Editing PS1 Emulation

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 157: Line 157:
| colspan="2" style="text-align:center; background-color:#ddddff;" | ''Any''
| colspan="2" style="text-align:center; background-color:#ddddff;" | ''Any''
|-
|-
! [[4.89_CEX|4.89]]
! [[4.88_CEX|4.88]]
| style="background-color:#ddddff; font-family:monospace" | 44F975821FD714E2E810771836178CB3 || style="background-color:#ddddff;" | 22/02/04/14:38
| style="background-color:#ddddff; font-family:monospace" | 0C553CE93A2A6322E16636DD76D75E32 || style="background-color:#ddddff;" | 21/04/12/11:34
|}
|}
<span style="font-size:small">
<span style="font-size:small">
{{dot}}'''Decrypted (elf)''': changes <abbr title="When comparing two decrypted files of the same revision from different firmwares the only differences are the build label (1 area with size 0x20) and the target firmware (1 area with size 0x2)">every firmware version</abbr><br>
{{widedot}}'''Decrypted (elf)''': changes <abbr title="When comparing two decrypted files of the same revision from different firmwares the only differences are the build label (1 area with size 0x20) and the target firmware (1 area with size 0x2)">every firmware version</abbr><br>
{{dot}}'''<abbr title="0x20 bytes">Build label</abbr>''': yes, with timestamp, search for '''-sgpu-sspu-sli4'''<br>
{{widedot}}'''<abbr title="0x20 bytes">Build label</abbr>''': yes, with timestamp, search for '''-sgpu-sspu-sli4'''<br>
{{dot}}'''<abbr title="2 bytes">Target Firmware</abbr>''': yes repeated '''one''' time<br>
{{widedot}}'''<abbr title="2 bytes">Target Firmware</abbr>''': yes repeated '''one''' time<br>
{{dot}}'''Revision''': unknown
{{widedot}}'''Revision''': unknown
</span>
</span>
</div>
</div>
Line 275: Line 275:
| colspan="2" style="text-align:center; background-color:#ddddff;" | ''Any''
| colspan="2" style="text-align:center; background-color:#ddddff;" | ''Any''
|-
|-
! [[4.89_CEX|4.89]]
! [[4.88_CEX|4.88]]
| style="background-color:#ddddff; font-family:monospace" | AE51D20A9E9564A135800E0F0AFC3F53 || style="background-color:#ddddff;" | 22/02/04/14:39
| style="background-color:#ddddff; font-family:monospace" | D3283D3F3B5CDF68113560829530E7B3 || style="background-color:#ddddff;" | 21/04/12/11:34
|}
|}
<span style="font-size:small">
<span style="font-size:small">
{{dot}}'''Decrypted (elf)''': changes <abbr title="When comparing two decrypted files of the same revision from different firmwares the only differences are the build label (1 area with size 0x20) and the target firmware (2 areas with size 0x2)">every firmware version</abbr><br>
{{widedot}}'''Decrypted (elf)''': changes <abbr title="When comparing two decrypted files of the same revision from different firmwares the only differences are the build label (1 area with size 0x20) and the target firmware (2 areas with size 0x2)">every firmware version</abbr><br>
{{dot}}'''<abbr title="0x20 bytes">Build label</abbr>''': yes, with timestamp, search for '''-sgpu-sli4'''<br>
{{widedot}}'''<abbr title="0x20 bytes">Build label</abbr>''': yes, with timestamp, search for '''-sgpu-sli4'''<br>
{{dot}}'''<abbr title="2 bytes">Target Firmware</abbr>''': yes repeated '''two''' times<br>
{{widedot}}'''<abbr title="2 bytes">Target Firmware</abbr>''': yes repeated '''two''' times<br>
{{dot}}'''Revision''': <abbr title="ps1_netemu.self from firmware 2.10 (or older) doesnt contains the revision string">sometimes</abbr>, search for '''Revision'''
{{widedot}}'''Revision''': <abbr title="ps1_netemu.self from firmware 2.10 (or older) doesnt contains the revision string">sometimes</abbr>, search for '''Revision'''
</span>
</span>
</div><div style="float:left;">
</div><div style="float:left;">
Line 372: Line 372:
| colspan="2" style="text-align:center; background-color:#ddddff;" | ''Any''
| colspan="2" style="text-align:center; background-color:#ddddff;" | ''Any''
|-
|-
! [[4.89_CEX|4.89]]
! [[4.88_CEX|4.88]]
| style="background-color:#ddddff; font-family:monospace" | F3739EB5CB787316B614F0CF244726D2 || style="background-color:#ddddff;" | 22/02/04/14:39
| style="background-color:#ddddff; font-family:monospace" | 4002EC6CB88F5D2D5E7DF0B0F80A6A0A || style="background-color:#ddddff;" | 21/04/12/11:35
|}
|}
<span style="font-size:small">
<span style="font-size:small">
{{dot}}'''Decrypted (elf)''': changes <abbr title="When comparing two decrypted files of the same revision from different firmwares the only differences are the build label (1 area with size 0x20) and the target firmware (2 areas with size 0x2)">every firmware version</abbr><br>
{{widedot}}'''Decrypted (elf)''': changes <abbr title="When comparing two decrypted files of the same revision from different firmwares the only differences are the build label (1 area with size 0x20) and the target firmware (2 areas with size 0x2)">every firmware version</abbr><br>
{{dot}}'''<abbr title="0x20 bytes">Build label</abbr>''': yes, with timestamp, search for '''-sgpu-sspu-sli4'''<br>
{{widedot}}'''<abbr title="0x20 bytes">Build label</abbr>''': yes, with timestamp, search for '''-sgpu-sspu-sli4'''<br>
{{dot}}'''<abbr title="2 bytes">Target Firmware</abbr>''': yes repeated '''two''' times<br>
{{widedot}}'''<abbr title="2 bytes">Target Firmware</abbr>''': yes repeated '''two''' times<br>
{{dot}}'''Revision''': unknown
{{widedot}}'''Revision''': unknown
</span>
</span>
</div>
</div>
Line 463: Line 463:


== PS1 BIOS ==
== PS1 BIOS ==
The PS1 emulators included in between PS3 firmwares [[1.00_AV|1.00]] up to [[2.01_CEX|2.01]] contains a PS1 BIOS embedded inside the emulator .SELF structure<br>
Current version of ps1_rom file is first 512KB of 1.90 PS2 rom. Previously it was exactly the same version but whole 4MB were supplied to emulator.<br>
In PS3 firmware [[2.10_CEX|2.10]] (at the same time the ps1_newemu.self was introduced) the PS1 BIOS was extracted from the .SELF and shipped as an independant file named ps1_rom.bin. This BIOS have a size of 4.089.584 bytes (MD5: FBB5F59EC332451DEBCCF1E377017237) and is exactly the same file that was previously embedded in all PS1 emulators<br>
Since firmware 2.10++ all PS1 emulators, ps1_emu.self, ps1_netemu.self, ps1_newemu.self uses the since then added ps1_rom.bin bios file. In earlier firmwares file was embed into every emulator self file. File '''ps1_rom.bin''' is exactly the same file that was previously embed in all PS1 emulators.
In PS3 firmware [[4.00_CEX|4.00]] the ps1_rom.bin file was reduced in size down to 524.288 bytes (MD5: 81BBE60BA7A3D1CEA1D48C14CBCC647B) by removing the unrelated PS2 functions<br>
The latest version of ps1_rom file is the first 512KB of the 1.90 PS2 rom.<br>


{| class="wikitable" style="line-height:110%; font-size:90%"
{| class="wikitable" style="line-height:110%; font-size:90%"
Line 479: Line 477:
|}
|}


The PS1 BIOS version can be seen in a string (codenamed VERSTR) with this text, where the last character of the first text row with the suffix "'''A'''" indicates the region (A=America, E=Europe, J=Japan). This character is always located at offset 0x7FF52 in all PS1 and PS2 bios/roms
=== Region patch ===
<pre>System ROM Version 5.0 06/23/03 A
All 3 emulators perform bios patching right after file is loaded into memory. Patch is related to region lock, and is unknown that its responsible for anything else, like timings etc.<br>
There is a string in emulator JJJJAEJEAEJJEJJA which is selector for bios/rom region based on target ID ([[Product_Code]]).
<pre>J    J    J    J    A    E    J    E    A    E    J    J    E    J    J    A
0x80 0x81 0x82 0x83 0x84 0x85 0x86 0x87 0x88 0x89 0x8A 0x8B 0x8C 0x8D 0x8E 0x8F</pre>
Patch apply to string in VERSTR, '''X''' is replaced with appropriate region:
<pre>System ROM Version 5.0 06/23/03 X
Copyright 1993-1999 (C) Sony Computer Entertainment Inc.
Copyright 1993-1999 (C) Sony Computer Entertainment Inc.
</pre>
</pre>
On PCSX2 while in PS1 mode the latest versions of the "'''J'''" and "'''E'''" roms/bios are not able to load the games from all regions because was added an additional '''CD licence check''' that only accepts the discs matching the hardcoded region<br>
The  "'''A'''" roms/bios are able to load all regions games because doesnt have this check. It happens the same in the PS2 roms/bios, only the "'''A'''" ones accepts the games from all regions by default (this is why you have to patch the MECHACON for the US DTL region to get true region free playback)<br>
The bios included in the PS3 firmwares is the "'''A'''" version, so it doesnt have this check, and allows the version string to be patched to replace the suffix "'''A'''" by "'''E'''" or "'''J'''" as explained below


=== PS1 BIOS Region patch ===
Is worth to note that '''X''' is always on the same offset in ALL ps1 bios versions, and all ps2 bios images. So in case of bios swap
Inside the emulators there is a string with the characters: <span style="font-familly:monospace; font-weight:bold">JJJJAEJEAEJJEJJA</span> that works as a selector based on the [[Product Code]] (also known as TargetID, and located inside the [[IDPS]])<br>
([[Talk:PS1_Emulation#ps1_rom.bin]] ) correct region will be still set.<br>
When the emulators are executed (inmediatly before booting the game) the PS3 does a check to the [[Product Code]], then the PS1 BIOS is loaded into memory and a patch is applyed to the version string to replace the suffix "'''A'''" by one of the characters from the selector string<br>
Patched offset is 0x7FF52 in rom file itself. Cobra have region free patch that in the end make X set to A (America) region, which apparently make bios region free. This can be true as similar thing happen on PCSX2 in ps1 mode. US rom is able to run all regions games, while JPN/EU fail to load different regions. It is because later JPN/EU BIOS versions have got an additional CD licence check introduced, accepting only the discs matching the hardcoded region. US BIOSes have never got this check implemented. By the way, it is the same thing with the PS2 BIOSes - only the US one will accept the discs from all over the world by default (that is why you have to patch the MECHACON for the US DTL region to get true region free playback).
This patch is related to the region, there are only 3 posible results for it, '''A'''=America, '''E'''=Europe, '''J'''=Japan. It changes the video output, and is unknown if is responsible for anything else, like timings etc...
 
<div style="overflow-x:auto">
{|class="wikitable" style="line-height:110%; font-size:90%"
|-style="text-align:center"
! Console Type
| {{NOT_IN_USE}} || class="nowrap" | {{TOOL}} {{SD}} || class="nowrap" | {{DEX}} {{DTCP-IP}} {{TEST}} || colspan="13" | {{CEX}} {{SHOP}}
|-style="text-align:center; font-weight:bold"
! [[SKU_Regioning|Release Region]]
| colspan="3" | WorldWide || Japan || US<br>Canada || Europe || Korea || U.K.<br>Ireland || Mexico || Australia<br>New Zealand || Singapore<br>Malaysia || Taiwan || Russia<br>Ukraine<br>India || China || Hong Kong || Brazil
|-style="text-align:center"
! [[SKU_Models|PS3 Models]]
| style="background:lightgrey" | N/A || DECR-xx'''00'''<br>DEH-Zxx'''00''' || DECH-xx'''00'''&nbsp;&nbsp;<br>DECH-Sxx'''00''' || CECHx'''00'''&nbsp;&nbsp;&nbsp;<br>CECH-xx'''00''' || CECHx'''01'''&nbsp;&nbsp;&nbsp;<br>CECH-xx'''01''' || CECHx'''04'''&nbsp;&nbsp;&nbsp;<br>CECH-xx'''04''' || CECHx'''05'''&nbsp;&nbsp;&nbsp;<br>CECH-xx'''05''' || CECHx'''03'''&nbsp;&nbsp;&nbsp;<br>CECH-xx'''03''' || CECHx'''11'''&nbsp;&nbsp;&nbsp;<br>CECH-xx'''11''' || CECHx'''02'''&nbsp;&nbsp;&nbsp;<br>CECH-xx'''02''' || CECHx'''06'''&nbsp;&nbsp;&nbsp;<br>CECH-xx'''06''' || CECHx'''07'''&nbsp;&nbsp;&nbsp;<br>CECH-xx'''07''' || CECHx'''08'''&nbsp;&nbsp;&nbsp;<br>CECH-xx'''08''' || style="background:lightgrey" | N/A || CECHx'''12'''&nbsp;&nbsp;&nbsp;<br>CECH-xx'''12''' || CECHx'''14'''&nbsp;&nbsp;&nbsp;<br>CECH-xx'''14'''
|-style="text-align:center; font-weight:bold"
! [[Product Code]]
| 0x80 || 0x81 || 0x82 || 0x83 || 0x84 || 0x85 || 0x86 || 0x87 || 0x88 || 0x89 || 0x8A || 0x8B || 0x8C || 0x8D || 0x8E || 0x8F
|-style="text-align:center"
! [[SKU_Regioning|PS1 PS2 Region]]
| colspan="3" | NTSC-J || NTSC-J || NTSC-U/C || PAL || NTSC-J || PAL || NTSC-U/C || PAL || NTSC-J || NTSC-J || PAL || NTSC-J || NTSC-J || NTSC-U/C
|-style="text-align:center; font-weight:bold"
! PS1 BIOS patch
! J !! J !! J !! J !! A !! E !! J !! E !! A !! E !! J !! J !! E !! J !! J !! A
|}
</div>
As example, in a retail PS3 model released in Europe (Fat=CECHx'''04''' or Slim/SuperSlim CECH-xx'''04''') the version string inside ps1_rom.bin is patched with the suffix "'''E'''" resulting in:
<pre>
System ROM Version 5.0 06/23/03 E
Copyright 1993-1999 (C) Sony Computer Entertainment Inc.
</pre>
 
==== PS1 BIOS Cobra Patch ====
Every CFW which use cobra module potentially can be affected by nasty bug that is there probably even before 7.00, example based on ps1_emu:
<pre>
SprxPatch ps1_emu_patches[] =
{
{ ps1_emu_get_region_offset, LI(R29, 0x82), &condition_true }, /* regions 0x80-0x82 bypass region check. */
{ 0 }
};
</pre>
 
The cobra patch is skipping part of code where the region of the PS3 is stored for later usage, and is setting the whole emulation to Japan region (NTSC U/C) by applying an static hard patch that belongs to [[Product Code]] '''0x82''' (a debug DECH-xx'''00''' PS3 model) potentially leading to PAL games frame pacing issues, desynced audio, and maybe more. While i can't test that i'm 100% sure that better solution here will be read third character of Title ID from SYSTEM.CNF file of disc/iso, and then applying a dynamic patch based on it<br>
If the game Title ID have an "'''E'''" (example: SLES-12345) then patch to ANY EU target ID, similar for US, for titles where U or E isn't found just use default J target ID
<pre>
SprxPatch ps1_emu_patches[] =
{
{ ps1_emu_get_region_offset, LI(R29, title_id_based_region), &condition_true }, /* Dynamic patch based on TitleID. */
{ 0 }
};
</pre>
 
=== PS1 BIOS Replacements ===
Is worth to note the suffix "'''A'''", "'''E'''", or "'''J'''" in the version string inside the BIOS is always on the same offset in ALL PS1 and PS2 bios images. So in case of replacing the bios the patches mentioned above will be applyed normally<br>
The bios can be replaced by any PS1 rom image (included DTL models), and by most PS2 rom images (maybe by all, deckard models untested). Replacing it by the original PS1 bios restores the Sony logo at start up, and is able to run PS1 menu alone (unmounting disc image with WebMAN during Sony Computer Entertainment logo). Both memory card and CD player are fully accessible. Remounting a disc image (regardless if different than the one started with) will work and boot to PlayStation logo from main menu. Props to Jabu, iirc he figured out running Sony startup screen ages ago<br>
The emulator have a bug (netemu at least) that loads the bios with a fixed size of 4MB file. They probably not changed that size after they reduced the bios file size from 4MB to 512KB. So any PS1/PS2(no deckard) bios image can be used if it have a size of 4MB or smaller. All of them should load games fine.


==PS1 GPU emulation==
==PS1 GPU emulation==
Line 562: Line 508:
* [[PS1_Savedata#Virtual_Memory_Card_PS1_.28.VM1.29 | .VM1 Playstation 1 Memory cards]] can be edited with [[PS1_Savedata#Memory_Card_Tools_PS1 | MemcardRex]]
* [[PS1_Savedata#Virtual_Memory_Card_PS1_.28.VM1.29 | .VM1 Playstation 1 Memory cards]] can be edited with [[PS1_Savedata#Memory_Card_Tools_PS1 | MemcardRex]]
* [[PS2_Savedata#Virtual_Memory_Card_PS2_.28.VM2.29 | .VM2 Playstation 2 Memory cards]] can be edited with [http://www.csclub.uwaterloo.ca:11068/mymc/ mymc]
* [[PS2_Savedata#Virtual_Memory_Card_PS2_.28.VM2.29 | .VM2 Playstation 2 Memory cards]] can be edited with [http://www.csclub.uwaterloo.ca:11068/mymc/ mymc]
=== PSone Classic Tools ===
*Latest psxtract by kozarovv (release date 2022/01/30) adds support to subchannel data extraction for single and multi disc PSone Classic games (used by libcrypt protected PAL games). Based on https://github.com/DeadlySystem/psxtract-2 (Only Windows version is updated, Linux code is not updated). Please mirror or even make pr on github if that's prefered. '''[https://www.mediafire.com/file/ytg875p1a6ph89f/psxtract-2-master.zip/file Download]''' (source plus exe)
*Other psxtract versions commented [https://www.psx-place.com/threads/ive-made-a-new-version-of-xdontnanos-psxtract.35541/#post-314241 here]


== Arguments ==
== Arguments ==
Line 743: Line 685:


=== Embedded Game settings ===
=== Embedded Game settings ===
All the PS1 emulators contains a list of game settings embedded inside his .SELF structure inside 3 tables we could name the '''Checksums Table''', the '''Titles table''', and the '''Commands Table'''. The offsets of this tables differs by emulator revision and type<br><!-- as far i know there is not a known way to find his offsets programatically, other than doing a search for a well known value, usually the first checksum-->
All the PS1 emulators contains a list of game settings embedded inside his .SELF structure inside 3 tables we could name the '''Checksums Table''', the '''Title IDs table''' (is the only in human readable format), and the '''Commands Table'''. The offset of this tables differs by emulator revision and by emulator type<br><!-- as far i know there is not a known way to find his offsets programatically, other than doing a search for a well known value, usually the first checksum-->
The entry point to read the whole structure of this tables starts by reading the 4 bytes of the first '''Checksum''' of the first game from the checksums table (see below), next 4 bytes are an offset (to read the Titles table), next 4 bytes is a '''Command Count''' and next 4 bytes is a '''Command offset''' (to read the Commands Table), to load the data in the other tables is needed to <abbr title="Or substract 0xFEB0000 in firmware 1.70 and keep in mind the order of the commands table is inverted">substract 0x10000</abbr> to this offsets located next to the checksum of a specific game<br>
The entry point to read the whole structure of this tables starts by reading the 4 bytes of the first checksum from the checksums table (see below), next 4 bytes are an offset (to read the Title IDs table), next 4 bytes is a '''Command Count''' and next 4 bytes is a '''Command offset''' (to read the Commands Table), to load the data in the other tables is needed to <abbr title="Or substract 0xFEB0000 in firmware 1.70 and keep in mind the order of the commands table is inverted">substract 0x10000</abbr> to this offsets located next to the checksum of a specific game<br>
The Title IDs (from inside the '''Titles table''') doesnt seems to be used for any logic check, seems to be mostly identifyers (with typos) intended to be displayed in some kind of debug menu in "human readable format" only for informative purposes. Are text strings null terminated in the format "ABCD_123.45" and aligned to 8 bytes, so most of them have a total size of 0x10 but in old firmwares there are some entries with the text "unknown" with a size of 8 bytes (in other words, the entries with the text "unknown" are half the size of the others)<br>
Every command inside the Commands Table is composed by 8 bytes, where the first 4 bytes are the '''Command ID''' (see talk page) and the next 4 bytes is the '''Command Data'''<br>
Every command inside the Commands Table is composed by 8 bytes, where the first 4 bytes are the '''Command ID''' (see talk page) and the next 4 bytes is the '''Command Data'''<br>
All the '''Command Data''' values can be considered the most bottom of this hierarchy... except command ID=0x02(netemu 3.40 up to 4.88) containing an offset to a deeper level of the hierarchy where is stored a list with some of the disc sectors for a few libcrypt protected games
All the '''Command Data''' values can be considered the most bottom of this hierarchy... except command ID=0x02(netemu 3.40 up to 4.88) containing an offset to a deeper level of the hierarchy where is stored a list with some of the disc sectors for a few libcrypt protected games
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps3/PS1_Emulation"