Editing PS1 Emulation

== Description ==
Note: there are no PS1 emulators available in early Tool/DECR and Debug/DEX firmwares (does not have dev_flash/ps1emu or ps2emu folder. dev_flash/vsh/etc/version.txt & index.dat say: ¨ps1emu:NA@NA: ps2emu:NA@NA: ps2gxemu:NA@NA: emerald:NA@NA: bdp:NA@NA:¨).

{{Boxframe1|content='''Firmware changes related with PS1 emulation'''
*Firmware [[1.02_CEX|1.02]]:
**Added '''ps1_emu.self'''

*Firmware [[1.70_CEX|1.70]]:
**Added '''ps1_netemu.self'''
**Added the ability to play original PlayStation format games downloaded from the PlayStation Store.
**Added rumble functionality for USB accessories which support it when playing PS2 games.
**Saved data from PlayStation format software now usable on both PSP and PS3 systems.
**Backwards compatibility for PS1 and PS2 games was improved.

*Firmware [[1.80_CEX|1.80]]:
**Ability to upscale PS1 and PS2 games
**Ability to copy PS1/PS2 game saves from PS3 to Memory Cards using a Memory Card adapter.
**Backwards compatibility for PS1 and PS2 games was improved.

*Firmware [[2.10_CEX|2.10]]:
**Added '''ps1_newemu.self'''
**Added '''ps1_rom.bin''' (MD5: FBB5F59EC332451DEBCCF1E377017237)
**Users can now play PS1 game discs on a PSP with remote play, PSP firmware version 3.50 or newer is required. (this feature was not announced).
**Backwards compatibility for PS1 and PS2 games was improved (Update was also unannounced but evident in Sony's backwards compatibility search site).

*Firmware [[4.00_CEX|4.00]]
**Updated '''ps1_rom.bin''' (MD5: 81BBE60BA7A3D1CEA1D48C14CBCC647B). The new rom is stripped from PS2 related functions. As a result is 3565296 bytes smaller than previous version.
}}

== Files ==

=== Emulator versions ===
There is no accurate info in wiki about the different PS1 emulator .self revisions, if you want to collaborate documenting this info see the experimental table on {{talk}} page

=== Game formats ===
See: [[ISO.BIN.EDAT]] and [[PSISOIMG0000]]

=== Savegames ===
*Location: /dev_hdd0/savedata/vmc
Note: capitalisation of filename is important: name it xxx.VM1 instead of xxxx.vm1 (e.g. Internal Memory Card.VM1 for PSX/PSone, Internal Memory Card.VM2 for PS2/PStwo)

The .VMx files appear to be raw memory card data:
* [[PS1_Savedata#Virtual_Memory_Card_PS1_.28.VM1.29 | .VM1 Playstation 1 Memory cards]] can be edited with [[PS1_Savedata#Memory_Card_Tools_PS1 | MemcardRex]]
* [[PS2_Savedata#Virtual_Memory_Card_PS2_.28.VM2.29 | .VM2 Playstation 2 Memory cards]] can be edited with [http://www.csclub.uwaterloo.ca:11068/mymc/ mymc]

==PS1 emulators workload comparison==

All emulators seems to use similar workload. Note that SPU 0-4 don't use JOB name per se, so is just info what they do.

{| class="wikitable" style="font-size:100%; line-height:100%"
|+ ps1_emu.self<br><div style="height:5px"></div>
! Core !! Job !! Source !! Notes
|-
| SPU0 || PS1 GPU SLI0 || SPU ASM || PS1 GPU software emulation
|-
| SPU1 || PS1 GPU SLI1 || SPU ASM || PS1 GPU software emulation
|-
| SPU2 || PS1 GPU SLI2 || SPU ASM || PS1 GPU software emulation
|-
| SPU3 || PS1 GPU SLI3 || SPU ASM || PS1 GPU software emulation
|-
| SPU4 || PS1 SPU || SPU ASM || PS1 SPU software emulation
|-
| SPU5 || _libadec_at3CellSpursKernel0  || SPU ASM || AT library from ps3 firmware
|-
| SPU6 || Isolation || C++ Raw SPU || Not PS1 emu specific
|-{{cellcolors|lightgrey}}
| SPU7 || - || - || Unavailable: Factory disabled SPU
|-
| PPU:0 || ? || ? ||
|-
| PPU:1 || ? || ? ||
|}
{| class="wikitable" style="font-size:100%; line-height:100%"
|+ ps1_netemu.self<br><div style="height:5px"></div>
! Core !! Job !! Source !! Notes
|-
| SPU0 || PS1 GPU SLI0 || SPU ASM || PS1 GPU software emulation
|-
| SPU1 || PS1 GPU SLI1 || SPU ASM || PS1 GPU software emulation
|-
| SPU2 || PS1 GPU SLI2 || SPU ASM || PS1 GPU software emulation
|-
| SPU3 || PS1 GPU SLI3 || SPU ASM || PS1 GPU software emulation
|-
| SPU4 || PS1 SPU || SPU ASM || PS1 SPU software emulation
|-
| SPU5 || _libadec_at3CellSpursKernel0  || SPU ASM || AT3 library from ps3 firmware
|-
| SPU6 || Isolation || C++ Raw SPU || Not PS1 emu specific
|-{{cellcolors|lightgrey}}
| SPU7 || - || - || Unavailable: Factory disabled SPU
|-
| PPU:0 || ? || ? ||
|-
| PPU:1 || ? || ? ||
|}
{| class="wikitable" style="font-size:100%; line-height:100%"
|+ ps1_newemu.self<br><div style="height:5px"></div>
! Core !! Job !! Source !! Notes
|-
| SPU0 || PS1 GPU SLI0 || SPU ASM || PS1 GPU software emulation
|-
| SPU1 || PS1 GPU SLI1 || SPU ASM || PS1 GPU software emulation
|-
| SPU2 || PS1 GPU SLI2 || SPU ASM || PS1 GPU software emulation
|-
| SPU3 || PS1 GPU SLI3 || SPU ASM || PS1 GPU software emulation
|-
| SPU4 || PS1 SPU || SPU ASM || PS1 SPU software emulation
|-
| SPU5 || _libadec_at3CellSpursKernel0  || SPU ASM || AT3 library from ps3 firmware
|-
| SPU6 || Isolation || C++ Raw SPU || Not PS1 emu specific
|-{{cellcolors|lightgrey}}
| SPU7 || - || - || Unavailable: Factory disabled SPU
|-
| PPU:0 || ? || ? ||
|-
| PPU:1 || ? || ? ||
|}

== Arguments ==

=== ps1_emu.self ===

{| class="wikitable"
|+ps1_emu.self arguments
! 7 arguments !! Name !! Example !! Notes
|-
| argv[0] || self starting location || dev_flash/ps1emu/ps1_emu.self ||
|-
| argv[1] || VM1-1 location || dev_hdd0/savedata/vmc/filename1.VM1 ||
|-
| argv[2] || VM1-2 location || dev_hdd0/savedata/vmc/filename2.VM1 ||
|-
| argv[3] || Regionnumber/TargetID || 0082 ||
|-
| argv[4] || unknown || 1200 || <!-- Screen Resolution... related ? -->
|-
| argv[5] || unknown || 1 || '''[[XRegistry.sys]]/setting/game/emuUpConvert''' ? (full/normal/off = 2/1/0)
|-
| argv[6] || unknown || 0 || '''[[XRegistry.sys]]/setting/game/emuSmoothing''' ? (on/off = 1/0)
|-
|}

=== ps1_netemu.self ===

{| class="wikitable"
|+ps1_netemu.self arguments
! 9 arguments !! Name !! Example !! Notes
|-
| argv[0] || Self starting location || dev_flash/ps1emu/ps1_netemu.self ||
|-
| argv[1] || VM1-1 name || (dev_hdd0/savedata/vmc/)argv[1] ||
|-
| argv[2] || VM1-2 name || (dev_hdd0/savedata/vmc/)argv[2] ||
|-
| argv[3] || Regionnumber/TargetID || 0084 ||
|-
| argv[4] || Unknown || 1200 || <!-- Screen Resolution... related ? -->
|-
| argv[5] || Path to ps1 game || /dev_hdd0/game/NPUJ01324 ||
|-
| argv[6] || Vibration on/off? || 1 || Seems to be '''[[XRegistry.sys]]/setting/pad/vibrationEnable'''	
|-
| argv[7] || Emu UpConvert || 0 || '''[[XRegistry.sys]]/setting/game/emuUpConvert''' ? (full/normal/off = 2/1/0)
|-
| argv[8] || Emu Smoothing || 0 || '''[[XRegistry.sys]]/setting/game/emuSmoothing''' ? (on/off = 1/0)
|-
|}

=== ps1_newemu.self ===

{| class="wikitable"
|+ps1_newemu.self arguments
! 9 arguments !! Name !! Example !! Notes
|-
| argv[0] || self starting location || dev_flash/ps1emu/ps1_newemu.self ||
|-
| argv[1] || VM1-1 name || (dev_hdd0/savedata/vmc/)argv[1] ||
|-
| argv[2] || VM1-2 name || (dev_hdd0/savedata/vmc/)argv[2] ||
|-
| argv[3] || Regionnumber/TargetID || 0082 ||
|-
| argv[4] || unknown || 600 ||
|-
| argv[5] || path to ps1 game || /dev_hdd0/game/NPUJ01324 ||
|-
| argv[6] || unknown || 1 ||
|-
| argv[7] || unknown || 2 ||
|-
| argv[8] || unknown || 2 ||
|-
|}

==PS1 GPU emulation==

That part of all 3 emulators is quite impressive. Task is split between 4 SPE cores, but not in usual way.
Every core is responsible for different part of PS1 GPU command flow, which is done dynamically. All that is linked by so called sli (spu link?), and all SPE cores run exactly same elf file.
SPE program synchronize using sliTick, and sliTock functions with use of channels 16 - 24, and with help of PPU.
That way 4 different PS1 GPU emulators can proceed 4 different PS1 GPU commands at the same time, with synchronization enough to not override other PS1 GPU tasks.
As a example you can remove dithering by patch only on SPU0, and observe that only 1/4 of displayed lines will be missing dither pattern. 

== Game settings ==

=== External CONFIG file ===
Created/loaded by ps1_newemu.self and ps1_netemu.self, at path: /USRDIR/CONFIG

Content: 
<pre>
00000000 1C 00 00 00 50 53 31 45 6D 75 43 6F 6E 66 69 67 ....PS1EmuConfig
00000010 46 69 6C 65 00 97 0A 54 04 00 00 00 01 00 00 00 File...T........
00000020 0F D4 CC B9 10 00 00 00 64 69 73 63 5F 6E 6F 00 ........disc_no.
00000030 04 00 00 00 00 00 00 00 93 D1 5B F8             ..........[.    
</pre>

{| class="wikitable"
|-
! Offset !! size !! data !! notes
|-{{cellcolors|lightgrey}}
| 0x00 || 0x04 || 1C 00 00 00 || size of the next 4 values
|-
| 0x04 || 0x10 || '''PS1EmuConfigFile''' || name/id
|-
| 0x14 || 0x04 || 00 97 0A 54 || ?
|-
| 0x18 || 0x04 || 04 00 00 00 || ?
|-
| 0x1C || 0x04 || 01 00 00 00 || ?
|-{{cellcolors|lightgrey}}
| 0x20 || 0x04 || 0F D4 CC B9 || crc32 of the previous 4 values
|-
| colspan="4" | 
|-{{cellcolors|lightgrey}}
| 0x24 || 0x04 || 10 00 00 00 || size of the next 3 values
|-
| 0x28 || 0x08 || '''disc_no''' || name/id
|-
| 0x30 || 0x04 || 04 00 00 00 || amount of discs
|-
| 0x34 || 0x04 || 00 00 00 00 || disc number
|-{{cellcolors|lightgrey}}
| 0x38 || 0x04 || 93 D1 5B F8 || crc32 of the previous 3 values
|-
|}

*Other posible entries/commands/id
**'''user_memory_size''' ? (in both ps1_newemu.elf and ps1_netemu.elf appears next to ''PS1EmuConfigFile'' and ''disc_no'')

=== Embedded Game settings ===
*Notes
**The value named "flags" is composed by 2 values unk1[4], unk2[4], located at a second depth level of  hierarchy structure. unk1[4] '''varies''' in between different ps1 emu versions (this variation indicates that <abbr title="but mostly a counter that could indicate a command ID indirectly from the "slot number" of another table>'''is not a command ID'''</abbr>), and unk2[4] have different purposes, sometimes contains a final value (so it represents the ending of a fork of the hierarchy) or an offset (to move one level deeper in the hierarchy), if the value is an offset also '''varies''' in between different ps1 emu versions
**Checksum is simple Adler32 calculated from 2048 bytes of disc data, starting from 0x9318 offset in raw image. Emulator perform check if that sector have CD001 string, if string is missing "unknown" string is used, and hash calculation is not performed. You can use tools like hashtab to easily calculate checksum for new game. 

==== Sector 16 checksum ====
Hash is calculated using the data contents only (2048 bytes or 0x800h) of the sector 16 (beginning at the 0x9318 of the RAW/2352 image). Every single byte is used in the process. Calculation code does start at 0xC1658 in the ps1_netemu from 4.88 firmware.
<pre>
loc_C1658:
0xC1658   lwz       r11, -0x7E4C(r2)
0xC165C   lis       r6, -0x7FF9
0xC1660   li        r9, 0x800                           # number of bytes to process. The value is passed to the CTR register next.
0xC1664   li        r0, 1
0xC1668   ori       r6, r6, 0x8071 # 0xFFFFFFFF80078071 # value the bytes are multiplied by
0xC166C   mtctr     r9                                  # set the CTR register for the loop count decrement
0xC1670   mr        r7, r24                             # first offset of the sector data to process moved into the r7 register (0x2DC28C in the RAM).
0xC1674   li        r10, 1                              # set the r10 register to 1.
0xC1678   li        r8, 0                               # set the r8 register to 0.
0xC167C   addi      r15, r24, 0x800                     # last offset of the sector data to process. It does not seem to be used at all.
0xC1680   stw       r0, 0x2640(r11)
loc_C1684:
0xC1684   clrldi    r11, r7, 32                         # move the content from r7 to the r11 (it is the current offset of the byte to process)
0xC1688   addi      r7, r7, 1
0xC168C   lbz       r9, 0(r11)                          # load the byte for calculation
0xC1690   add       r9, r10, r9                         # add r10 to r9
0xC1694   mulhwu    r0, r9, r6                          # multiply the byte by constant and store the high 32 bits of result in the r0
0xC1698   srwi      r10, r0, 15                         # divide the result by 0x8000
0xC169C   slwi      r11, r10, 4                         # multiply r10 by 0x10
0xC16A0   slwi      r0, r10, 16                         # multiply r10 by 0x10000
0xC16A4   subf      r0, r11, r0
0xC16A8   add       r0, r0, r10
0xC16AC   subf      r10, r0, r9
0xC16B0   add       r11, r8, r10
0xC16B4   mulhwu    r0, r11, r6
0xC16B8   srwi      r8, r0, 15
0xC16BC   slwi      r9, r8, 4
0xC16C0   slwi      r0, r8, 16
0xC16C4   subf      r0, r9, r0
0xC16C8   add       r0, r0, r8
0xC16CC   subf      r8, r0, r11
0xC16D0   bdnz+     loc_C1684                           # loop

0xC16D4   lwz       r22, -0x7E4C(r2)
0xC16D8   mr        r3, r22
0xC16DC   lbz       r4, 0xA7(r22)
0xC16E0   lbz       r0, 0xA6(r22)
0xC16E4   slwi      r4, r4, 8
0xC16E8   lbz       r9, 0xA5(r22)
0xC16EC   lbz       r11, 0xA4(r22)
0xC16F0   or        r4, r4, r0
0xC16F4   slwi      r0, r8, 16                         # multiply the r8 by 0x10000 and place the result in the r0 register. It is the higher four bytes of hash.
0xC16F8   slwi      r4, r4, 8
0xC16FC   add       r0, r0, r10                        # add the r10 to r0 - the lower four bytes of hash
0xC1700   or        r4, r4, r9
0xC1704   stw       r0, 0x2640(r22)                    # store the hash
</pre>

Super simple python script to calculate checksum, script lack of some checks performed by emu, and is hardcoded to 0x9318 offset, but should be enough.<br>
Usage: edit *your first.bin* to name of your image, run script from CMD. Require python (3?).
<pre>import zlib

with open('your first.bin', 'rb') as f:
    f.seek(0x9318)
    suma = zlib.adler32(f.read(2048))
    print (hex(suma))</pre>

==== Game settings lists ====

<div class="mw-collapsible mw-collapsed" style="background:#ffb0b0; margin:5px 0px">'''TitleID settings hardcoded in ps1_emu.self'''
<div class="mw-collapsible-content" style="text-align:left">{{TitleID settings hardcoded in ps1_emu.self}}
</div></div>{{clear}}

{{TitleID settings hardcoded in ps1_netemu.self}}

<div class="mw-collapsible mw-collapsed" style="background:#b0b0ff; margin:5px 0px">'''TitleID settings hardcoded in ps1_newemu.self'''
<div class="mw-collapsible-content" style="text-align:left;">{{TitleID settings hardcoded in ps1_newemu.self}}
</div></div>{{clear}}

==PS1 rom handling==
Current version of ps1_rom file is first 512KB of 1.90 PS2 rom. Previously it was exactly the same version but whole 4MB were supplied to emulator.<br>
Since firmware 2.10++ all PS1 emulators, ps1_emu.self, ps1_netemu.self, ps1_newemu.self uses the since then added ps1_rom.bin bios file. In earlier firmwares file was embed into every emulator self file. File '''ps1_rom.bin''' is exactly the same file that was previously embed in all PS1 emulators.

{| class="wikitable" style="line-height:110%; font-size:90%"
|+ ps1_rom.bin
! Firmware !! Size !! MD5
|-
! [[2.10_CEX|2.10]] ~ [[3.74_CEX|3.74]]
| 4.089.584 || style="font-family:monospace" | FBB5F59EC332451DEBCCF1E377017237
|-
! [[4.00_CEX|4.00]] ~ [[4.88_CEX|4.88]]
| 524.288 || style="font-family:monospace" | 81BBE60BA7A3D1CEA1D48C14CBCC647B
|}

===Region patch===
All 3 emulators perform bios patching right after file is loaded into memory. Patch is related to region lock, and is unknown that its responsible for anything else, like timings etc.<br>
There is a string in emulator JJJJAEJEAEJJEJJA which is selector for bios/rom region based on target ID ([[Product_Code]]). 
<pre>J    J    J    J    A    E    J    E    A    E    J    J    E    J    J    A
0x80 0x81 0x82 0x83 0x84 0x85 0x86 0x87 0x88 0x89 0x8A 0x8B 0x8C 0x8D 0x8E 0x8F</pre>
Patch apply to string in VERSTR, '''X''' is replaced with appropriate region:
<pre>System ROM Version 5.0 06/23/03 X
Copyright 1993-1999 (C) Sony Computer Entertainment Inc.
</pre>

Is worth to note that '''X''' is always on the same offset in ALL ps1 bios versions, and all ps2 bios images. So in case of bios swap 
([[Talk:PS1_Emulation#ps1_rom.bin]] ) correct region will be still set.<br>
Patched offset is 0x7FF52 in rom file itself. Cobra have region free patch that in the end make X set to A (America) region, which apparently make bios region free. This can be true as similar thing happen on PCSX2 in ps1 mode. US rom is able to run all regions games, while JPN/EU fail to load different regions. It is because later JPN/EU BIOS versions have got an additional CD licence check introduced, accepting only the discs matching the hardcoded region. US BIOSes have never got this check implemented. By the way, it is the same thing with the PS2 BIOSes - only the US one will accept the discs from all over the world by default (that is why you have to patch the MECHACON for the US DTL region to get true region free playback).

==PS1 games management in multiman==
=== Manual starting SELF method ===
#Insert PSX/PSone disc (region/pressed doesn't matter)
#Start MultiMAN (e.g. 2.07.01++)
::*Since 02.07.05 the PSX and PS2 discs are properly detected. PSX discs will show in XMB Game Column and you can launch the PS1 game from there. It uses ps1_emu.self default (you can choose Load or Load (Net), latter uses ps1_netemu).
#Switch to filemanager mode
#Browse to /dev_flash/ps1emu
#Select either one of the ps1 emulation SELF files

Note: Some games run better with ps1_emu.self (e.g. Mortal Kombat) while others run better with ps1_netemu.self (e.g. Resident Evil 3). If it doesn't work, try another ps1 emulation SELF file.

Downside: memory card options are unavailable unless you created a Virtual Memorycard ''before'' starting MultiMAN (XMB::Category Game:: Memory Card Utility (PS/PS2) > Create a PS1 memory card. Set it to Slot 1 (Press Triangle while selecting the Memory Card, then Assign it). Note: naming it "Internal Memory Card" sometimes works better than other names. MultiMAN 02.07.07 seems to solve the savegame issues.

=== Changes in MultiMAN 2.07.00/01 for ps1_emu handling ===
These options where needed to make above work:
* Added: LV2 access rights to use LV1 Storage Manager (syscall 864)
* Added: LV1 patch for user access to sys_storage functions (syscalls 600 to 623)

=== Arguments handling===
From multiman.cpp source (line 2502) http://code.google.com/p/multiman/source/browse/source/multiman.cpp?r=8c5b662f1c54d4f95f646949cae3d033b15b1a2e
{{Boxcode|code=<syntaxhighlight lang="c">
{
	char* launchargv[9];
	memset(launchargv, 0, sizeof(launchargv));
	launchargv[0] = (char*)malloc(strlen(mc1)+1); strcpy(launchargv[0], mc1);
	launchargv[1] = (char*)malloc(strlen(mc2)+1); strcpy(launchargv[1], mc2);
	launchargv[2] = (char*)malloc( 5); strcpy(launchargv[2], "0082");
	launchargv[3] = (char*)malloc( 5); strcpy(launchargv[3], "1600");
	launchargv[4] = (char*)malloc(10); strcpy(launchargv[4], app_path);
	launchargv[5] = (char*)malloc( 2); strcpy(launchargv[5], "1");
	launchargv[6] = (char*)malloc( 2); strcpy(launchargv[6], "2");		// full screen	on/off	= 2/1
	launchargv[7] = (char*)malloc( 2); strcpy(launchargv[7], "1");		// smoothing	on/off	= 1/0
	launchargv[8] = NULL;
	unload_modules();
	exitspawn((const char*) "/dev_flash/ps1emu/ps1_netemu.self", (char* const*)launchargv, NULL, NULL, 0, 1001, SYS_PROCESS_PRIMARY_STACK_SIZE_1M);
}

{
	char* launchargv[7];
	memset(launchargv, 0, sizeof(launchargv));
	launchargv[0] = (char*)malloc(strlen(mc1)+1); strcpy(launchargv[0], mc1);
	launchargv[1] = (char*)malloc(strlen(mc2)+1); strcpy(launchargv[1], mc2);
	launchargv[2] = (char*)malloc( 5); strcpy(launchargv[2], "0082");	// region
	launchargv[3] = (char*)malloc( 5); strcpy(launchargv[3], "1200");
	launchargv[4] = (char*)malloc( 2); strcpy(launchargv[4], "1");		// full screen	on/off	= 2/1
	launchargv[5] = (char*)malloc( 2); strcpy(launchargv[5], "1");		// smoothing	on/off	= 1/0
	launchargv[6] = NULL;
	unload_modules();
	exitspawn((const char*) "/dev_flash/ps1emu/ps1_emu.self", (char* const*)launchargv, NULL, NULL, 0, 1001, SYS_PROCESS_PRIMARY_STACK_SIZE_1M);
}
</syntaxhighlight>}}
*Notes:
**The '''''full screen''''' commented argument seems to be the '''Upscaler''' setting available from XMB {{icon category settings}} ⇨ '''[Game Settings]''' ⇨ '''[PS/PS2 Upscaler]''', with values: '''full/normal/off = 2/1/0'''
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>