a “cd-writer”. so the timing info is always there…i tested with a scope on the data of recorded cd-r and you can easy find the regular pattern ! a “pressed” cd is different, just because the glass-master-writer is a expensive “writer”, that needs no timing info on the glassmaster, so here - and on the pressed copies - is no “timing”-pattern. a standard cd-writer could be modified, ok, ok, but have you any source for cd-r without “wobble” pattern ??? no ? so forget it.

look here, you ll see , why its so different to make a master or a cd-r…
http://www.mediatechnics.com/mastering.htm

I also agree that there is no way to avoid the ‘wobble’ on a CD-R. But, would it be possible to programatically ‘cancel out’ (or ignore) the expected ATIP wobble that is present on all CD-Rs? If so, then maybe one could concentrate on the non-expected wobble signals. If a PSX drives firmware is the one that detects the wobble signal, then my guess is all bets are off without a firmware hack.

lol guys im not trying to avoid the wobble im simply giving a way for the computer to be able to read, record and write the wobble along with the data encoded on that track in the wobble. cd rom drives have to constatly change tracking on the laser to compensate for vibration ect. by reading the signal outputed by a psx disk on the drive while the drive is not compensating for tracking and running at a very low speed we could then see the waveform that the wobble is in. then by running the same test with a normal straight spiral cd / dvd we can then deduce what the wobbles accual wave is by comparing the waves and aplying some math. once we have the wave we can then have the drive burn the data as described above and send that wave information to the tracking coils along with any tracking compensation to effectively burn the track exact. as stated above the major reason is due to software control the laser can burn anything. in short we have to get the picter before we can print it. also as above the read sensor outputs radio waves which alows the controler to know several things. first it shows if its on a bump or not. also by reading change in waveform it can determin how off center the laser is decause its resistance varies depending on how many photons hit the surface. making it purpously go straight meens we get a very exact reading of that waveform by reading the sinwave. also by using an oscilliscope and some running some tests we can record the different signals that do different things so we will know, how what signal we need in order for said to occur and how much we would have to modulat the signal to get what we want. also all “blank” cds accually have a timming groove in it si there is a groove but if u use a dvd burner on a cd rom the pit size is so small, 2x+, that the ridge line in a cdr is much larger so u can encode wobble in it, thats just an idea like all of this its just gonna take testing to find what will work. but above i was just giving a method to facilitat the meens to do it, i basicly said it is possable and its not as hard as previously thought its just that it will take testing to find the correct waves and modulation schems to carryout the plan.

also the mod box is effectivly a firware hack by reading and deducing what waveforms do what, then we can use this to determin what and how it should modulate the wave its basicly going over head of the control. its a bypass that gives us direct access to the hardware but by modulating control waves instead of creating them we can still use the controllers hardware to do much of the grunt work such as tracking and anticipation but the box would do all the reading and writing so there is no sofeware middleman. and yes but using testing and some math we can deduce and or cancel out the wobble to really read it and then output that to the laser. or we could for the drive to track the spiral while the disc spinns at a to low speed. if the controller doent know this that the data would seem stretched and cause tracking error as it could hit sections of all zeros and think its lost.
by dropping this low enough then effectivly all pits will make the controller think its lost on the frequency of error would be that specific wobble wave at that particular moment. there are many posablilities i think we just need some guildence which direction to go first even if its off my paths.

btw i know some comments were made a little rash by others but i am still very appreciative of any input its what helps me reset and rework the plan, its how i do my best work i need the input of others so please anything u can add that is constructive would be welcomed and appreciated thanx guys
peace

Guys, I think I said years ago the way around it.

The disc spins at 1x during the SCEx check. Its works out this speed from the data (distance apart 13T spaces are). Write the pits and lands 3x longer. The spindle will spin 3x faster during start up. 3x 20khz wobble becomes 60khz. 60khz is outside the band the AM detector used for SCEx is. You can then write your own wobble how ever you like at 6.5khx. When it is sped up 3x it becomes 20.5khz. Dead smack in the middle of the AM detectors band.

I did do a few experiments to show that the idea had merit (and posted about them). I was never able to get a CDR drive to cooperate with me on a few points though.

Still interested in cracking the cookie totally. Just not enough to waste more time with no end in sight and no availablity to a drive I can get data sheets for.

For anyone who doesn’t know, andrewm knows what he’s talking about - he’s made experiments in the past and has probed with oscilloscope, etc.

The disc spins at 1x during the SCEx check. Its works out this speed from the data (distance apart 13T spaces are). Write the pits and lands 3x longer. The spindle will spin 3x faster during start up. 3x 20khz wobble becomes 60khz. 60khz is outside the band the AM detector used for SCEx is. You can then write your own wobble how ever you like at 6.5khx. When it is sped up 3x it becomes 20.5khz. Dead smack in the middle of the AM detectors band.
Maybe there is some hope - but it isn’t easy!

I think you misunderstood us guys above, the ATIP wobble is already written on the CD-R, i.e. a writer does not write ATIP wobble it’s already there on a blank unwritten CD-R.

right, forget it…the timing is pressed by the cdr stamper, so no way to change it.
but: if its just for a copy, without the drive realizing it as a copy, the most simple way is: modify the drive, so it always reports “no copy” to the system.
or much more komplex: “andrewm-way” : change the recording speed , so the frequency of the wobble changes proportional (could be done by replacing the cd-writers clock crystal with a pll )

Are you talking about modifying the PSX CD drive? That’s not what we’re after here, i.e. a mod chip allows copies to be played flawlessly if you want that route. We’re (well I am) only doing this as a [U]challenge[/U] to see if there are any ways to break it without modifying the PSX at all.

Care to explain how one would change that without any specs or datasheets?

*I want to stress out to all:

  1. that my comments are not to cause offence,
  2. and any ideas should hold a sense of accuracy and acheivability by normal means. Example, one could say he can build a processor, car or a house, but to do so, is not in the reach of a normal person and without some serious expertise.

modifying the PSX CD drive…only doing this as a challenge

ok, but you have to modify a drive anyway: the reader or the writer …but stopping the reader to ident a copy as a copy is much more easy…

mod a writer with pll: no great problem, but it could loose tracking, if pll is far from normal speed, just because the servo loops are optimized for “normal” speed.
(btw circuit dia for writers…i dont know any source, so replacing master clock is my only idea to change speed…ooohhh, if drive references rotation and data speed from this clock: no effect, data–pre-groove relation will stay same)
so : need to get the speed-info-signal in the drive, and simulate a different signal to the drive, so it would record a different data–pre-groove relation
but searching for this signal in a writer…nice job…:slight_smile:

guys just want to say quickly that this is great i think we can really work this out. wether its varying speed, input to laser ect. all are at least a step forward. all we need to do is pick a direction to start with and take another step. if it works out its a step in a the right direction but if it doesnt and u gotta go back to square one at least u have the knowledge of what doesnt work. that is what will take us where we want to go. reverse engineering is a very difficult science but not impossable. and as for it being out of our reach its not. all those experts out there are experts because they either been taught or have learned from trial and error.

I think the best quote for the situation comes from Tom Edison. He tested thousands of possabilities for the lightbulb. yet in the end he said he found a thousand ways not to make a lightbulb but he only needed one to make it work.

his work of trial and error led so some of the greatest inventions of all time and in short the same applies here. guys this is not impossable it is poassoble and yes it seems extremly hard but we cant look at the big picture. he need to just look one step at a time and take it easy. ideas and the clash of them bring out the best in the end.

so dont give up and we will sucssed. and when we do victory will be sweeter than ever.

btw opened up an old cd burner of mine which has a farly simple control board with markings indicating key junction points on the board. im in the process at the moment of creating a full electronics schimatic of the control board with the assistance of my teacher. When its done i will use this along with some standered operation testing to get all the specification of everything, this will be very detailed otherwise no point right. so once i have mapped the electronics of it i just need help understanding the code and programing that the computer uses to control it so if any can give me a quick overview of the process im and electronics guy, not a programer so im gonna need help understanding this lol but from an electrics level ive got it under control. hope this helps and keep the ideas coming guys. we will sucssed, i cant tell u when but i am not about to give up, nothing is imposable in my eyes, nothing. and im willing to give blood sweat and tears for this so please keep it up i cant do it alone the more heads of knowledge the closer we can get.

hope the pep talk helps loljk

peace guys

If that is the case then wouldn’t the plexwriter premier come in handy here, since it can write streched pits? And btw I used to own one of those drives and the psx read it no problem.

Ok guys ive been doing a bunch of thinking on this is ive come to some realizations about the problems and possible solutions.
One is while dissecting the drive I noticed that the major controlling IC chips are made by Phillips in this drive so I then opened another from a completely different company and I saw the same thing that the main Ic chips where made by Phillips. What I realized after a little research is that sony and Phillips co-created the optical madea storage so they have the patents on the major control cicuits. So I have come to the conclusion that these similar cicuits are what control the key functions of the drives. This is a theory and will need some others efforts to confirm as I don’t have any more old drives to dissect. Also the cd burner has a removable/programmable BIOS chip so it is well within our ability, with some programming help to decifer the main controlling algorithims, and through this and some electrical test determine exact specs of optical components by comparing it with a different drive to see what is similar and what is changed to compensate for different specifications.

Now the other thing the ATIP groove. Its obvious that the timming is stamped into the cd as stated above. This groove wobbles do to two sources, Ambient vibration from the machine, earth ect and purpuosful vibration put in the groove to make it uniquie. This leads to the fact that ALL cd medium whos glass master was made in a different machine will have a distinct groove wobble. Now the basis of this project is to do what hasent been done so we have rules.
We cant modify the ps because its been done. We cant creat our owns cds because its to expensive and nearly impossible in the fact that the groove cant be changed on a cd-r. and this leaves us with seemingly no options. I was very upset at this prospect and the more I thought about it the more impossible the problem seemd.
So I was later burning some dvds when I found myself examining my reflection in a cd case. I saw that it wasn’t straight but warped by the shape of the clear plastic. This set off a though which has lead me to a whole new idea on the wobble and I think u guys will like this.

OK so if u could see a micro cross section of a cd-r you will see the clear plastic layer followed by the photo layer, the reflective layer and another clear plastic layer. If u could look closely at the first clear layer u would see a v-shaped goove, this is the tracking groove. The way it works is the laser heats the photo reactive dye, this causes it to instantly vaporize and this gass needs a place to go. The gas then expands into the v-shaped goove and leaves behind an area that is transparent. The cd-r is efectivly black to the laser but the transparent areas are read as bumps. Now the other thing is this grooves shap if you have ever looked at a vynil record its has a v shaped groove in it in a spiral the sound in this groove is encoded in the wobble of the groove. So its almost axactly the same as the atip groove but the atip groove is much, much smaller. And that’s the kicker its so small, and the room for error so small aswell, that its nearly impossible to get a perfect tracking of the spiral even if it didn’t wobble. This is the same for making the groove at the factory its so small that error is bound to happen. That’s why drives have extensive error correction mechinisims to account for this error.
Now the thing I realized is that if u cant modify the disk(groove) and you cant modify the drive then there is only one way, modify the light signal coming back to the laser. Think of it this way. The laser is not shot directly straight up, it is almost straight but not. This is because it doesn’t measure the amount of time to bounce off the disk and back, to much work. Instead it is at a slight angle and this angle is the key. Light enters the disk from one side of the groove, it refracts off the groove and data and then travels out the other side of the groove. this leades to my idea which is the equivalent of contacts for the cd. The only problem is its not going to be easy and its definetly not going to be cheap but it seems to be the only way of changing the groove, or should I say changing the APERENCE of the groove to the laser.
Basicly if we had a super, ultra precises cnc lathe and connected a cd laser pack right before the cutting tip. And used an ultra precise diamond tip it can be done. What is done is the lathe is connected to a computer, the computer reads a playstation disc with a special drive. The drive is able to record the wobble and is built specificly to not be effected by vibration. So its gotta be super accurate. Now that it has the groove data is sends this to the computer and uses a program and a little math to figure out how it has to modify the surface in order to do what we want it then sends this data to the lathe which does the work.
The lathe uses the laser to first identify where the groove is and tracks it on a blank cd-r. This is all done at very slow speeds because precision is key. It then cuts out in many strokes a specific undulating complex curve that takes the light that’s coming out of the disc and bends/refracts it to look like the wobble in the psx disk, similare to the way mirrors in a funhouse bend your imagechange its apperence its still your picture just warped. Then after it is done it would use a super fine diamond polish and a extra soft buff to make the plastic perfectly smooth. And viwoala it should work

Now I know it might sound far feched at first but there are some key points to my method. First it seems to be the only way to make the wobble appere to be something different. Second this doesn’t have to be done to the disk but could also be in the form of a disk sleeve like the protectors u snap on the bottom. Also it is not impossible because such machines and technics do exist its how them make precision fiber optic arrays and junctions for precision optics. And yes is will be expensive but it could be done at a fraction of what it would cost to stamp cds. So case in point is itcan be done but will require work and will also need assistance of the other techniques of pit lengthening and bed sector encoding ect. Like I said not easy but POSSIBLE.

So for the moment it seems I might have something here built I would like your guys opinions so tha and creases could be ironed out. Enjoy and peace

p.s. i also want to make a note that a friend of mine is a conputer science major and has enlightened me and a certin fact. there are accually 2 programmable controller chipsets with the cd burner. on is the bios chip on the control board which handles error correction and data translation algorithims, the others is a EPROM chip inside the laser assembly that translates data and controls the laser. this chip he mentioned also has within it the specifications and algorithims particular to that laser. this is the part we need to understand more about because it is what controls the laser not the control board that computes and translates data. so yea put your thinking caps on and id like to hear back. peace

Right… I have let the old PSX threads last for years with
such nonsense, I will not let this thread go the same way.
From now on only realistic and sensible posts will be kept,
the rest will be beamed to alt.fan.star-trek. Best of luck to
you to “decifer the main controlling algorithims”, whatever
that means.

Hi friends and ‘long’-time-ago bootprotection co-fighters, after a long time ‘giving up’ I see you’re all still here! Thank you all and also the newly interrested guys around.

Apologize my absence but as ambitious and strong-willed I am, there is still enough power left for beating this “impossible task” in me.

First I have to read over again all the theories and technical issues we found out but that idea I had a few weeks ago sounds really simple (but I know is hard to get done):

absolute raw burning!

Switching the laser on and off at ANY time we want it, writing from a very special raw (binary) image file. I’m shure those mysterious hong kong ps-x-change lik-sang (shutdown by $ony) bootdisk really was burned but on a different speed (or with hardware which doesn’t need wobble). It must be possible copying some “picture” of the wobble how it looks like at the pits and lands level and imitate this or the effect it has on the laser - at least we have to know the exact length in bits or bytes or whatever. Maybe it is possible to overwrite the usual burned CD-R with some kind of “light-track”, which makes the wobble gone or just invisible for the psx-laser, besides the few important spots at the lead-in.

I’m still having my special modified PSX, it still works (after 10 years!) and can do all those tests again, with or without SCExy programmed smartcard!

Perhaps I have to buy a new CD-Burner first. Problem: I’m having already 3 DVD-Burners and the old hardware-swap (overburncapable) Mitsumi 2x, but don’t know if they do the special job.

I’m happy Truman is still around but I’m shure he reached already the borders of “raw-burning”.

Enough info for the moment. I’ll keep an eye here again now and even if it makes me headaches without end, I want and I will find a way to beat this “foolproofed” protection - without modchip etc. It may sound absurd after that many frustrating defeats and “useless” efforts but I’m not finished yet, as long as my “genious” is alive and kicking. gg :wink:

I 2nd that spath. This is supposed to be a techincal forum. Any silly posts will be laser vaporised (deleted) - you have been warned.

Blah, the alexnoe syndrome again… listen, you’re a damn student.
In other words, you have zero experience and your knowledge is
theoretical and mainly useless in practice, as you will realize
when you get a job. People here work in this field and/or have
practical experience with CD/DVD software and/or electronics,
so you’re far far behind.

Oh, so it’s an “algoithim” now ? Is that like these mysterious
"algorithim" you were talking about ? FYI part of an engineer’s
job is to write documents, so you should seriously work on your
spelling, grammar and style.

No they wont. If you have something concrete to share,
like results of experiments, you’re welcome to post them.
But if you post more of your theoretical sci-fi ideas, you’re
out of here.

It’s really OK if spath or whoever looks that this thread stays ontopic but it’s contraproductive if he deletes important information! Or was this second, much more important posting of me 2 days ago just deleted by mistake?? Such offences against me don’t raise my motivation! :frowning: If this happens again I will communicate by email or other ways with the interested persons and no longer in public…

Otherwise Truman wouldn’t just talking about how great spath’s beaming postings to xy is, but could had answered already how or if he has made some advantages and improvements in “low level laser-controlling” meanwhile.

So again, @ Truman: We just have to need the laser switched on and off precisetimed, without any data etc for very short timeperiods. The laser can even write shorter or longer lines instead of “dots”, if there’s no laser-burn-out problem!

Writing the complexest stuff to disk but cannot simply switch the laser on and off is ridicolous especially because we really would need it now!

So I say it again:

If we ever want to beat that protection we have to write very short overburn “SCEx pattern” onto disc! I’ve made tests already that overburn techniques can lead to the results we need, because I can record and get the overburn-results directly at the source-signal-line where all this data is send to the BIOS!

@hydrohollic
Don’t get me wrong, you may have alot technical experience or “inspiration” but your ideas for beating this protection are simply far away from every possible realisations, especially your idea of using strong uv light to “burn” those pattern into the reactive dye. If you wanna help us concentrate yourself on possible and realistic methods. Don’t you think it’s absurd creating such black-boxes inbetween some drives which read and write “everything” if we even haven’t a possibility switching on and off the laser by a simple stupid assembler command???

btw. I also have my big doubts the idea of andrewm ever will work. Even if we burn the CD-R on a speed which “overclocks” the wobble - we still need something that causes the SCEx signal - so if the wobble was made succesfully “invinsible” by Andrews technique, what idea does he has for getting it back for those needed SCEx intervals??? The CD won’t start spinning slower for the needed few milliseconds.

I have thought alot how to solve this problem we’re dealing a long time now, using only CD-R media (no swap stuff or modchip) and there are only 2 possibilities:

#1
sophisticated overburn

#2
writing some special donglekey-stuff onto CD-R which executes automatically and can trick the BIOS’ boot process (so far there is no indice such a backdoor, similar to the Dreamcast, does exist or exists at all, so I really suggest we forget #2)

First, I didn´t delete your post, but if I had read it I might well have
done so. Second, let me remind you that we have hosted (ie paid) for
more than two years your discussions about PSX booting and wobble,
for a total of nearly 1,000 posts. All these discussions lead nowhere,
so don´t tell me about productivity.

As said before this topic has been beaten to death, so from now on
only posts containing realistic and new information as judged
by Truman and me will be allowed ; the rest will be deleted without
notice, and this includes your posts. If you don´t like it, don´t use
this board.

Hi spath and everyone else,

OK, fine & thx that you delete not that 2nd post, but that’s post ehm past now anyway… :wink:

>we have hosted (ie paid)
I don’t know how cdfreaks.com pays or refinances (advertisments…) his forums, and it’s not my business, but I guess and hope its profitable etc. for them if people write interresting threads, and the PSX protection always was very interresting and fascinating, not only for me. We’ve had over 100.000 views.

> All these discussions lead nowhere
Well, compared with the “mess” before, it not only did lead to clearing up everything, we also developed many things and perhaps everyone now has the proof that there’s absolutly no way in writing selfbootable PSX disx. Shure, the effort was high, but who cares. We’re not here at a 'boot’camp, it also has to be a bit funny and motivating. :wink:

But now the bad news anyway: :frowning:

Looking to some 6000x CD-R microscope pictures I recognised really big differences of the pits-land structure if using different media, burningspeed or writers! So even if one of us sometimes (and perhaps with professional equipment only!) really can assimilate the wobble interference by ultra-short overburns - I’m shure no other else will, as long as he doesn’t use the absolute identic equipment - which is highly questionable. This is the bitter truth, but also a release for us, 'cause it leads our concentration away from this anyway extremly complicated method.

So there’s only one way left - tricking the BIOS or SCEx bootcode-verification.

Before all my efforts was “how to (over)-write the SCEx”, so for the moment I haven’t many idea’s how to achive that goal, but they do exist:

Perhaps creating buffer-overflows so a special code can be executed (for our needed bypassing the SCEx checks) or finding a way the already existing memory-card dongle-code can be written on CD-R (in other words: this CD-R has to boot just one single time by chip, PS-X-Change or swaptrick - but after this the boot-dongle-crack gets installed permanent on everyones memorycard). The advantage of this method: no special hardware or software needed, only that special psx.iso has to be copied correct!

It’s easy to copy data from CD-R to PSX memorycards, I’ve done this already with a selfcreated savestate-icon, but what we need is the dongle-code. We’ve had already a person here who worked with such dongle-memorycards or what exactly this was, so we might have a chance to contact 'em again or find other possibilitys.

So good luck and a great 2007 to all of you CDfreaks out there! :slight_smile:

A random posting thread had 3 times this amount :
http://club.cdfreaks.com/showthread.php?t=48450
Does that mean its content is even more interesting
and fascinating than PSX protection ?

If the PSX thread had contained anything practical,
it would have brought ten times this amount of
views, such as this thread about WMA protection :
http://club.cdfreaks.com/showthread.php?t=78454

Ahhh, finally ! This is what this thread was about,
so now I can finally close it and end this 4 years
long saga. Note also that there are better forums
than this one to discuss modchips and buffer overflows,
for instance this one : http://club.cdfreaks.com/forumdisplay.php?f=98