Editing PS2 Emulation

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 3: Line 3:
Emulation of Playstation 2 is currently handled by 3 kind of emulators. CECH-A/B models use ps2_emu.self able to use built-in PS2 hardware (EE/GS/Rambus memory), and have best compatibility. CECH-C/E use ps2_gxemu, this emulator use physical Graphic Synthesizer found in this ps3 model, but Emotion Engine is fully emulated here, also there is no Rambus memory. All other models emulate PS2 thru fully software based ps2_netemu used for ps2 classics, and hacked now to use decrypted ISO files. Earlier before Sony provided ps2 classics on PS Store there was another soft only emulator strongly based on ps2_gxemu. It was called ps2_softemu, and had support for original PS2 CDVD. Only emulator not able to run physical discs is ps2_netemu.  
Emulation of Playstation 2 is currently handled by 3 kind of emulators. CECH-A/B models use ps2_emu.self able to use built-in PS2 hardware (EE/GS/Rambus memory), and have best compatibility. CECH-C/E use ps2_gxemu, this emulator use physical Graphic Synthesizer found in this ps3 model, but Emotion Engine is fully emulated here, also there is no Rambus memory. All other models emulate PS2 thru fully software based ps2_netemu used for ps2 classics, and hacked now to use decrypted ISO files. Earlier before Sony provided ps2 classics on PS Store there was another soft only emulator strongly based on ps2_gxemu. It was called ps2_softemu, and had support for original PS2 CDVD. Only emulator not able to run physical discs is ps2_netemu.  


Emulators are self files, but not typical one. Emulators are not truly PS3 Game OS elf executables, but Guest OS'es running on LV1 of PS3. This mean that LV2, or more friendly Game OS is unloaded before emulator is loaded. This also mean that while emulators are running we can't call any LV2 function. Also LV1 syscalls are limited to call from all emulators, but can be fully unlocked.
Emulators are self files, but not typical one. Emulators are not truly PS3 Game OS elf executables, but Guest OS'es running on LV1 of PS3. This mean that LV2, or more friendly Game OS is unloaded before emulator is loaded. This also mean that while emulators are running we can't call any LV2 function. Also LV1 syscalls are limited to call from all emulators, but can be fully unlocked.  


All emulators use built-in stripped developement version of PS2 BIOS with disabled debug functions that can affect some games. This is done because some games print debug info on screen when found that are run on dev bios. Bios between ps2_emu, and ps2_gxemu/ps2_netemu are different. Ps2_emu BIOS is able to run only on ps2emu version of emulator due to RDRAM check.
All emulators use built-in stripped developement version of PS2 BIOS with disabled debug functions that can affect some games. This is done because some games print debug info on screen when found that are run on dev bios. Bios between ps2_emu, and ps2_gxemu/ps2_netemu are different. Ps2_emu BIOS is able to run only on ps2emu version of emulator due to RDRAM check.


PS3 models without Emotion Engine unit use "SPE-compatible SIMD graphics-rounding mode for VMX/Altivec Instructions" for FPU, and VU0 emulated floats calculations. This is set on emulator init by HV call 97 with param 1. VU1 actually run at SPE core so no compatibility mode need (or can) to be set. SPE compatible mode for PPE mean that rounding mode is set as round to zero, denormals are treated as zero, and there are no infinities or NaNs. So theoretically what PS2 FPU/VU was originally. Although SPE and PPE SPE compatibility mode is still inaccurate comparing to PS2, because Sony decided to cut off 2 guard bits from calculations on PS2. Probably because there was no need for round and sticky bits (no Nan/Inf, one round mode, etc.). Additionally float divide algorithm is custom and not fully understood up to this day. Good example here are TriAce games, or Castlevania COD where SPE calculation is wrong by 1 bit making games unplayable without patch. This are PS2 math algo specific inaccuracies in FPU/VU implementation that are not present on any other hardware.
PS3 models without Emotion Engine unit use "SPE-compatible SIMD graphics-rounding mode for VMX/Altivec Instructions" for FPU, and VU0 emulated floats calculations. This is set on emulator init by HV call 97 with param 1. VU1 actually run at SPE core so no compatibility mode need (or can) to be set. SPE compatible mode for PPE mean that rounding mode is set as round to zero, denormals are treated as zero, and there are no infinities or NaNs. So literally what PS2 VU was originally. Although SPE, and PPE SPE compatibility mode can still be inaccurate comparing to PS2. Good example here are TriAce games, or Castlevania COD where SPE calculation is wrong by 1 bit making games unplayable without patch. This is due to some PS2 math algo specific inaccuracies in FPU/VU implementation that are not present on any other hardware.


Note:  
Note:  
* not available in early Tool/DECR and Debug/DEX firmwares. But available in AV TOOL firmware since 1.00
* not available in early Tool/DECR and Debug/DEX firmwares. But available in AV TOOL firmware since 1.00
* Emulation is based on a SCPH-50000/SCPH-20401 Playstation 2 Model.
* Emulation is based on a SCPH-50000/SCPH-20401 Playstation 2 Model.
* [https://web.archive.org/web/20211118050305/http://unina.stidue.net/Universita'%20di%20Trieste/Ingegneria%20Industriale%20e%20dell'Informazione/Tuzzi/Architetture_Avanzate_dei_Calcolatori/Emotion_2.pdf Introduction to PlayStation2 Architecture.pdf]
* [http://unina.stidue.net/Universita'%20di%20Trieste/Ingegneria%20Industriale%20e%20dell'Informazione/Tuzzi/Architetture_Avanzate_dei_Calcolatori/Emotion_2.pdf Introduction to PlayStation2 Architecture.pdf]
* ps2tek docs - https://psi-rockin.github.io/ps2tek/
* ps2tek docs - https://psi-rockin.github.io/ps2tek/


Line 131: Line 131:
| colspan="2" style="text-align:center; background-color:#ddddff;" | ''Any''
| colspan="2" style="text-align:center; background-color:#ddddff;" | ''Any''
|-{{cellcolors|#ddddff}}
|-{{cellcolors|#ddddff}}
! [[4.89_CEX|4.89]]
! [[4.88_CEX|4.88]]
| 7523DE6D38B13B9C4B9F72419C50D4A7 || 22/02/04/14:35
| 83AA2C1DC985B2CCD20D1A42C7B79DDE || 21/04/12/11:31
|}
|}
<span style="font-size:small">
<span style="font-size:small">
{{dot}}'''Decrypted (elf)''': changes <abbr title="when comparing two decrypted files of the same revision from different firmwares the only difference is the build label">every firmware version</abbr><br>
{{widedot}}'''Decrypted (elf)''': changes <abbr title="when comparing two decrypted files of the same revision from different firmwares the only difference is the build label">every firmware version</abbr><br>
{{dot}}'''<abbr title="0x20 bytes">Build label</abbr>''': yes, with timestamp, search for '''ps2ver:'''<br>
{{widedot}}'''<abbr title="0x20 bytes">Build label</abbr>''': yes, with timestamp, search for '''ps2ver:'''<br>
{{dot}}'''Target Firmware''': no/unknown<br>
{{widedot}}'''Target Firmware''': no/unknown<br>
{{dot}}'''Revision''': unknown
{{widedot}}'''Revision''': unknown
</span>
</span>
</div>
</div>
Line 199: Line 199:
! colspan="6" style="background:#80ff80; line-height:75%" | Abandoned (last revision)
! colspan="6" style="background:#80ff80; line-height:75%" | Abandoned (last revision)
|-
|-
! [[4.78_CEX|4.78]] ~ [[4.89_CEX|4.89]]
! [[4.78_CEX|4.78]] ~ [[4.88_CEX|4.88]]
| 6.874.848 || C7681420A7B3A2A6E3BF89F4A12A3DD6 || ? || 0x2B ?
| 6.874.848 || C7681420A7B3A2A6E3BF89F4A12A3DD6 || ? || 0x2B ?
|}
|}
<span style="font-size:small">
<span style="font-size:small">
{{dot}}'''Decrypted (elf)''': changes <abbr title="when comparing two decrypted files of the same revision from different firmwares there are no differences">every emu revision</abbr><br>
{{widedot}}'''Decrypted (elf)''': changes <abbr title="when comparing two decrypted files of the same revision from different firmwares there are no differences">every emu revision</abbr><br>
{{dot}}'''<abbr title="0x20 bytes">Build label</abbr>''': no/unknown<br>
{{widedot}}'''<abbr title="0x20 bytes">Build label</abbr>''': no/unknown<br>
{{dot}}'''Target Firmware''': no/unknown<br>
{{widedot}}'''Target Firmware''': no/unknown<br>
{{dot}}'''Revision''': unknown
{{widedot}}'''Revision''': unknown
</span>
</span>
</div><div style="float:left; width:24%;">
</div><div style="float:left; width:24%;">
Line 259: Line 259:
|}
|}
<span style="font-size:small">
<span style="font-size:small">
{{dot}}'''Decrypted (elf)''': changes <abbr title="when comparing two decrypted files of the same revision from different firmwares there are no differences">every emu revision</abbr><br>
{{widedot}}'''Decrypted (elf)''': changes <abbr title="when comparing two decrypted files of the same revision from different firmwares there are no differences">every emu revision</abbr><br>
{{dot}}'''<abbr title="0x20 bytes">Build label</abbr>''': no/unknown<br>
{{widedot}}'''<abbr title="0x20 bytes">Build label</abbr>''': no/unknown<br>
{{dot}}'''Target Firmware''': no/unknown<br>
{{widedot}}'''Target Firmware''': no/unknown<br>
{{dot}}'''Revision''': unknown
{{widedot}}'''Revision''': unknown
</span>
</span>
</div><div style="float:left; width:24%;">
</div><div style="float:left; width:24%;">
Line 313: Line 313:
! colspan="6" style="background:#80ff80; line-height:75%" | Abandoned (last revision)
! colspan="6" style="background:#80ff80; line-height:75%" | Abandoned (last revision)
|-  
|-  
! [[4.78_CEX|4.78]] ~ [[4.89_CEX|4.89]]
! [[4.78_CEX|4.78]] ~ [[4.88_CEX|4.88]]
| 10.442.536 || 8B2DBD1AAD22A0EDCF9C867A1A1FB94D || <abbr title="build r17495-main-rel">17495</abbr> || 0x50
| 10.442.536 || 8B2DBD1AAD22A0EDCF9C867A1A1FB94D || <abbr title="build r17495-main-rel">17495</abbr> || 0x50
|}
|}
<span style="font-size:small">
<span style="font-size:small">
{{dot}}'''Decrypted (elf)''': changes <abbr title="when comparing two decrypted files of the same revision from different firmwares there are no differences">every emu revision</abbr><br>
{{widedot}}'''Decrypted (elf)''': changes <abbr title="when comparing two decrypted files of the same revision from different firmwares there are no differences">every emu revision</abbr><br>
{{dot}}'''<abbr title="0x20 bytes">Build label</abbr>''': yes, without timestamp, search for '''build r'''<br>
{{widedot}}'''<abbr title="0x20 bytes">Build label</abbr>''': yes, without timestamp, search for '''build r'''<br>
{{dot}}'''Target Firmware''': included in the build label<br>
{{widedot}}'''Target Firmware''': included in the build label<br>
{{dot}}'''Revision''': yes, <abbr title="the location can be seen by comparing 4.23 (value 0x40DC) with 4.25 (value 0x4164) at offset 0x3E4BA in both">'''one''' time</abbr>, and included in the build label
{{widedot}}'''Revision''': yes, <abbr title="the location can be seen by comparing 4.23 (value 0x40DC) with 4.25 (value 0x4164) at offset 0x3E4BA in both">'''one''' time</abbr>, and included in the build label
</span>
</span>
</div>
</div>
Line 421: Line 421:


===LIMG Segment===
===LIMG Segment===
The ISO.BIN.ENC has a block of 0x4000 bytes added at the end codenamed "LIMG" that works as a descriptor for the ISO structure
The ISO.BIN.ENC have a block of 0x4000 bytes added at the end codenamed "LIMG" that works as a descriptor of the ISO structure


{| class="wikitable"
{| class="wikitable"
Line 480: Line 480:


===Video Modes===
===Video Modes===
'''Note:''' Real PS2 : https://web.archive.org/web/20180802152820/http://users.neoscientists.org/~blue/ps2videomodes.txt
'''Note:''' Real PS2 : http://users.neoscientists.org/~blue/ps2videomodes.txt


  Video Modes
  Video Modes
Line 506: Line 506:


=== ps2netemu ===  
=== ps2netemu ===  
Mapping ELF @ 0x200000000
{| class="wikitable"
{| class="wikitable"
|-
|-
Line 582: Line 584:
| iopTrace      || 0x1400000000 ||      0x3250000 ||  0x10000( 64 KB) || 0x0000000000000001  0000000000000000 || 0x7250000
| iopTrace      || 0x1400000000 ||      0x3250000 ||  0x10000( 64 KB) || 0x0000000000000001  0000000000000000 || 0x7250000
|}
|}
====SPE local storage====
Emulator access SPE LS by accessing special addresses. Mapping as follows:
{| class="wikitable"
|-
! SPE Num. !! SPE task !! Address in netemu !! address in SPE
|-
| 0 || IOP || 0x40000000 - 0x4003FFFF ||  0x0 - 3FFFF
|-
| 1 || SPU2 || 0x40080000 - 0x400BFFFF ||  0x0 - 3FFFF
|-
| 2 || VU1 || 0x40100000 - 0x4013FFFF ||  0x0 - 3FFFF
|-
| 3 || EEDMA || 0x40180000 - 0x401BFFFF ||  0x0 - 3FFFF
|-
| 4 || FE || 0x40200000 - 0x4023FFFF ||  0x0 - 3FFFF
|-
| 5 || BE || 0x40280000 - 0x402BFFFF ||  0x0 - 3FFFF
|-
| 6 || IPU || 0x40300000 - 0x4033FFFF ||  0x0 - 3FFFF
|-
|}
Additionally, emulator access SPU directly with those addresses. <br>
{| class="wikitable"
|-
! Address !! Channel !! Channel description !! Access type !! Notes
|-
| 0x44004 || SPU_Out_Mbox || SPU Outbound Mailbox Register || Read only || Used to read 32 bits of data from the corresponding SPU outbound mailbox queue. Outbound Mailbox Register has a corresponding SPU Write Outbound Mailbox Channel for writing data into outbound mailbox queue.
|-
| 0x4400C || SPU_In_Mbox || SPU Inbound Mailbox Register || Write only || Used to write 32 bits of data into the corresponding SPU inbound mailbox queue. Inbound mailbox queue has a corresponding SPU Read Inbound Mailbox Channel for reading data from the queue.
|-
| 0x44014 || SPU_Mbox_Stat || SPU Mailbox Status Register || Read only || Contains the current In_Mbox/Out_Mbox/Out_Intr_Mbox count of the mailbox queues in the corresponding SPE. 
|-
| 0x4401C || SPU_RunCntl || SPU Run Control Register || Read/Write || Used to start and stop the execution of instructions in the SPU.
The SPU can dynamically change the state of the Run Status bit (that is, SPU_Status[R]). 
|-
| 0x44024 || SPU_Status || SPU Status Register || Read only || Used to report the status (state) of an SPU. Emulator use it mostly to check if SPU is running (bit31).
|-
| 0x44034 || SPU_NPC || SPU Next Program Counter Register || Read/Write || Contains the address from which an SPU starts executing when the Run Control bit is set in the SPU Run Control Register.
Used in function that start SPU programs, and in interrupts handlers, plus in few other places.
|-
| 0x5400C || SPU_Sig_Notify_1 || SPU Signal Notification 1 Register || Read/Write || Used to write data that can be read in SPU_RdSigNotify1 channel corresponding SPE.
|-
| 0x5C00C || SPU_Sig_Notify_2 || SPU Signal Notification 2 Register || Read/Write || Used to write data that can be read in SPU_RdSigNotify2 channel corresponding SPE.
|-
|}
Address = SPU base + Address. For example, IPU SPU is mapped to 0x40300000 so accessing SPU_Sig_Notify1 will be done by read/write to 0x4035400C.


===PS2 Memory and Hardware Mapped Registers Layout===
===PS2 Memory and Hardware Mapped Registers Layout===
Line 942: Line 894:


===ps2_netemu.self===
===ps2_netemu.self===
Support for USB devices seems to be limited comparing to other available emulators. Although PS2 side of USB subsystem seems to be fully implemented. IOP emulator in SPU handle USB HW registers addresses and generate interrupt for PPU which later handle RW to mentioned registers in similar fashion to ps2_emu/ps2_gxemu. PS2 side of things can be disabled/enabled using one byte, when disabled USB writes are ignored, and USB reads return 0. Initial state is unknown. Emulator seems to accept HID controllers and use them as DS3.
<br/><br/>
Supported devices:
#BD Remote Control
#BD Remote Control
#PLAYSTATION(R)3 Controller (Vendor ID 0x54C, Product ID 0x268),  
#PLAYSTATION(R)3 Controller (Vendor ID 0x54C, Product ID 0x268),  
Line 954: Line 903:
#Vendor ID 0xF0D (Hori), Product ID 0x4A  
#Vendor ID 0xF0D (Hori), Product ID 0x4A  
#Vendor ID 0x54C (Sony), Product ID 0x5AF
#Vendor ID 0x54C (Sony), Product ID 0x5AF
<br/>
Few peripherals not listed above work fine or with issues.
#PS3 Dance Dance Revolution Dance Pad - not ps2 accessory, opposite arrows can't be pressed at the same time.
#Pop'N Music controllers - Require PS2 to USB converter. Wrong button mappings can be fixed by remap in config file.
#Retro-Bit Official SEGA Mega Drive USB 6-Button Controller. Mapped for PS3 already and also works with this emulator. Lacks analogue sticks and shoulder buttons.


==BIOS==
==BIOS==
Line 1,021: Line 965:
| ADDDRV || 0x85E960 || 0x3DF60 ||  Adds support for the DVD ROM (rom1:), via ROMDRV. || ELF
| ADDDRV || 0x85E960 || 0x3DF60 ||  Adds support for the DVD ROM (rom1:), via ROMDRV. || ELF
|-
|-
| STDIO || 0x85EDC0 || 0x3D3C0 || Standard I/O library. || ELF
| STDIO || 0x85DDC0 || 0x3D3C0 || Standard I/O library. || ELF
|-
|-
| SIFMAN || 0x85F9B0 || 0x3EFB0 || SIF manager. || ELF
| SIFMAN || 0x85F9B0 || 0x3EFB0 || SIF manager. || ELF
Line 1,051: Line 995:
| RDRAM || 0x861A00 || 0x41000  || Provides a RDRAM test for the EE at power-on. This is run from RESET. || BIN
| RDRAM || 0x861A00 || 0x41000  || Provides a RDRAM test for the EE at power-on. This is run from RESET. || BIN
|-
|-
| - || 0x864190 || 0x43A30 ||  || BIN
| EELOADCNF || 0x864750 || 0x43D50 || Contains the IOP boot configuration file for EELOAD. || BIN
|-
| EELOADCNF || 0x864200 || 0x43D50 || Contains the IOP boot configuration file for EELOAD. || BIN
|-
|-
| SIFCMD || 0x864900 || 0x43F00 || SIF command module. Contains the SIF command and SIF RPC functions. || ELF
| SIFCMD || 0x864900 || 0x43F00 || SIF command module. Contains the SIF command and SIF RPC functions. || ELF
Line 1,078: Line 1,020:
|-
|-
| - || 0x87FE20 || 0x5F420 ||  || BIN
| - || 0x87FE20 || 0x5F420 ||  || BIN
|-
| BNNETCNF || 0x881D00 || 0x61300 ||  Network configuration. Used by BB Navigator Network Configuration Library. || BIN
|-
|-
| MCSERV || 0x881D40 || 0x61340 ||  RPC server for MCMAN. || ELF
| MCSERV || 0x881D40 || 0x61340 ||  RPC server for MCMAN. || ELF
Line 1,089: Line 1,029:
| - || 0x8866C0 || 0x65CC0 ||  || BIN
| - || 0x8866C0 || 0x65CC0 ||  || BIN
|-
|-
| KROM || 0x886A30 || 0x66030 || Kanji ROM? Not sure where this is used. || BIN
| KROM || 0x886A00 || 0x66000 || Kanji ROM? Not sure where this is used. || BIN
|-
|-
| - || 0x8A0870 || 0x7FE70 ||  || BIN
| - || 0x8A0870 || 0x7FE70 ||  || BIN
Line 1,146: Line 1,086:


Emulator patch loaded bios image to set proper region based on target_id, and string (separated for readability):
Emulator patch loaded bios image to set proper region based on target_id, and string (separated for readability):
JJjpnJJ  AAengAUU EEengEEE EEengEOA HHengJAG ERengERD CCschJCC HKkorJAG HHtchJAG AAspaAMM
<pre>
Note: Additional space after first set is intentional and exist also in full string.<br><br>
          JJjpnJJ  AAengAUU EEengEEE EEengEOA HHengJAG ERengERD CCschJCC HKkorJAG HHtchJAG AAspaAMM
0x83 plus    0        1        2        3        4        5        6        7        8        9
</pre>
Note: Additional space after first set is intentional, and exist also in full string.<br><br>
'''Target id to region pairing:'''
'''Target id to region pairing:'''
* JJjpnJJ  for 0x83
<pre>
* AAengAUU for 0x84 , others (DECR, etc.)
* JJjpnJJ  for 0x83
* EEengEEE for 0x85 , 0x87 (also forced if game id from SYSTEM.CNF is xxEx_yy.zzz)
* AAengAUU for 0x84 , others (DECR, etc.)
* HHengJAG for 0x86 , 0x8A , 0x8E
* EEengEEE for 0x85 , 0x87 (also forced if game id from SYSTEM.CNF is xxEx_yy.zzz)
* AAspaAMM for 0x88 , 0x8F
* HHengJAG for 0x86 , 0x8A , 0x8E
* EEengEOA for 0x89
* AAspaAMM for 0x88 , 0x8F
* HHtchJAG for 0x8B
* EEengEOA for 0x89
* ERengERD for 0x8C
* HHtchJAG for 0x8B
* CCschJCC for 0x8D (unreleased PS3 Chinese model)
* ERengERD for 0x8C
* HKkorJAG unused
* CCschJCC for 0x8D (unreleased PS3 Chinese model)
</pre>


Bios is patched using EE memory mapping addresses, so offset in file + 0x1FC00000.
Bios is patched using EE memory maping addresses, so offset in file + 0x1FC00000.
Using HKkorJAG example, addresses below are set to:
Using HKkorJAG example, addresses below are set to:


* 0x1FC7FF04 = H (x in "0220xD20121227" string)
* 0x1FC7FF04 = H (x in "0220xD20121227" string)
* 0x1FC7FF14 = K
* 0x1FC7FF14 = K
* 0x1FC7FF15 = k
* 0x1FC7FF15 = k
* 0x1FC7FF16 = o
* 0x1FC7FF16 = o
* 0x1FC7FF17 = r
* 0x1FC7FF17 = r
* 0x1FC7FF52 = J (x in "System ROM Version 5.0 12/27/12 x" string)
* 0x1FC7FF52 = J (x in "System ROM Version 5.0 12/27/12 x" string)
* 0x1FC7FF20 = A
* 0x1FC7FF20 = A
* 0x1FC7FF90 = G
* 0x1FC7FF90 = G


==Virtual PS2 HDD==
==Virtual PS2 HDD==
Line 1,194: Line 1,138:
*Notes
*Notes
**List of PS2 disc games compatibles with PS3 HDD installation hardcoded in '''dev_flash/vsh/module/[[game_ext_plugin]].sprx'''
**List of PS2 disc games compatibles with PS3 HDD installation hardcoded in '''dev_flash/vsh/module/[[game_ext_plugin]].sprx'''
**Virtual PS2 HDD support module '''dev_flash/vsh/module/[[libps2hdd]].sprx''' ?
**Virtuall PS2 HDD support module '''dev_flash/vsh/module/[[libps2hdd]].sprx''' ?


===PS2 System Data (PSN HDD Tool package)===
===PS2 System Data (PSN HDD Tool package)===
Line 1,276: Line 1,220:


In PS2 Emulator same Title IDs are present with following information:  
In PS2 Emulator same Title IDs are present with following information:  
  SLPS25200 FINAL FANTASY XI          : 0x00000001
  SLPS25200 FINAL FANTASY XI          : 0x100000000 (4 GB?)
  SCUS97269 FINAL FANTASY XI          : 0x00000003
  SCUS97269 FINAL FANTASY XI          : 0x300000000 (12GB?)
  SLPM65981 Front Mission Online      : 0x00000001
  SLPM65981 Front Mission Online      : 0x100000000 (4 GB?)
  SLPM65197 Nobunagas Ambition Online : 0x00000002 (return different value in IOP SPEED 0x10000004 read (2 instead of default 3) )
  SLPM65197 Nobunagas Ambition Online : 0x200000000 (8 GB?)


==Emulators management from GameOS==
==Emulators management from GameOS==
Line 1,289: Line 1,233:
===ps2_netemu syscalls ===
===ps2_netemu syscalls ===
Vector at 0xC00 address.
Vector at 0xC00 address.
  0x00 -
  0x0 - 0 = exec smth,  
      0 = return ((unk from 0x1C30/0x1C38 << 56) | thread_number << 48 | ctrl_CT1 (in bit 30) | srr1_EE (in bit 15) | srr1_PS (in bit 14) | srr1_DR (in bit 4))
       1 = 0x132 lv1 panic,
          Where 0x1C30/0x1C38 is selected depending on current HW thread.
       2 = 0x133 lv1 panic,
          Thread number is current SW thread
       3 = 0x134 lv1 panic,
          ctrl_CT1 is lower bit of CT (Current Thread) from PPC Control Register (0 for HW0, 1 for HW1)
       4 = 0x135 lv1 panic,
          srr1_EE is MSR Enable External Interrupts bit from time when exception occurred (from before syscall was executed)
       else = 0x136 lv1 panic)
          srr1_PS is MSR Problem State bit from time when exception occurred (from before syscall was executed)
  0xC - exec smth
          srr1_DR is MSR Data Relocate bit from time when exception occurred (from before syscall was executed)
  0x5 - exec smth
       1 = 0x132 lv1 panic
  0x6 - exec smth
       2 = 0x133 lv1 panic
  0x10 - lv1 panic
       3 = 0x134 lv1 panic
       4 = 0x135 lv1 panic
       else = 0x136 lv1 panic
0x02 - Destroy init code and perform illegal instructions check. Memzero following addresses:
      CODE: 0x16000 - 0x20B80
      DATA: 0x930F80 - 0x933F80
      UNK:  0x3D016000 - 0x3D020B80
0x03 - Enable additional code related to VU0/COP2.
      3 = Patch 0x186C10 to NOP
      4 = Patch 0x186C40 to NOP
      anything else = LV1 panic
0x04 - Unknown. Available for HW0 only.
0x05 - External interrupts disable (48 bit in MSR). Returns previous MSR state.
  0x06 - External interrupts enable (48 bit in MSR) if param & 0x8000 is not 0, otherwise disable them.
      This sc is more like restore 48th bit of MSR, but many times emu use it to enable bit without using old state.
      Also, emulator panic LV1 if syscall is called while external interrupts are already enabled.
0x0A - IPU emulation related syscall
  0x0B - IPU emulation related syscall
  0x0C - Used in PS2 COP0 MTC0/MFC0 r9/r25 (count/perf), decrementer/timing related, return value in r15.
        Config CMD 0x17 disable that syscall for r9 (count) r/w, and alternative path is used. Perf r/w still use it.
0x0E - PS2 counters/timers related (also used on vsync related functions).
0x0F - PS2 counters/timers related (also used on vsync related functions).
  0x10 - lv1 panic.
0x11 - Wrapper for lv1_read_virtual_uart(port_number, buffer, bytes) [HW0 only, only ports 0 and 2 available, else panic]
0x12 - Wrapper for lv1_storage_send_device_command(dev_id, cmd_id, cmd_block, cmd_size, data_buffer, blocks)
      [HW0 only, Available only for threads: VRC, MECHA, HDD, else panic]
      params are rearranged:
      r3 = cmd_block (0x245E000 is added to this value internally)
      r4 = data_buffer (0x245E000 is added to this value internally)
      r5 = blocks
      dev_id is taken from 0x245D008 and it is 0(HDD) for my dump.
      cmd_id = 0x88 and cmd_size is 8.
0x13 - Set thread info unknown byte to 1 for respective thread and set unknown byte to 1 in USB thread.
      [HW0 only, else panic. Available only for threads: BL2MAIN and BL2LNK, else do nothing in exception handler]
0x14 - Same as 0x13 but set all bits to 0 regardless which thread called it.
      [HW0 only, else panic. Available only for threads: BL2MAIN and BL2LNK, else do nothing in exception handler]
0x1002 - Invalidate gpu hvcalls.
  0x800000XX - HV Syscall where XX is syscall nr.
  0x800000XX - HV Syscall where XX is syscall nr.
  else (other syscalls) - jump to 0x12670 (FW4.78 - current) for HW_0
  else (other syscalls) - jump to 0x12670 (FW4.78 - current) for HW_0
Line 1,420: Line 1,327:
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"  
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;"  
|- bgcolor="#cccccc"
|- bgcolor="#cccccc"
! Name !! Auth ID !! Self<br />(/dev_flash/ps2emu) !! SM Ability Mask !! Notes
! Name !! Auth ID !! Self<br />(/dev_flash/ps2emu) !! Notes
|-
|-
| PS2_LPAR  || 0x1020000003000001 || rowspan="2" | ps2_emu.self || rowspan="2" | 0x201226D || rowspan="2" |  
| PS2_LPAR  || 0x1020000003000001 || rowspan="2" | ps2_emu.self ||  
|-
|-
| *SCE_CELLOS_SYSTEM_MGR_PS2  || 0x107000001D000001
| *SCE_CELLOS_SYSTEM_MGR_PS2  || 0x107000001D000001 ||
|-
|-
| PS2_GX_LPAR || 0x1020000003000001 || rowspan="2" | ps2_gxemu.self || rowspan="2" | 0x201226D || rowspan="2" |
| PS2_GX_LPAR || 0x1020000003000001 || rowspan="2" | ps2_gxemu.self ||  
|-
|-
| *SCE_CELLOS_SYSTEM_MGR_PS2_GX || 0x107000001D000001
| *SCE_CELLOS_SYSTEM_MGR_PS2_GX || 0x107000001D000001 ||
|-
|-
| PS2_SW_LPAR || 0x1020000003000001 || rowspan="2" | ps2_softemu.self || rowspan="2" | 0x201226D || rowspan="2" |
| PS2_SW_LPAR || 0x1020000003000001 || rowspan="2" | ps2_softemu.self ||  
|-
|-
| *SCE_CELLOS_SYSTEM_MGR_PS2_SW || 0x107000001D000001
| *SCE_CELLOS_SYSTEM_MGR_PS2_SW || 0x107000001D000001 ||
|-
|-
| PS2_NE_LPAR || 0x1020000003000001 || rowspan="2" | ps2_netemu.self || rowspan="2" | 0x412265 || rowspan="2" | Netemu additional SM abilities:
| PS2_NE_LPAR || 0x1020000003000001 || rowspan="2" | ps2_netemu.self ||  
* 0x00400000 = Reboot into netemu LPAR (using opcode 0x8204).
Missing SM abilities when compared to other ps2 emus:
* 0x00000008 = Reboot into PS2/GX/SOFT LPAR (using opcode 0x8202).
* 0x02000000 = Unknown, seems to be unused by current system manager.
|-
|-
| *SCE_CELLOS_SYSTEM_MGR_PS2_NE || 0x107000001D000001
| *SCE_CELLOS_SYSTEM_MGR_PS2_NE || 0x107000001D000001 ||
|-
|-
|}
|}
Note: All PS2 emulator lack 0x00000100 ability, thus can't get/set fan speed without LV1 patch.


===Getting compatibility hardware info===
===Getting compatibility hardware info===
Line 1,465: Line 1,367:
This "game config" data seems to work in the same way for all the PS2 emulator types but can be located in different places, some are hardcoded inside the emulators itself (inside the .self), and at the time the "PS2 classics" emulator (ps2_netemu.self) was developed this config can be loaded from an external file<!--and there is some more inside some .sprx or inside the ps2 hdd data pkg ?-->
This "game config" data seems to work in the same way for all the PS2 emulator types but can be located in different places, some are hardcoded inside the emulators itself (inside the .self), and at the time the "PS2 classics" emulator (ps2_netemu.self) was developed this config can be loaded from an external file<!--and there is some more inside some .sprx or inside the ps2 hdd data pkg ?-->


In short, the "game configs" can modify the game image (by patching it) and can be used to configure the virtual PS2 (the emulated machine). And can be loaded from hardcoded data (inside the .self) or from an external file (this feature is supported only by ps2_netemu.self). Maximum CONFIG size for ps2_netemu is 16384 bytes.
In short, the "game configs" can modify the game image (by patching it) and can be used to configure the virtual PS2 (the emulated machine). And can be loaded from hardcoded data (inside the .self) or from an external file (this feature is supported only by ps2_netemu.self)
 
The config data consists in a list of concatenated values of 8 bytes length (uint32_t), and can be processed like this:
union{
  uint32_t command
  ...data...
}


===Config Commands===
===Config Commands===
Below is a brief summary table with basic info about available config commands. <br>
ps2_netemu.self fw4.50 sub_12D7D8, fw4.81 sub_12E050
Detailed commands description can be found here: '''[[PS2_Emulation/PS2_Config_Commands|PS2 Config Commands]]'''. <br>
params are uint32_t unless noted.
If you want to read some speculation and brainstorming about them, please join the {{talk}} page. <br>
 
At the time of writing this, most of the commands are completely or partially unknown.<br />
If you want to read some speculation and brainstorming about them, please join the {{talk}} page


{| class="wikitable" style="font-size:85%; line-height:100%; text-align:center"
<div>
|+PS2 Emulators Config Commands Overview
<div style="float:top; text-align:center;">'''PS2 Emulators Config Commands Overview'''</div>
! rowspan="2" | Command Name !! colspan="3" | Command ID !! rowspan="2" style="padding:1px" | Max<br>Usage !! colspan="4" | Command Data
<div style="float:left; width:50%;">
<div style="float:right; padding-right:5px;">
{| class="wikitable mw-datatable" style="font-size:85%; line-height:100%;"
|-
! rowspan="2" | Command Name !! colspan="3" | Command ID !! rowspan="2" | Max<br>Usage !! colspan="3" | Command Data
|-
! gxemu !! softemu !! netemu !! Length !! colspan="2" | Valid Values
|-
| {{cellcolors|#cc9966}} Config terminator or TitleID enforcer || {{no}} || {{no}} || 0x00 || 1 || Nothing or 0xA bytes || colspan="2" style="text-align:center; background-color:#cc9966;" |  TitleID
|-
|-
! style="padding:1px" | gxemu !! style="padding:1px" | softemu !! style="padding:1px" | netemu !! Length !! colspan="3" | Params
| {{cellcolors|#555555|#ffffff}} Hook EE memory offset with emu function || 0x00 || 0x00 || 0x01 || 3 ? || 2 * uint32_t || {{cellcolors|#555555|#ffffff}} EE memory offset || {{cellcolors|#555555|#ffffff}} emu function
|-
|-
! {{cellcolors|#c96|#000}} TitleID enforce
| {{cellcolors|#ddddff}} Set something || 0x01 || 0x01 || 0x02 || 1 || uint32_t || colspan="2" | 1000=?<br>3000=?<br>6000=?
| {{NA}} || {{NA}} || 0x00
| 1 || style="text-align:left" | char[10]
| colspan="3" {{cellcolors|#c96|#000|center}} titleid
|-
|-
! {{cellcolors|#555|#fff}} Hook EE memory offset with emu function ID
| <abbr title="After the purpose of this command is identifyed, this word should be replaced either by DISABLE or ENABLE">Switch</abbr> something || 0x02 || 0x02 || 0x03 || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| 0x00 || 0x00 || 0x01
| 3 ? || style="text-align:left" | 2&nbsp;*&nbsp;uint32_t
| {{cellcolors|#555|#fff|center}} offset || colspan="2" {{cellcolors|#555|#fff|center}} functionid
|-
|-
! {{cellcolors|#fff|#000}} Set something
| {{cellcolors|#ddddff}} Set something || 0x03 || 0x03 || 0x04 || 1 || uint32_t || colspan="3" | 8=?<br>0x10=?
| 0x01 || 0x01 || 0x02
| 1 || style="text-align:left" | uint32_t
| colspan="3" | ?
|-
|-
! {{cellcolors|#fff|#000}} Skip r5900 CACHE IXIN/IHIN opcodes
| <abbr title="After the purpose of this command is identifyed, this word should be replaced either by DISABLE or ENABLE">Switch</abbr> something || 0x04 || 0x04 || {{cellcolors|#CC5555}} 0x05 || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| 0x02 || 0x02 || 0x03
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#bd5|#000}} Patch something in SP3 EEDMA
| <abbr title="After the purpose of this command is identifyed, this word should be replaced by something like: 'Enable buffer size 4k'">Switch</abbr> something || 0x05 || 0x05 || 0x06 || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | <abbr title="0x14F80 if enabled">''Nothing''</abbr>
| 0x03 || 0x03 || 0x04
| 1 || style="text-align:left" | uint32_t
| colspan="3" | ?
|-
|-
! {{cellcolors|#bd5|#000}} Alternative VIF1 DIRECT/DIRECTHL handler
| {{cellcolors|#ddddff}} Delay VU xgkick by X cycles || 0x06 || 0x06 || 0x07 || 1 || uint32_t || colspan="2" style="text-align:center; background-color:#ddddff;" | <abbr title="2=2cycles, 4=4cycles, 8=8cycles">cycles</abbr>
| 0x04 || 0x04 || {{cellcolors|#eee|#b44|center}} <abbr style="cursor:help; text-decoration:none" title="Not Available">0x05</abbr>
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#fff|#000}} Alternative VIF1 OFFSET handler
| {{cellcolors|#c19a6b}} Patch VU memory by <abbr title="two bit masks for original and patched data">bitmask</abbr> || 0x07 || 0x07 || 0x08 || 3 || 8 * uint32_t || colspan="2" style="text-align:center; background-color:#c19a6b;" | <abbr title="read mask, read mask, original opcode, original opcode, write mask, write mask, replace opcode, replace opcode">BITMASK</abbr>
| 0x05 || 0x05 || 0x06
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#c96|#000}} Delay VU1 xgkick by X cycles
| {{cellcolors|lightgreen}} Patch EE memory with 2 opcodes || 0x08 || 0x08 || 0x09 || <abbr title="command">1</abbr>→<abbr title="list">32</abbr> || uint32_t + LIST || style="text-align:center; background-color:lightgreen;" | count || style="text-align:center; background-color:lightgreen;" | <abbr title="offset, original opcode, original opcode, replace opcode, replace opcode">LIST entries</abbr>
| 0x06 || 0x06 || 0x07
| 1 || style="text-align:left" | uint32_t
| colspan="3" {{cellcolors|#c96|#000|center}} <abbr title="2=2cycles, 4=4cycles, 8=8cycles">cycles</abbr>
|-
|-
! {{cellcolors|#c96|#000}} Patch VU1 memory by <abbr title="two bit masks for original and patched data">bitmask</abbr>
| {{cellcolors|lightgreen}} Patch EE memory with 1 opcode || {{no}} || {{no}} || 0x0A || <abbr title="command">1</abbr>→<abbr title="list">32</abbr> || uint32_t + LIST || style="text-align:center; background-color:lightgreen;" | count || style="text-align:center; background-color:lightgreen;" | <abbr title="offset, original opcode, replace opcode">LIST entries</abbr>
| 0x07 || 0x07 || 0x08
| 3 || style="text-align:left" | 8&nbsp;*&nbsp;uint32_t
| colspan="3" {{cellcolors|#c96|#000|center}} <abbr title="read mask, read mask, original opcode, original opcode, write mask, write mask, replace opcode, replace opcode">MASK</abbr>
|-
|-
! {{cellcolors|#9f9|#000}} Patch EE memory 64 bit
| {{cellcolors|lightgreen}} Patch game disc by sector & offset || 0x09 || 0x09 || 0x0B || <abbr title="command">1</abbr>→<abbr title="list">47</abbr> || uint32_t + LIST || style="text-align:center; background-color:lightgreen;" | count || style="text-align:center; background-color:lightgreen;" | <abbr title="sector id, offset, sizeof present opcodes, replace opcodes, original opcodes">LIST entries</abbr>
| 0x08 || 0x08 || 0x09
| <abbr title="command">1</abbr>→<abbr title="list">32</abbr> || style="text-align:left" | uint32_t&nbsp;+&nbsp;LIST
| {{cellcolors|#9f9|#000|center}} <abbr title="amount of patches in the LIST">count</abbr> || colspan="2" {{cellcolors|#9f9|#000|center}} <abbr title="offset, original opcode, original opcode, replace opcode, replace opcode">LIST</abbr>
|-
|-
! {{cellcolors|#9f9|#000}} Patch EE memory 32 bit
| {{cellcolors|#ddddff}} Set something || 0x0A || 0x0A || 0x0C || 1 || 2 * uint16_t || 0=?<br>1=?<br>2=? || 0=?<br>0x180=?<br>0x400=?<br>0x800=?
| {{NA}} || {{NA}} || 0x0A
| <abbr title="command">1</abbr>→<abbr title="list">32</abbr> || style="text-align:left" | uint32_t&nbsp;+&nbsp;LIST
| {{cellcolors|#9f9|#000|center}} <abbr title="amount of patches in the LIST">count</abbr> || colspan="2" {{cellcolors|#9f9|#000|center}} <abbr title="offset, original opcode, replace opcode">LIST</abbr>
|-
|-
! {{cellcolors|#9f9|#000}} Patch game disc by sector & offset
| {{cellcolors|#ddddff}} Set something || 0x0B || 0x0B || 0x0D || 1 || uint32_t || colspan="2" | 0=?<br>1=?(default?)
| 0x09 || 0x09 || 0x0B
| <abbr title="command">1</abbr>→<abbr title="list">47</abbr> || style="text-align:left" | uint32_t&nbsp;+&nbsp;LIST
| {{cellcolors|#9f9|#000|center}} <abbr title="amount of patches in the LIST">count</abbr> || colspan="2" {{cellcolors|#9f9|#000|center}} <abbr title="sector id, offset, sizeof present opcodes, replace opcodes, original opcodes">LIST</abbr>
|-
|-
! {{cellcolors|#fff|#000}} Set something
| {{cellcolors|#ff9933}} FPU? ADD/SUB accurate opcode || 0x0C || 0x0C || 0x0E || 31 || uint32_t || colspan="2" style="text-align:center; background-color:#ff9933;" | opcode
| 0x0A || 0x0A || 0x0C
| 1 || style="text-align:left" | 2&nbsp;*&nbsp;uint16_t
| <abbr title="0=?, 1=?, 2=?">unk_mode</abbr> || colspan="2" | <abbr title="min 0x0, max 0xFFFF">unk_range</abbr>
|-
|-
! {{cellcolors|#fff|#000}} Set something
| {{cellcolors|#ff9933}} FPU MUL/DIV/SUB/ADD accurate range || 0x0D || 0x0D || 0x0F || 31 || 2 * uint32_t || {{cellcolors|#ff9933}} <abbr title="min 0x100000">start offset</abbr> || {{cellcolors|#ff9933}} <abbr title="max 0x1FFFFFFF">end offset</abbr>
| 0x0B || 0x0B || 0x0D
| 1 || style="text-align:left" | uint32_t
| colspan="3" | <abbr title="0=skip, 1=don't skip (default)">skip</abbr>
|-
|-
! {{cellcolors|#f93|#000}} COP2 and FPU accurate ADD/SUB address
| {{cellcolors|#ff9933}} COP2 MUL/DIV/SUB/ADD accurate range || 0x0E || 0x0E || 0x10 || 31 || 2 * uint32_t || {{cellcolors|#ff9933}} start offset || {{cellcolors|#ff9933}} end offset
| 0x0C || 0x0C || 0x0E
| 32 || style="text-align:left" | uint32_t
| colspan="3" {{cellcolors|#f93|#000|center}} <abbr title="min 0x100000 ?, max 0x1FFFFFFF ?">offset</abbr>
|-
|-
! {{cellcolors|#f93|#000}} COP2 and FPU accurate ADD/SUB range
| {{cellcolors|#ff9933}} VU ADD/SUB accurate opcode || 0x0F || 0x0F || 0x11 || 31 || uint32_t || colspan="2" style="text-align:center; background-color:#ff9933;" | opcode
| 0x0D || 0x0D || 0x0F
| 32 || style="text-align:left" | 2&nbsp;*&nbsp;uint32_t
| {{cellcolors|#f93|#000|center}} <abbr title="min 0x100000">start&nbsp;offset</abbr> || colspan="2" {{cellcolors|#f93|#000|center}} <abbr title="max 0x1FFFFFFF">end&nbsp;offset</abbr>
|-
|-
! {{cellcolors|#f93|#000}} FPU accurate MUL/DIV range
| {{cellcolors|lightgreen}} ? || 0x10 || 0x10 || 0x12 || <abbr title="command">1</abbr>→<abbr title="list">63</abbr> || uint32_t + LIST ? || style="text-align:center; background-color:lightgreen;" | count ? || style="text-align:center; background-color:lightgreen;" | <abbr title="unknown ?">LIST entries</abbr>
| 0x0E || 0x0E || 0x10
| 32 || style="text-align:left" | 2&nbsp;*&nbsp;uint32_t
| {{cellcolors|#f93|#000|center}} <abbr title="min 0x100000">start&nbsp;offset</abbr> || colspan="2" {{cellcolors|#f93|#000|center}} <abbr title="max 0x1FFFFFFF">end&nbsp;offset</abbr>
|-
|-
! {{cellcolors|#f93|#000}} VU0 accurate ADD/SUB address
| {{cellcolors|#77aaff}} IOP/SIO2/MC related ? || 0x11 || 0x11 || 0x13 || 1 || uint64_t || colspan="2" style="text-align:center; background-color:#77aaff;" | timing ?
| 0x0F || 0x0F || 0x11
| 32 || style="text-align:left" | uint32_t
| colspan="3" {{cellcolors|#f93|#000|center}} <abbr title="min 0x000, max 0xFF8">offset</abbr>
|-
|-
! {{cellcolors|#588|#fff}} VU0/COP2 multi cmd
| <abbr title="After the purpose of this command is identifyed, this word should be replaced either by DISABLE or ENABLE">Switch</abbr> something || 0x12 || 0x12 || 0x14 || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| 0x10 || 0x10 || 0x12
| <abbr title="command">1</abbr>→<abbr title="list">63</abbr> || style="text-align:left" | uint32_t&nbsp;+&nbsp;LIST
| {{cellcolors|#588|#fff|center}} flags ? || colspan="2" {{cellcolors|#588|#fff|center}} LIST
|-
|-
! {{cellcolors|#dda|#000}} Memory Card Delay
| {{cellcolors|#CA2691}} Set something (with bit flags) || 0x13 || 0x13 || 0x15 || 1 || uint32_t || colspan="2" style="background:#CA2691;" | 2=? (<abbr title="only valid for gxemu and softemu, when used in netemu the result is the same than using value 4">gxemu and softemu only</abbr>)<br>0x14=? (<abbr title="only valid for softemu, when used in netemu the result is the same than using value 4">softemu only</abbr>)<br>4=?
| 0x11 || 0x11 || 0x13
| 1 || style="text-align:left" | uint64_t
| colspan="3" {{cellcolors|#dda|#000|center}} time ?
|-
|-
! {{cellcolors|#f93|#000}} Alternative VU1 ADD/SUB
| ? || 0x14 ? || 0x14 ? || {{cellcolors|#CC5555}} 0x16 || ? || colspan="3" | ?
| 0x12 || 0x12 || 0x14
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#fff|#000}} Patch IOP SPE program
| {{cellcolors|#ffff99}} Set something || 0x15 || 0x15 || 0x17 || 1 || uint8_t || colspan="2" style="background:#ffff99;" | 0=?<br>1=?
| 0x13 || 0x13 || 0x15
| 1 || style="text-align:left" | uint32_t
| colspan="3" | 2 or higher
|-
|-
! {{cellcolors|#fff|#000}} Unknown
| <abbr title="After the purpose of this command is identifyed, this word should be replaced either by DISABLE or ENABLE">Switch</abbr> something || 0x16 || 0x16 || {{cellcolors|#CC5555}} 0x18 || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| 0x14? || 0x14? || {{cellcolors|#eee|#b44|center}} <abbr style="cursor:help; text-decoration:none" title="Not Available">0x16</abbr>
| ? || style="text-align:left" | ?
| colspan="3" | ?
|-
|-
! {{cellcolors|#9cf|#000}} Alternative COP0 MTC0/MFC0 Count ($9) handler
| <abbr title="After the purpose of this command is identifyed, this word should be replaced either by DISABLE or ENABLE">Switch</abbr> something || {{no}} || 0x17 || 0x19 || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| 0x15 || 0x15 || 0x17
| 1 || style="text-align:left" | uint8_t ?
| colspan="3" {{cellcolors|#9cf|#000|center}} <abbr title="0=disabled, 1=enabled">status</abbr>
|-
|-
! {{cellcolors|#fff|#000}} Switch something
| <abbr title="After the purpose of this command is identifyed, this word should be replaced either by DISABLE or ENABLE">Switch</abbr> something || 0x17 || 0x18 || 0x1A || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| 0x16 || 0x16 || {{cellcolors|#eee|#b44|center}} <abbr style="cursor:help; text-decoration:none" title="Not Available">0x18</abbr>
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#ff9|#000}} Force analog controller mode
| <abbr title="After the purpose of this command is identifyed, this word should be replaced either by DISABLE or ENABLE">Switch</abbr> something || 0x18 || 0x19 || 0x1B || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| {{NA}} || 0x17 || 0x19
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#fff|#000}} End fromIPU DMA transfer on BCLR command
| {{cellcolors|#ffff99}} Set something || 0x19 ? || 0x1A ? || 0x1C || 1 || uint8_t || colspan="2" {{cellcolors|#ffff99}} ?
| 0x17 || 0x18 || 0x1A
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#fff|#000}} IPU IDEC Hack
| {{cellcolors|#ffff99}} Set something || 0x1A || 0x1B || 0x1D || 1 || uint8_t || colspan="2" {{cellcolors|#ffff99}} 2=?
| 0x18 || 0x19 || 0x1B
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#ff9|#000}} Emulate Multitap
| {{cellcolors|#ffff99}} Set something || 0x1B || {{no}} || 0x1E || 1 || uint8_t || colspan="2" {{cellcolors|#ffff99}} 3=?
| 0x19? || 0x1A? || 0x1C
| 1 || style="text-align:left" | uint8_t
| colspan="3" {{cellcolors|#ff9|#000|center}} port
|-
|-
! {{cellcolors|#ff9|#000}} Set Multitap
| {{cellcolors|#ddddff}} Set something || 0x1C || 0x1C || 0x1F || 1 || uint32_t || colspan="2" | 200=?<br>1000=?(default)
| 0x1A || 0x1B || 0x1D
| 1 || style="text-align:left" | uint8_t
| colspan="3" {{cellcolors|#ff9|#000|center}} order
|-
|-
! {{cellcolors|#ff9|#000}} Multitap related
| {{cellcolors|#ddddff}} Set something || 0x1D || 0x1D || 0x20 || 1 || uint64_t  || colspan="2" | 10=?<br>60=?(default)<br>100=?<br>120=?<br>200=?<br>240=?
| 0x1B || {{NA}} || 0x1E
| 1 || style="text-align:left" | uint8_t
| colspan="3" | ?
|-
|-
! {{cellcolors|#fff|#000}} Enable VIF0 cmds MSXXX/MPG/FLUSHE timings.
| {{cellcolors|#ddddff}} Set something || 0x1E || 0x1E || 0x21 || 1 || uint32_t || colspan="2" | 0=?<br>1=?<br>2=?
| 0x1C || 0x1C || 0x1F
|}
| 1 || style="text-align:left" | uint32_t
</div>
| colspan="3" | Initial cycles to run
</div>
<div style="float:right; width:50%;">
<div style="float:left; padding-left:5px;">
{| class="wikitable mw-datatable" style="font-size:85%; line-height:100%;"
|-
|-
! {{cellcolors|#fff|#000}} Set something
! rowspan="2" | Command Name !! colspan="3" | Command ID !! rowspan="2" | Max<br>Usage !! colspan="3" | Command Data
| 0x1D || 0x1D || 0x20
| 1 || style="text-align:left" | uint64_t
| colspan="3" | ?
|-
|-
! {{cellcolors|#fff|#000}} Set something
! gxemu !! softemu !! netemu !! Length !! colspan="2" | Valid Values
| 0x1E || 0x1E || 0x21
| 1 || style="text-align:left" | uint32_t
| colspan="3" | ?
|-
|-
! {{cellcolors|#fff|#000}} Switch something
| <abbr title="After the purpose of this command is identifyed, this word should be replaced either by DISABLE or ENABLE">Switch</abbr> something || 0x1F || 0x1F || 0x22 || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| {{NA}} || 0x1F || 0x22
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#fff|#000}} Snowblind Engine hack
| <abbr title="After the purpose of this command is identifyed, this word should be replaced by something like: 'Enable buffer size 4k'">Switch</abbr> something || {{no}} || 0x20 || 0x23 || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | <abbr title="0x14E00 if enabled">''Nothing''</abbr>
| 0x1F || 0x20 || 0x23
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#ddf|#000}} SIO2 Delay
| {{cellcolors|#ddddff}} Internal image aspect ratio ? || 0x20 || 0x21 || 0x24 || 1 || uint64_t || colspan="2" | 12000=?<br>48000=?
| 0x20 || 0x21 || 0x24
| 1 || style="text-align:left" | uint64_t
| colspan="3" | ?
|-
|-
! {{cellcolors|#fff|#000}} Switch something
| <abbr title="After the purpose of this command is identifyed, this word should be replaced either by DISABLE or ENABLE">Switch</abbr> something || 0x21 || 0x22 || {{cellcolors|#CC5555}} 0x25 || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| 0x21 || 0x22 || {{cellcolors|#eee|#b44|center}} <abbr style="cursor:help; text-decoration:none" title="Not Available">0x25</abbr>
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#f93|#000}} FPU accurate ADD/SUB range
| {{cellcolors|#ff9933}} FPU ADD/SUB accurate range || 0x22 || 0x23 || 0x26 || 31 || 2 * uint32_t || {{cellcolors|#ff9933}} start offset || {{cellcolors|#ff9933}} end offset
| 0x22 || 0x23 || 0x26
| 32 || style="text-align:left" | 2&nbsp;*&nbsp;uint32_t
| {{cellcolors|#f93|#000|center}} <abbr title="min 0x100000">start&nbsp;offset</abbr> || colspan="2" {{cellcolors|#f93|#000|center}} <abbr title="max 0x1FFFFFFF">end&nbsp;offset</abbr>
|-
|-
! {{cellcolors|#f93|#000}} COP2 accurate ADD/SUB range
| {{cellcolors|#ff9933}} COP2-VU0 MUL/DIV/SUB/ADD accurate range || 0x23 || 0x24 || 0x27 || 31 || 2 * uint32_t || {{cellcolors|#ff9933}} start offset || {{cellcolors|#ff9933}} end offset
| 0x23 || 0x24 || 0x27
| 32 || style="text-align:left" | 2&nbsp;*&nbsp;uint32_t
| {{cellcolors|#f93|#000|center}} <abbr title="min 0x100000">start&nbsp;offset</abbr> || colspan="2" {{cellcolors|#f93|#000|center}} <abbr title="max 0x1FFFFFFF">end&nbsp;offset</abbr>
|-
|-
! {{cellcolors|#aaf|#000}} Set something <abbr title="PS2 MECHACON related">(CDVD)</abbr>
| {{cellcolors|#ddddff}} Set something <abbr title="PS2 MECHACON related">(MECHA)</abbr> || 0x24 ? || 0x25 ? || 0x28 || 1 || uint32_t || colspan="2" | 0=?<br>1=?<br>2=?<br>3=?
| 0x24 || 0x25? || 0x28
| 1 || style="text-align:left" | uint32_t
| colspan="3" | ?
|-
|-
! {{cellcolors|#aaf|#000}} CDVD seek timing
| {{cellcolors|#ddddff}} Set something <abbr title="PS2 MECHACON related">(MECHA)</abbr> || 0x25 ? || 0x26 ? || 0x29 || 1 || 2 * uint32_t || ? || ?
| 0x25 || 0x26? || 0x29
| 1 || style="text-align:left" | 2&nbsp;*&nbsp;uint32_t
| ? || colspan="2" | ?
|-
|-
! {{cellcolors|#fff|#000}} Switch something
| <abbr title="After the purpose of this command is identifyed, this word should be replaced either by DISABLE or ENABLE">Switch</abbr> something || 0x26 ? || 0x27 || 0x2A || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| 0x26 || 0x27 || 0x2A
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#aaf|#000}} Enable CDDA hack <abbr title="PS2 MECHACON related">(CDVD)</abbr>
| <abbr title="After the purpose of this command is identifyed, this word should be replaced either by DISABLE or ENABLE">Switch</abbr> something <abbr title="PS2 MECHACON related">(MECHA)</abbr> || 0x27 ? || 0x28 || 0x2B || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| 0x27? || 0x28 || 0x2B
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#fff|#000}} Set something
| {{cellcolors|#ddddff}} Set something || 0x28 || 0x29 || 0x2C || 1 || uint32_t || colspan="2" | 1=?
| 0x28 || 0x29 || 0x2C
| 1 || style="text-align:left" | uint32_t
| colspan="3" | ?
|-
|-
! {{cellcolors|#fff|#000}} Switch something
| <abbr title="After the purpose of this command is identifyed, this word should be replaced either by DISABLE or ENABLE">Switch</abbr> something || 0x29 ? || 0x2A || {{cellcolors|#CC5555}} 0x2D || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| 0x29? || 0x2A || {{cellcolors|#eee|#b44|center}} <abbr style="cursor:help; text-decoration:none" title="Not Available">0x2D</abbr>
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#fff|#000}} Set something
| {{cellcolors|#ddddff}} Set something || 0x2A || 0x2B || 0x2E || 1 || uint32_t || colspan="2" | 0x172=?
| 0x2A || 0x2B || 0x2E
| 1 || style="text-align:left" | uint32_t
| colspan="3" | ?
|-
|-
! {{cellcolors|#fff|#000}} SPU2 multi cmd.
| {{cellcolors|#ddddff}} Set something || 0x2B || {{no}} ? || 0x2F || 1 || uint32_t || colspan="2" | 1=?
| 0x2B || {{NA}} || 0x2F
| 1 || style="text-align:left" | uint32_t
| colspan="3" | ?
|-
|-
! {{cellcolors|#eee|#b44|left}} Reserved
| {{cellcolors|lightgrey}} ? || {{no}} ? || {{no}} ? || style="background:#CC5555;" | 0x30<br>0x31<br>0x32<br>0x33<br>0x34 || {{cellcolors|lightgrey}} ? || colspan="3" {{cellcolors|lightgrey|black|center}} ?
| {{cellcolors|#eee|#b44|center}} <abbr style="cursor:help; text-decoration:none" title="Not Available">N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A</abbr> || {{cellcolors|#eee|#b44|center}} <abbr style="cursor:help; text-decoration:none" title="Not Available">N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A</abbr> || {{cellcolors|#eee|#b44|center}} <abbr style="cursor:help; text-decoration:none" title="Not Available">0x30<br>0x31<br>0x32<br>0x33<br>0x34</abbr>
| 0 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#f66|#000}} Enable Force Flip Field
| Enable Force Flip Field || {{no}} || {{no}} || 0x35 || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| {{NA}} || {{NA}} || 0x35
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#eee|#b44|left}} Reserved
| {{cellcolors|lightgrey}} ? || {{no}} ? || {{no}} ? || style="background:#CC5555;" | 0x36<br>0x37<br>0x38<br>0x39<br>0x3A<br>0x3B<br>0x3C || {{cellcolors|lightgrey}} ? || colspan="3" {{cellcolors|lightgrey|black|center}} ?
| {{cellcolors|#eee|#b44|center}} <abbr style="cursor:help; text-decoration:none" title="Not Available">N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A</abbr> || {{cellcolors|#eee|#b44|center}} <abbr style="cursor:help; text-decoration:none" title="Not Available">N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A<br>N&thinsp;/&thinsp;A</abbr> || {{cellcolors|#eee|#b44|center}} <abbr style="cursor:help; text-decoration:none" title="Not Available">0x36<br>0x37<br>0x38<br>0x39<br>0x3A<br>0x3B<br>0x3C</abbr>
| 0 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#c96|#000}} Config revision
| Config file revision || {{no}} || {{no}} || 0x3D || 1 || uint32_t || colspan="2" | >=15686
| {{NA}} || {{NA}} || 0x3D
| 1 || style="text-align:left" | uint32_t
| colspan="3" {{cellcolors|#c96|#000|center}} revision
|-
|-
! {{cellcolors|#fff|#000}} Switch something
| Disable something || {{no}} || {{no}} || 0x3E || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| {{NA}} || {{NA}} || 0x3E
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#fff|#000}} Set something
| {{cellcolors|#ddddff}} Set something || {{no}} || {{no}} || 0x3F || 1 || uint32_t || colspan="2" | ?
| {{NA}} || {{NA}} || 0x3F
| 1 || style="text-align:left" | uint32_t
| colspan="3" | ?
|-
|-
! {{cellcolors|#fff|#000}} Switch something
| <abbr title="After the purpose of this command is identifyed, this word should be replaced either by DISABLE or ENABLE">Switch</abbr> something || {{no}} || {{no}} || 0x40 || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| {{NA}} || {{NA}} || 0x40
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#fff|#000}} Switch something
| Disable lwsync ? || {{no}} || {{no}} || 0x41 || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| {{NA}} || {{NA}} || 0x41
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#9f9|#000}} Patch EE memory by overlay
| {{cellcolors|lightgreen}} Patch EE memory by overlay || {{no}} || {{no}} || 0x42 || <abbr title="command">1</abbr>→<abbr title="list">1023</abbr> || 2 * uint32_t + LIST || style="text-align:center; background-color:lightgreen;" | address, count || style="text-align:center; background-color:lightgreen;" | <abbr title="opcode,opcode,opcode, etc...">LIST entries</abbr>
| {{NA}} || {{NA}} || 0x42
| <abbr title="command">1</abbr>→<abbr title="list">1023</abbr> || style="text-align:left" | 2&nbsp;*&nbsp;uint32_t&nbsp;+&nbsp;LIST
| {{cellcolors|#9f9|#000|center}} offset || {{cellcolors|#9f9|#000|center}} count || {{cellcolors|#9f9|#000|center}} <abbr title="opcode,opcode,opcode, etc...">LIST</abbr>
|-
|-
! {{cellcolors|#fff|#000}} Set something
| {{cellcolors|#ddddff}} Set something || {{no}} || {{no}} || 0x43 || 1 || uint32_t || colspan="2" | 0=?(default)<br>1=?
| {{NA}} || {{NA}} || 0x43
| 1 || style="text-align:left" | uint32_t
| colspan="3" | ?
|-
|-
! {{cellcolors|#fcc|#000}} Disable smoothing filter
| Disable Smoothing filter || {{no}} || {{no}} || 0x44 || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| {{NA}} || {{NA}} || 0x44
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#fff|#000}} Switch something
| <abbr title="After the purpose of this command is identifyed, this word should be replaced either by DISABLE or ENABLE">Switch</abbr> something || {{no}} || {{no}} || 0x45 || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| {{NA}} || {{NA}} || 0x45
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#f66|#000}} Enable L2H Improvement
| Enable L2H Improvement || {{no}} || {{no}} || 0x46 || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| {{NA}} || {{NA}} || 0x46
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#f66|#000}} Enable XOR CSR
| Enable XOR CSR || {{no}} || {{no}} || 0x47 || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| {{NA}} || {{NA}} || 0x47
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#f66|#000}} Set VSYNC IPU & Delay
| {{cellcolors|#ddddff}} Set VSYNC IPU & Delay || {{no}} || {{no}} || 0x48 || 1 || 2 * uint32_t || style="text-align:center; background-color:#ddddff;" | <abbr title="1=No IPU, 2=IPU, 3=Anytime">ipu type</abbr> || style="text-align:center; background-color:#ddddff;" | <abbr title="20000=Conservative, 100000=Normal, 250000=Agressive, Any other">delay</abbr>
| {{NA}} || {{NA}} || 0x48
| 1 || style="text-align:left" | 2&nbsp;*&nbsp;uint32_t
| {{cellcolors|#f66|#000|center}} <abbr title="1=No IPU, 2=IPU, 3=Anytime">ipu</abbr> || colspan="2" {{cellcolors|#f66|#000|center}} <abbr title="20000=Conservative, 100000=Normal, 250000=Agressive, Any other">delay</abbr>
|-
|-
! {{cellcolors|#fff|#000}} Switch something
| <abbr title="After the purpose of this command is identifyed, this word should be replaced by something like: 'Enable buffer size 4k'">Switch</abbr> something || {{no}} || {{no}} || 0x49 || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | <abbr title="0xB,0,0 if enabled">''Nothing''</abbr>
| {{NA}} || {{NA}} || 0x49
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#fff|#000}} Switch something
| <abbr title="After the purpose of this command is identifyed, this word should be replaced by something like: 'Enable buffer size 4k'">Switch</abbr> something || {{no}} || {{no}} || 0x4A || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | <abbr title="0x15100 if enabled">''Nothing''</abbr>
| {{NA}} || {{NA}} || 0x4A
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|-
|-
! {{cellcolors|#fff|#000}} Set something
| {{cellcolors|#ddddff}} Set something || {{no}} || {{no}} || 0x4B || 1 || 2 * uint32_t || ? || ?
| {{NA}} || {{NA}} || 0x4B
| 1 || style="text-align:left" | 2&nbsp;*&nbsp;uint32_t
| ? || colspan="2" | ?
|-
|-
! {{cellcolors|#fff|#000}} Set something
| {{cellcolors|#ddddff}} Set something || {{no}} || {{no}} || 0x4C || 1 || 2 * uint32_t || ? || ?
| {{NA}} || {{NA}} || 0x4C
| 1 || style="text-align:left" | 2&nbsp;*&nbsp;uint32_t
| ? || colspan="2" | ?
|-
|-
! {{cellcolors|#fff|#000}} Set something
| {{cellcolors|#ddddff}} Set something || {{no}} || {{no}} || 0x4D || 1 || uint32_t || colspan="2" | ?
| {{NA}} || {{NA}} || 0x4D
| 1 || style="text-align:left" | uint32_t
| colspan="3" | ?
|-
|-
! {{cellcolors|#fff|#000}} Unknown
| ? || {{no}} || {{no}} || 0x4E || 1 || || colspan="2" | ?
| {{NA}} || {{NA}} || 0x4E
| 1 || style="text-align:left" | ?
| colspan="3" | ?
|-
|-
! {{cellcolors|#fff|#000}} Unknown
| ? || {{no}} || {{no}} || 0x4F || 1 || || colspan="2" | ?
| {{NA}} || {{NA}} || 0x4F
| 1 || style="text-align:left" | ?
| colspan="3" | ?
|-
|-
! {{cellcolors|#ff9|#000}} Enable pressure sensitive controls
| Enable pressure sensitive controls || {{no}} || {{no}} || 0x50 || 1 || colspan="3" style="text-align:center; background-color:lightgrey;" | ''Nothing''
| {{NA}} || {{NA}} || 0x50
| 1 || style="text-align:left" | 0
| colspan="3" {{cellcolors|#ddd|#666|center}} ''Nothing''
|}
|}
</div>
</div>
</div>
<br style="clear: both;" />


===Config file examples (for netemu)===


====Official PS2 Classic====
<!-- We need to find a better way to organize the commands info below, right now all the info is "constricted" inside the same table but is better to take them out of the table to have more freedon when adding comments, etc... Are a lot so by now i prefer to dont make page sections for every command. Im going to try something that visually looks like page sections but are not (so are not going to be displayed in the TOC at top of the page). With this change we are moving forward because the command info is not going to be inside the same table anymore, im going to split them but the visual look and other details are not going to be definitive because later can be converted into page sections if someone insists in it -->
See: [[PS2 Official Configs]]


====Official GXEMU/SOFTEMU extracted====
See: [[PS2 Official Configs]]


==== Custom Configs ====
{{Boxcomm|id=0x00|name=Title ID Enforce|data=1x String in format: ABCD-12345}}
See: [[PS2 Custom Configs]]
Copy following title id for enforcing if available.


===Config data examples (hardcoded)===
{{Boxcomm|id=0x01|name=EE_ADD_HOOK|data=2x uint32_t Params (addr, func_id 0-0x3B)}}
====Inside ps2_emu.self====
Most of 0x01 commands are strictly per game fixes, or at least per game engine.  
Embedded patches are based on Checksum/Hash of title. ps2_emu is only emulator version where patches are described inside self file in ascii. Known patch types described in ascii are: Patch data, new SPU2 params, and Setting mecha HACK to show GODZCD as GODZCDDA.
  [Grand Theft Auto 3 (EU)] uses 0x349790, 0x10 (somewhat floats related)
  [Max Payne] uses 0x52E9F4, 3 and 0x52EB78, 2 (set lwsync 0)
Maximum Amount of Usage: ?
(The command is used 3 times consecutively by SLUS-20565 (Champions of Norrath) and SLUS-21494 (Need for Speed Carbon)
game configs hardcoded inside ps2_gxemu.self)


{| class="wikitable sortable"
{| class="wikitable sortable" style="font-size:0.9em; line-height:90%"
! PS2 Title !! Hash !! Game !! Patch Type !! Data
|-
!Function ID!! Notes
|-
|0x00||
|-
|-
| SCUS_971.46|| 0x6B1ADE00D||Disney's Treasure Planet || Patch data - Fixes black screen at start, it apply to STREAM_D.IRX file in IOP folder. || 0x147C (sector) , 0x580 (offset) (- 0xC on disc)
|0x01|| FIFA 2000 use it as hook for EE kernel at 0x80001858 (DMAC related).  
Replace opcodes
|-
00 01 01 3C lui at,0x0100
|0x02||  
80 BF 03 3C lui v1,0xBF80
Max Payne
C8 10 63 8C lw v1,0x10C8(v1)
sets some sync off?
24 18 61 00 and v1,at
|-
FB FF 61 10 beq v1,at, -0x10
|0x03||
00 00 00 00 nop
Max Payne
sets some sync on?
Original opcodes
|-
FF FF 01 24 li at,-0x1
|0x04|| Used by Castle Shikigami II store 0 on 0x94A290 (EMU Memory)
04 00 61 14 bne at,v1, +0x14
|-
00 80 01 3C lui at,0x8000
|0x05|| Used by Star Wars games developed by Pandemic Studios (freeze fix), Worms 3D and NBA 08.
02 00 41 14 bne at,v0, +0x0C
|-
00 00 00 00 nop
|0x06||
0D 00 06 00 break 
|-
|0x07||
|-
|0x08|| Harry Potter - Quidditch World Cup US use it at offset 0x2BD45C (EE)
|-
|0x09|| Harry Potter - Quidditch World Cup US use it at offset 0x2BD620 (EE)
|-
|0x0A||
|-
|-
|SLUS_201.74 ||0x23D92589C5|| Rumble Racing || Patch data - fixes black screen after Playstation 2 logo. Patch apply to AUDIO.IRX file in MODULES folder || 0x3AEDA (sector), 0x120 (offset)
|0x0B||
  Replace opcodes
|-
  06 00 80 14 bnez a0, +0x1C
|0x0C|| Used by Piglet's Big Game
  21 20 43 00 addu a0,v0,v1
|-
  21 10 A0 00 move v0,a1
|0x0D|| usleep(100)
  02 00 A0 14 bnez a1, +0x0C
|-
  00 00 00 00 nop
|0x0E|| Used 3 times in Need for Speed - Carbon [Collector's Edition] US
  01 00 05 24 li a1,0x1
|-
  EB FF 40 10 beqz v0, -0x50
|0x0F||
  04 00 84 24 addiu a0,0x4
GTA 3 (US)
  FC FF 90 24 addiu s0,a0,-0x4
using 0x348B40, 0x18E1F0, 0x348EC8 ( + 200000000 base )
 
0x348B40 = start CTheScripts::ClearSpaceForMissionEntity((CVector const &, CEntity *))
  Original opcodes
0x18E1F0 = start CCollision::ProcessColModels((CMatrix const &, CColModel &, CMatrix const &, CColModel &, CColPoint *, CColPoint *, float *))
  07 00 80 14 bnez a0, +0x20
0x348EC8 = Almost end (only loading values preserved on stack) of CTheScripts::ClearSpaceForMissionEntity((CVector const &, CEntity *))
  21 80 43 00 addu s0,v0,v1
|-
  21 10 A0 00 move v0,a1
|0x10||
  02 00 A0 14 bnez a1, +0x0C
GTA 3 (EU)
  00 00 00 00 nop
using 0x349790, 0x18E1F0, 0x349B18 ( + 200000000 base )
  01 00 05 24 li a1,0x1
0x349790 = start CTheScripts::ClearSpaceForMissionEntity((CVector const &, CEntity *))
  FC FF 40 10 beqz v0, -0x0C
0x18E1F0 = start CCollision::ProcessColModels((CMatrix const &, CColModel &, CMatrix const &, CColModel &, CColPoint *, CColPoint *, float *))
  00 00 00 00 nop
0x349B18 = Almost end (only loading values preserved on stack) of CTheScripts::ClearSpaceForMissionEntity((CVector const &, CEntity *))
  04 00 04 26 addiu a0,s0,0x4
|-
 
|0x11||
|-
GTA 3 (EU different ver.)
|SLUS_211.96||0x24D92589D5|| Indigo Prophecy || new SPU2 params || 1
using 0x3495C0, 0x18E1F0, 0x349948 ( + 200000000 base )
|-
0x3495C0 = start CTheScripts::ClearSpaceForMissionEntity((CVector const &, CEntity *))
|SLPM_661.93||0x608634992D|| <abbr title="https://www.gamefaqs.com/ps2/544598-indigo-prophecy/data">Fahrenheit (NTSC-J)</abbr> || new SPU2 params || 1
0x18E1F0 = start CCollision::ProcessColModels((CMatrix const &, CColModel &, CMatrix const &, CColModel &, CColPoint *, CColPoint *, float *))
|-
0x349948 = Almost end (only loading values preserved on stack) of CTheScripts::ClearSpaceForMissionEntity((CVector const &, CEntity *))
|SLUS_212.96||0x5CA15DF14D|| Dance Factory ||Setting mecha HACK to show GODZCD as GODZCDDA ||
|-
|}
|0x12|| Used by Disney/Pixar Finding Nemo (fixes the pause menu freeze)
 
if condition met...
====Inside ps2_gxemu.self/ps2_softemu.self====
store 0 in [ 0x204FC500 + 200000000 base] 0x4FC500 EE memory
There are hundreds of configs hidden in ps2_gxemu, and ps2_softemu self files. Internal config structure is basing on custom hash based on Title ID, internal memory offset pointing to place where true patch instruction is, and count of used commands. When disc/iso is started emulator search for configs, and if config for selected ID exist, then emulator apply it by itself. Is not perfect way of applying patches, because some games use the same ID, but different content. Good example here is Star Wars Battlefront II SLUS-21240, where some versions of game can refuse to work because it apply bad patch.
|-
 
|0x13||
{| class="wikitable sortable"
|-
|0x14||
|-
|0x15||
|-
|0x16|| Used exclusively by Champions of Norrath (NTSC)
store 0x01114BA8 in [ 0x208EAB4C + 200000000 base]
store 0x010C9E40 in [ 0x208EAB6C + 200000000 base]
|-
|0x17||
condition r18 == 0x8000
setting:
  stores 0x40490FDA somewhere
Note: 0x40490FDA (3.14159250) is the highest float approximation to π in hexadecimal without going over the value.<br />
Probably can improve FPU accuracy for some games.
|-
|0x18||
condition [ 0x20183F04 + 200000000 base ] == 0x0C060F2C
setting:
  stores 0 in address 0x20183F04, 0x20183F34, 0x20183F3C ( + 0x200000000 base )
  0x183F0C, sub_46334 (4.70)
  0x183F3C, sub_45DA4 (4.70)
  0x183D74, sub_47B50 (4.70)
|-
|0x19||
|-
|0x1A||
store 0 in [ 0x209FD560 + 200000000 base]
store 0 in [ 0x209F9550 + 200000000 base]
store 0 in [ 0x20A01570 + 200000000 base]
store 0 in [ 0x209F9540 + 200000000 base]
store 0 in [ 0x209F5540 + 200000000 base]
store 0 in [ 0x209F1530 + 200000000 base]
|-
|0x1B|| store 0 in [ 0x20552168 + 200000000 base]
|-
|0x1C|| store 1 in [ 0x20552168 + 200000000 base]
|-
|0x1D|| store 0 in [ 0x20556C08 + 200000000 base]
|-
|0x1E|| store 1 in [ 0x20556C08 + 200000000 base]
|-
|0x1F|| store 0 in [ 0x205243D8 + 200000000 base]
|-
|0x20|| store 1 in [ 0x205243D8 + 200000000 base]
|-
|0x21|| store 0 in [ 0x20524F88 + 200000000 base]
|-
|0x22|| store 1 in [ 0x20524F88 + 200000000 base]
|-
|0x23|| store 0 in [ 0x2047E7F8 + 200000000 base]
|-
|0x24|| store 1 in [ 0x2047E7F8 + 200000000 base]
|-
|0x25|| store 0 in [ 0x204802B8 + 200000000 base]
|-
|0x26|| store 1 in [ 0x204802B8 + 200000000 base]
|-
|0x27|| store 0 in [ 0x20586348 + 200000000 base]
|-
|0x28|| store 1 in [ 0x20586348 + 200000000 base]
|-
|0x29|| store 0 in [ 0x205868A8 + 200000000 base]
|-
|0x2A|| store 1 in [ 0x205868A8 + 200000000 base]
|-
|0x2B||
|-
|0x2C|| Shin Onimusha - Dawn of Dreams Fix ingame IPU runtime - JPN/US release [https://github.com/PCSX2/pcsx2/issues/1141 bug]
|-
|0x2D|| Shin Onimusha - Dawn of Dreams Fix ingame IPU runtime - PAL release [https://github.com/PCSX2/pcsx2/issues/1141 bug]
|-
|0x2E||
|-
|0x2F|| condition [ 0x37B0C4 + 200000000 base ] == 0 -> 00 10 0B 98
|-
|0x30|| condition [ 0x37B704 + 200000000 base ] == 0 -> 00 10 0B 98
|-
|0x31|| condition [ 0x37630C + 200000000 base ] == 0 -> 00 10 0B A8
|-
|0x32|| condition [ 0x37BB0C + 200000000 base ] == 0 -> 00 10 0B A8
|-
|0x33||
|-
|0x34|| not filled
|-
|0x35||
|-
|0x36||
|-
|0x37||
|-
|0x38||
|-
|0x39||
|-
|0x3A||
|-
|0x3B|| GTA 3 (JP/AS) ? using 0x351210, 0x18F590, 0x351568 ( + 200000000 base )
|}
 
{{Boxcomm|id=0x02|name=Unknown|data=1x int32}}
*Valid values found:
**1000d
**3000d
**6000d
 
{{Boxcomm|id=0x03|name=Unknown|data=N/A}}
Sets something 0
 
{{Boxcomm|id=0x04|name=Unknown|data=1x uint32_t index (i*0x80, special 0x12345: 0x91a280?)}}
*Valid values found:
**0x08
**0x10
 
{{Boxcomm|id=0x05|name=N/A|data=N/A}}
Command not available in ps2_netemu.self
 
{{Boxcomm|id=0x06|name=Unknown|data=N/A}}
Sets something 0x14F80 (85888'd)
 
{{Boxcomm|id=0x07|name=Delay VU xgkick by X cycles|data=1x uint32_t}}
Default 1
 
{{Boxcomm|id=0x08|name=Patch VU memory by mask |data=8x uint32_t (read mask,read mask, original opcode, original opcode, write mask, write mask, replace opcode, replace opcode)}}
Maximum Amount of Usage: 3 times
{{Boxcomm|id=0x09|name=EE_INSN_REPLACE64|data=uint32_t count, <list> (offset, original opcode, original opcode, replace opcode, replace opcode)}}
Maximum List Count: 32
*Valid values found
**1 [Dark Cloud] and [Dead Or Alive 2 Hardcore]
 
{{Boxcomm|id=0x0A|name=EE_INSN_REPLACE32|data=uint32_t count, <List> (offset, original opcode, replace opcode)}}
Command present only in the ps2_netemu. Maximum List Count: 32
*Valid values found
**1 [Deadly Strike]
**2 [Dragon Force]
 
{{Boxcomm|id=0x0B|name=MECHA_SET_PATCH|data=1x uint32_t count, <List> {sector id, offset, sizeof present opcodes, replace opcodes, original opcodes)}}
Offset on disc = sector id * sector size + offset (-0xC for DVD [not always applied, see Psychonauts or
SRS: Street Racing Syndicate configs], +0x18 for CD [raw 2352 sector size])
  [Dead Or Alive 2 Hardcore] uses 7
  [Gradius V] uses 1
  [Grand Theft Auto III] uses 1
  [Katamari Damacy] uses 1
  [Manhunt] uses 1
  [Odin Sphere] uses 2
  [Primal] uses 1
  [Psychonauts] uses 1
  [Syphon Filter The Omega Strain] uses 1
Maximum List Count: 47
 
{{Boxcomm|id=0x0C|name=Unknown|data=1x (uint16_t, uint16_t)}}
0/1/2,<0x63>
 
{{Boxcomm|id=0x0D|name=Unknown|data=1x int32}}
True/false. Default = 1 ?
0 == skip some code,
1 == some code + checks
 
{{Boxcomm|id=0x0E|name=Improves ADD/SUB accuracy|data=1x int32}}
1 Param offset --- Improves ADD/SUB accuracy for selected offset (incl. Floats). Seems to work with the COP2 too.
  [Rygar] only has 0x147DA8 sub.s  $f12, $f20, $f12
Used in official configs: SCUS97501=0x3C458C, SCES53642=0x3C4854, SLUS21026=0x386864, SLUS20916=0x121F64, SLUS20437=0x11EDF0
Maximum Amount of Usage: 31 times
 
{{Boxcomm|id=0x0F|name=More accurate memory range|data=List <uint32_t Param, uint32_t Param>}}
More accurate memory range (FPU mul/div/sub/add accuracy related)
  [Dark Cloud] uses 0x239334, 0x1FFFFFF
  [Grand Theft Auto SA] uses 0x1E46DC, 0x1E4AE8
Maximum List Count: 31
 
{{Boxcomm|id=0x10|name=MULDIV_Accurate_range|data=List <uint32_t Param, uint32_t Param>}}
More accurate memory range (COP2, mul/div/sub/add accuracy related)
Maximum List Count: 31
 
{{Boxcomm|id=0x11|name=VU0 MICROPROGRAM Memory Offset|data=1x uint32_t Param}}
Keep in mind this offset is a direct address.<br>
So by PS2 memory mapping is ((offset + 0x11000000) & 0x11000FF8)<br>
Function is somehow related to all Upper pipeline ADD/SUB operations (incl. opcodes like MADD, OPMSUB, etc.).<br>
When offset is hit, opcode is processed using different code path, probably more accurate.<br>
Note: Due to how VU work, exact offset in VU memory will be param + 4, because VU process 2 opcodes in same time.<br>
Lower pipeline fetch opcode from address, Upper from address + 4.
Used in official configs: SLUS21172=0x208, SLUS20878=0x140,0x368,0x570
Maximum Amount of Usage: 31 times
 
{{Boxcomm|id=0x12|name=Unknown|data=<List> (uint32_t count,}}
  [Primal] uses 0xD
  [Rayman Arena] uses 0x11
  [Syphon Filter: The Omega Strain] uses 0x5
00 00 00 0?
00 00 00 00
type? count?
... 
Maximum List Count: 63
 
{{Boxcomm|id=0x13|name=Memory card timing related delay|data=1x uint64_t Param}}
Jak X: Combat Racing uses 0xf960 (63840)
Netsu Chu! Pro Yakyuu 2004 uses 0xf960 (63840)
Phantasy Star Universe uses 0x9bdc (39900)
WRC II Extreme uses 0x9bdc (39900)
Burnout Dominator uses 0x9bdc (39900)
Jissen Pachi-Slot Hisshouhou! Kemono-Oh uses 0x1d394 (119700)
Used in official configs: SCUS97429=0xF960(63840), SLPM66031=0x9BDC(39900), SLPS20131=0x1D394(119700)
 
{{Boxcomm|id=0x14|name=Unknown|data=N/A}}
Sets something 1
 
{{Boxcomm|id=0x15|name=Unknown|data=1 Param ( <1, >1 )}}
Different settings/mode?
[Bloodrayne 2] uses 4
[GRIMgRiMoiRe] uses 4
[Mana Khemia 2] uses 4
[Odin Sphere] uses 4
[SMT Persona 3 FES] uses 4
 
{{Boxcomm|id=0x16|name=N/A|data=N/A}}
Command not available in ps2_netemu.self
 
{{Boxcomm|id=0x17|name=Unknown|data=1x int32}}
True/false?
[Bully] uses 1
 
{{Boxcomm|id=0x18|name=N/A|data=N/A}}
Command not available in ps2_netemu.self
 
{{Boxcomm|id=0x19|name=SB_SIO2 related?|data=N/A}}
Sets something 1
[Grand Theft Auto III]
[Red Faction 2]
[Siren]
 
{{Boxcomm|id=0x1A|name=Unknown|data=N/A}}
Sets something 1
 
{{Boxcomm|id=0x1B|name=Unknown|data=N/A}}
Sets something 1
[Mana Khemia 2]
 
{{Boxcomm|id=0x1C|name=Unknown|data=read uint32_t (use uint8_t)}}
Default 3
 
{{Boxcomm|id=0x1D|name=Unknown|data=read uint32_t (use uint8_t)}}
 
{{Boxcomm|id=0x1E|name=Unknown|data=read uint32_t (use uint8_t)}}
 
{{Boxcomm|id=0x1F|name=Unknown|data=1x uint32_t}}
Default 0x3E8?
 
{{Boxcomm|id=0x20|name=Unknown|data=1x uint64_t}}
Default 0x3C
Config value is used as multiplier for some value, and result is used in vsync related runtimes.
Is worth to note that 0x3C is default multiplier even for PAL titles, so is not stricly related to framerate,
but to vsync counters (where 0x3C is still wrong anyway..). Result of multiply is also compared at some point to vsync delay value.
 
{{Boxcomm|id=0x21|name=Unknown|data=1x uint32_t}}
0 = sets an option from 1 to 0 and another one to 0,
1 = sets an option from 1 to 0 and another one to 1,
2 = sets an option from 1 to 1 and another one to 0
  [Fatal Frame II] uses 0
  [Grand Theft Auto Vice City] uses 1
  [Grand Theft Auto III (EU)] uses 1
  [SMT Persona 3 FES] uses 0
 
{{Boxcomm|id=0x22|name=Unknown|data=N/A}}
Sets something 1
 
{{Boxcomm|id=0x23|name=Unknown|data=N/A}}
Memcpy 0x100 Bytes and sets 0x14E00
 
{{Boxcomm|id=0x24|name=Unknown|data=1x uint64_t}}
 
{{Boxcomm|id=0x25|name=N/A|data=N/A}}
Command not available in ps2_netemu.self
 
{{Boxcomm|id=0x26|name=FPU_Accurate_range|data=List <uint32_t Param,uint32_t Param>}}
Improves ADD/SUB accuracy for selected memory range (incl. Floats)
  [Bloodrayne 2] uses 0x340000, 0x350000
  [Gradius V] uses 0x3046E0, 0x0x305E44
Maximum List Count: 31
Maximum Amount of Usage: ??
  The command is used 4 times consecutively by [Strawberry Shortcake: The Sweet Dreams]
  SLES-54309 (EU) and
  SLUS-21497 (US) game configs hardcoded inside ps2_gxemu.self
 
{{Boxcomm|id=0x27|name=VU0 macromode accurate range|data=List <uint32_t Param,uint32_t Param>}}
Improves COP2 operations accuracy for selected memory range
Maximum List Count: 31
 
{{Boxcomm|id=0x28|name=Unknown|data=1x uint32_t}}
<=3
 
{{Boxcomm|id=0x29|name=Unknown|data=2x uint32_t}}
 
{{Boxcomm|id=0x2A|name=Unknown|data=N/A}}
Sets something 1. Allows online downloadable content (HDD)? Multitap? Local 2 player?
All-Star Baseball 2004
 
{{Boxcomm|id=0x2B|name=Unknown|data=N/A}}
Sets something 1. Allows disc eject/swap? Probably allow read PS2CDDA disc as PS2CD, DF is only known retail game that use audio tracks on own disc. Without config there should be no track to play available in game (info: https://github.com/PCSX2/pcsx2/issues/4880 - please ignore other titles, only DF really use audio tracks.) Make sure to test single bin/cue, not multi bin image. EDIT: No tracks are detected either, regardless of the command. Could be a netemu or Cobra issue (single, mixed mode .bin/.cue loaded)
Dance Factory
 
{{Boxcomm|id=0x2C|name=Unknown|data=1x uint32_t}}
Summoner uses 0x1
 
{{Boxcomm|id=0x2D|name=N/A|data=N/A}}
Command not available in ps2_netemu.self
 
{{Boxcomm|id=0x2E|name=Unknown|data=1x uint32_t}}
 
{{Boxcomm|id=0x2F|name=Unknown|data=1x uint32_t}}
SPU2 related?
Indigo Prophecy/Fahrenheit uses 0x1
 
{{Boxcomm|id=0x30|name=N/A|data=N/A}}
Command not available in ps2_netemu.self
 
{{Boxcomm|id=0x31|name=N/A|data=N/A}}
Command not available in ps2_netemu.self
 
{{Boxcomm|id=0x32|name=N/A|data=N/A}}
Command not available in ps2_netemu.self
 
{{Boxcomm|id=0x33|name=N/A|data=N/A}}
Command not available in ps2_netemu.self
 
{{Boxcomm|id=0x34|name=N/A|data=N/A}}
Command not available in ps2_netemu.self
 
{{Boxcomm|id=0x35|name=Enable Force Flip Field|data=N/A}}
Described in emu setting as "''Fix for [Hang] for soft-lock''"
 
{{Boxcomm|id=0x36|name=N/A|data=N/A}}
Command not available in ps2_netemu.self
 
{{Boxcomm|id=0x37|name=N/A|data=N/A}}
Command not available in ps2_netemu.self
 
{{Boxcomm|id=0x38|name=N/A|data=N/A}}
Command not available in ps2_netemu.self
 
{{Boxcomm|id=0x39|name=N/A|data=N/A}}
Command not available in ps2_netemu.self
 
{{Boxcomm|id=0x3A|name=N/A|data=N/A}}
Command not available in ps2_netemu.self
 
{{Boxcomm|id=0x3B|name=N/A|data=N/A}}
Command not available in ps2_netemu.self
 
{{Boxcomm|id=0x3C|name=N/A|data=N/A}}
Command not available in ps2_netemu.self
 
{{Boxcomm|id=0x3D|name=Config file revision|data=1x uint32_t}}
 
{| class="wikitable sortable" style="font-size:0.9em; line-height:90%"
|-
! Firmware !! ps2_netemu Revision !! Max Supported Commands
|-
| 3.70 || 15686 || 0x41
|-
| 3.73 || 15936 || 0x41
|-
| 3.74 || 15936 || 0x41
|-
| 4.00 || 16195 || 0x41
|-
| 4.01 || 16195 || 0x41
|-
| 4.10 || 16361 || 0x41
|-
| 4.11 || 16361 || 0x41
|-
| 4.20 || 16604 || 0x43
|-
| 4.21 || 16604 || 0x43
|-
| 4.23 || 16604 || 0x43
|-
| 4.25 || 16740 || 0x43
|-
| 4.26 || 16740 || 0x43
|-
| 4.30 || 16808 || 0x45
|-
| 4.31 || 16808 || 0x45
|-
| 4.40 || 16916 || 0x46
|-
| 4.41 || 16916 || 0x46
|-
| 4.45 || 17041 || 0x48
|-
| 4.46 || 17041 || 0x48
|-
| 4.50 || 17179 || 0x4A
|-
| 4.55 || 17277 || 0x4D
|-
|4.60<br />
4.70<br />
4.75<br />
4.76<br />
|| 17314 || 0x4D
|-
|4.78<br />
4.80<br />
4.81<br />
|| 17495 || 0x50
|-
|}
 
{{Boxcomm|id=0x3E|name=Unknown|data=N/A}}
Sets something 1. Default Init = 0. Similar to 0x0D with param 0. Affect the same code path, but skips more code.
0 == do set some stuff,
1 == skip
 
{{Boxcomm|id=0x3F|name=Unknown|data=1x uint32_t}}
 
{{Boxcomm|id=0x40|name=Unknown|data=N/A}}
Sets something 1
Grand Theft Auto SA
Silent Hill Origins - unofficial fix
 
{{Boxcomm|id=0x41|name=Unknown|data=N/A}}
Sets something 1 (Disables some lwsync - speedhack?)
Dragon Force
God Hand
Gradius V
Katamari Damacy
 
{{Boxcomm|id=0x42|name=EE Overlay patch|data=2 main Params + patch data: uint32_t address, uint32_t count, opcode,opcode,opcode...}}
Address need to be in 0xFF000 - 0xFFFFC range.
Count is size of patch in 4 bytes opcodes. So 5 opcode patch = count 5.
Opcodes will be placed on selected address, we use only patch code, no need for original opcode.
Next opcode addresses are auto calculated (+4..) so we need to specify only patch start address.
Remember we need to jump to our new code, best way is command 0x0A with j (jump) opcode.
Also is important to add return jump if required. That one need to be added in our 0x42 patch.
Maximum opcodes count seems to be 0x3FF (1023 opcodes).
 
{{Boxcomm|id=0x43|name=Unknown|data=1x int32}}
Equal to command 0x40, but with Parameter:
0 = Default
1 = (like 0x40)
param =
-1 = failure?
 
{{Boxcomm|id=0x44|name=Disables Smoothing and Smoothing option|data=N/A}}
 
{{Boxcomm|id=0x45|name=Unknown|data=N/A}}
Sets something 1
Prevent  display_mode 2 (CELL_GCM_DISPLAY_576_unk)        [640x576]
and      display_mode 0 (CELL_GCM_DISPLAY_480_unk) (60Hz?) [640x480]
from beign set.
Allow  display_mode 1 (CELL_GCM_DISPLAY_480_unk2) (59Hz?) [640x480]
and    display_mode 5 (CELL_GCM_DISPLAY_720P_59)          [1280x720]
depending on sys_info.video_mode & 0x200 is 0 or not.
Both 480 modes can be either I or P, so is something else, probably 59/60Hz.
This config possibly affect only in-emu UI, but this require testing.
Phantasy Star Complete Collection
 
{{Boxcomm|id=0x46|name=Enable L2H Improvement|data=N/A}}
Performance related setting for titles using L2H (Local to Host, so called GS download (from GS to  EE))
SMT Digital Devil Saga 1
SMT Nocturne
Fatal Frame II
 
{{Boxcomm|id=0x47|name=Enables XOR CSR|data=N/A}}
Graphics related setting.<br>
XOR  bit 13 of GS CSR register (CSR.FIELD). Should fix fullscreen line corruption, maybe some interlacing issues. Long shot, but can possibly affect SCANMSK games.
 
{{Boxcomm|id=0x48|name=VSYNC Delay|data=2x uint32_t}}
*First param possible value are 1 = No IPU, 2 = IPU, 3 = Anytime.
*Second param is delay (in ms?), and can be also negative value.
**Emu has standard presets for second param.
***Agressive = 0x3D090 (250000 decimal),
***Normal = 0x186A0 (100000 decimal),
***Conservative = 0x4E20 (20000 decimal),
***But other values can be used.
[SMT Digital Devil Saga 1] uses 1, 0x3D090
[Fatal Frame II] uses 0x2, 0xFFFFE69C (-6500 decimal)
 
{{Boxcomm|id=0x49|name=Unknown|data=N/A}}
Sets something 0xB,0,0
Trapt
 
{{Boxcomm|id=0x4A|name=Unknown|data=N/A}}
Sets something 0x15100
Applies to the Snowblind Engine games. Fixes the rest of flickering textures.
Meant to be used in conjunction with the GX/SOFT Snowblind Engine's specific commands (double 0x01 and 0x23 combo).
 
{{Boxcomm|id=0x4B|name=Redirect SAVEDATA by ID|data=2x uint32_t Params + ID: offset, int, char[12]}}
For proper config we need at least 2 (can be more if needed) 0x4B commands, one to enable redirect, one to disable.
First param is EE memory offset that when is hit enable/disable redirection.
Second param is partially unknown, seems to be size of next param to read * 4 (3 in known configs), or 0xFFFFFFFF for disable redirect command.
Third param is ID of SAVEDATA we want to use padded with 00 to match 12 bytes, or all 00 in disable redirect config.
Important note here is that config have own 00 00 00 00 terminator at the end.
So after 12 bytes of ID we need to add 4 bytes of 00. That apply also to disable redirect version.
 
{{Boxcomm|id=0x4C|name=Unknown|data=2x uint32_t (offset, int)}}
2 = current path?, 3 = new ISO.BIN.ENC path?, other= ?
 
{{Boxcomm|id=0x4D|name=Unknown|data=1x uint32_t}}
Param can be -1. Sets something (same as 0x49 but) 0xC, Param, 0
Wild Arms: The Fifth Vanguard uses 0x3F800000
 
{{Boxcomm|id=0x4E|name=Unknown|data=Unknown}}
 
{{Boxcomm|id=0x4F|name=Unknown|data=Unknown}}
 
{{Boxcomm|id=0x50|name=Enable pressure sensitive controls|data=N/A}}
 
===Config file examples (for netemu)===
 
====Official PS2 Classic====
See: [[PS2 Official Configs]]
 
====Official GXEMU/SOFTEMU extracted====
See: [[PS2 Official Configs]]
 
==== Custom Configs ====
See: [[PS2 Custom Configs]]
 
===Config data examples (hardcoded)===
====Inside ps2_emu.self====
Embedded patches are based on Checksum/Hash of title. ps2_emu is only emulator version where patches are described inside self file in ascii. Known patch types described in ascii are: Patch data, new SPU2 params, and Setting mecha HACK to show GODZCD as GODZCDDA.
 
{| class="wikitable sortable"
! PS2 Title !! Hash !! Game !! Patch Type !! Data
|-
| SCUS_971.46|| 0x6B1ADE00D||Disney's Treasure Planet || Patch data - Fixes black screen at start, it apply to STREAM_D.IRX file in IOP folder. || 0x147C (sector) , 0x580 (offset) (- 0xC on disc)
Replace opcodes
00 01 01 3C lui at,0x0100
80 BF 03 3C lui v1,0xBF80
C8 10 63 8C lw v1,0x10C8(v1)
24 18 61 00 and v1,at
FB FF 61 10 beq v1,at, -0x10
00 00 00 00 nop
Original opcodes
FF FF 01 24 li at,-0x1
04 00 61 14 bne at,v1, +0x14
00 80 01 3C lui at,0x8000
02 00 41 14 bne at,v0, +0x0C
00 00 00 00 nop
0D 00 06 00 break 
|-
|SLUS_201.74 ||0x23D92589C5|| Rumble Racing || Patch data - fixes black screen after Playstation 2 logo. Patch apply to AUDIO.IRX file in MODULES folder || 0x3AEDA (sector), 0x120 (offset)
  Replace opcodes
  06 00 80 14 bnez a0, +0x1C
  21 20 43 00 addu a0,v0,v1
  21 10 A0 00 move v0,a1
  02 00 A0 14 bnez a1, +0x0C
  00 00 00 00 nop
  01 00 05 24 li a1,0x1
  EB FF 40 10 beqz v0, -0x50
  04 00 84 24 addiu a0,0x4
  FC FF 90 24 addiu s0,a0,-0x4
 
  Original opcodes
  07 00 80 14 bnez a0, +0x20
  21 80 43 00 addu s0,v0,v1
  21 10 A0 00 move v0,a1
  02 00 A0 14 bnez a1, +0x0C
  00 00 00 00 nop
  01 00 05 24 li a1,0x1
  FC FF 40 10 beqz v0, -0x0C
  00 00 00 00 nop
  04 00 04 26 addiu a0,s0,0x4
 
|-
|SLUS_211.96||0x24D92589D5|| Indigo Prophecy || new SPU2 params || 1
|-
|SLPM_661.93||0x608634992D|| <abbr title="https://www.gamefaqs.com/ps2/544598-indigo-prophecy/data">Fahrenheit (NTSC-J)</abbr> || new SPU2 params || 1
|-
|SLUS_212.96||0x5CA15DF14D|| Dance Factory ||Setting mecha HACK to show GODZCD as GODZCDDA ||
|}
 
====Inside ps2_gxemu.self/ps2_softemu.self====
There are hundreds of configs hidden in ps2_gxemu, and ps2_softemu self files. Internal config structure is basing on custom hash based on Title ID, internal memory offset pointing to place where true patch instruction is, and count of used commands. When disc/iso is started emulator search for configs, and if config for selected ID exist, then emulator apply it by itself. Is not perfect way of applying patches, because some games use the same ID, but different content. Good example here is Star Wars Battlefront II SLUS-21240, where some versions of game can refuse to work because it apply bad patch.
 
{| class="wikitable sortable"
! PS2 Title !! Hash !! Game !! Patch Type !! Data
! PS2 Title !! Hash !! Game !! Patch Type !! Data
|-
|-
Line 1,914: Line 2,222:
! Bug !! Description !! Known Affected Games
! Bug !! Description !! Known Affected Games
|-
|-
| Missing Emotion Engine Data Cache emulation || Emulating that is literally not possible without making games run at 3 fps. Fixed by patches to game image, or EE code. Instruction Cache (not Data) seems to be implemented, at least partially. || Ice Age 2, DOA2: Extreme, Nascar 2009.
| Missing Emotion Engine Cache emulation || Emulating that is literally not possible without making games run at 3 fps. Fixed by patches to game image, or EE code. || Ice Age 2, DOA2: Extreme, Nascar 2009 (luckily fixed by instant VIF bug).
|-
|-
| Branch delay slot violation not supported on EE || Some games have Branch instruction inside Branch delay slots, this is not emulated correctly on EE (VU have proper emulation of that). This is patched in configs by rearangging MIPS code. || WRC 3,4,Rally Evolved, one of Action Replay discs.   
| Branch delay slot violation not supported on EE || Some games have Branch instruction inside Branch delay slots, this is not emulated correctly on EE (VU have proper emulation of that). This is patched in configs by rearangging MIPS code. || WRC 3,4,Rally Evolved, one of Action Replay discs.   
|-
|-
| Unmapped write only EE memory (confirmed only for SIF) || Reads/Writes to 0x2000000+ shouldn't throw bus error on dma transfers. Write should be performed as successful, memory should stay unchanged. Reads should return 0. || Games developed by In Utero, while creating initial save file, send DMA where address is EE stack pointer. At the time of transfer start $sp is too high, and requested transfer size make MADR overflow above 0x2000000 at some point. This is game bug, and happen also on real hardware. Fixed by config.
| VIF is instant || There is no correct timing, or even attempt to emulate that. Everyting done by VIF0/1 is done right when pushed || Nascar 2009 is affected in possitive way, game don't have time to corrupt transfer. Probably many more games.  
|-
| VIF bugs || There is no correct timing, and queuing for some VIF commands like MSCAL. || Snowblind Engine games. Probably more.  
|-
|-
| XGKick is instant || Some games expect to XGKick happen few cycles in future, on PS3 is done instant. Fixed by config 0x07 which delay XGKick by selected value || WRC series, Wakeboarding Unleashed, TriAce games, World of Outlaws - Sprint Cars, Ty - The Tazmanian Tiger, dot Hack - G.U. series, and more
| XGKick is instant || Some games expect to XGKick happen few cycles in future, on PS3 is done instant. Fixed by config 0x07 which delay XGKick by selected value || WRC series, Wakeboarding Unleashed, TriAce games, World of Outlaws - Sprint Cars, Ty - The Tazmanian Tiger, dot Hack - G.U. series, and more
Line 1,926: Line 2,232:
| COP2 instructions are instant || Some games rely on fact that COP2 operations can take some time, on PS3 emulators they are done instantly due to lack of correctly emulated pipeline Patched by rearranging mips code || FFX, FFX-2, Ghost in The Shell SAC, Ace Combat series, Sprint Cars 1/2, Black, Run Like Hell, Everblue 2, Dragon Quest - Shounen Yangus no Fushigi na Daibouken, and many more
| COP2 instructions are instant || Some games rely on fact that COP2 operations can take some time, on PS3 emulators they are done instantly due to lack of correctly emulated pipeline Patched by rearranging mips code || FFX, FFX-2, Ghost in The Shell SAC, Ace Combat series, Sprint Cars 1/2, Black, Run Like Hell, Everblue 2, Dragon Quest - Shounen Yangus no Fushigi na Daibouken, and many more
|-
|-
| VU0 is not running in sync with EE core || VU0 is running program "at once", which mean that VU0 run until it hits E bit. From EE perspective it looks like whole VU0 program run in 1 cycle. Games that expect VU0 registers to be changed from EE side while VU0 is running are broken due to that. Partially resolved using 0x12 command with 2/3 subcommands, or by code rearranging.|| 24 The Game, ATV Quad Power Racing 2, Twisted Metal Head-On, Primal, Ghosthunter, Rayman Arena, Rayman 3, Largo winch. All games using M-bit.
| VU0 is not running in sync with EE core || Seems like old pcsx2 mVU approach is used where VU0 is running thousands of cycles ahead of EE. Partially resolved on emu using 0x12 command with 2/3 subcommands. || 24 The Game, ATV Quad Power Racing 2, Twisted Metal Head-On, Primal, Ghosthunter, Rayman Arena, Rayman 3, All games using M-bit.  
|-
| M-Bit not supported || Emulator ignore VU0 M-Bit, that cause issues for games that need it to work correctly. This is done because there is no way to sync correctly running VU0 without sync with EE. Partially resolved on emu using 0x12 command with 2/3 subcommands, or direct VU0/MIPS code rearranging. || Totally Spies! Totally Party, Mike Tyson Heavyweight Boxing, My Street, Crash Twinsanity, Marvel Nemesis, Panzer Elite Action - Fields of Glory, TriAce games (speed optimizations only), Super Monkey Ball Adventure, most Eko Software games, and many more.
|-
|-
| T-Bit not supported on VU0 || Emulator ignore VU0 T-Bit, that cause issues for games that need it to work. Note: T-Bit is correctly handled for VU1. || Spiderman 3 set T-Bit, then do cfc2 from TPC (address where VU0 stopped). Since T-Bit is ignored, TPC is wrong. Value is later copied to CMSAR0, and program continue at wrong address. Well that's what should happen, but T-Bit also not signalize correct bit in VPU-STAT. Causing another issue, also in Spiderman 3.  
| M-Bit not supported || Emulator ignore VU0 M-Bit, that cause issues for games that need it to work correctly. This is done because there is no way to sync correctly running VU0 without sync with EE. Partially resolved on emu using 0x12 command with 2/3 subcommands. || Totally Spies! Totally Party, Mike Tyson Heavyweight Boxing, My Street, Crash Twinsanity, Marvel Nemesis, Panzer Elite Action - Fields of Glory, TriAce games (speed optimizations only), Super Monkey Ball Adventure, most Eko Software games, and many more.
|-
|-
| Emulator do not update correct flag instances for COP2 while ending VU0 program on Ebit || This cause few games to read bad flag status (not status flag!) on COP2. This is resolved on emu by forcing update of MAC flag on every STATUS flag read (by config 0x12), this cause slowdowns creating a lot of unnecessary operations. || Driving Emotion Type-S, State of Emergency 2, The Getaway Black Monday.
| Emulator Fail to save correct flag instances while ending VU0 program on Ebit || This cause few games to read bad flag status (not status flag!) on COP2. This is resolved on emu by forcing update of MAC flag on every STATUS flag read (by config 0x12), this cause slowdowns creating a lot of unnesessary operations. || Driving Emotion Type-S, State of Emergency 2, The Getaway Black Monday.
|-
|-
| Not updated status flag when VDIV/VSQRT/VRSQRT is done on COP2 || Potential bad flag state can cause a lot of issues that are not related on first sight || Yanya Caballista (already patched by custom config)
| Not updated status flag when VDIV/VSQRT/VRSQRT is done on COP2 || Potential bad flag state can cause a lot of issues that are not related on first sight || Yanya Caballista (already patched by custom config)
|-
|-
| In corner cases emu select wrong block flags pipeline state (both VU0/EEonBE and VU1/VRC affected). || This can cause various issues, mostly SPS, missing graphic, specific slowdowns, etc. Issue seems to occur when branch/jump delay slot have opcode important for flags calculation. Theory is that cached microprogram don't include modified flags state from delay slot instruction. So when already recompiled program is fetched from pool, it will miss one cycle in fmac flags pipeline. This can be crucial in games that rely on it. || Tales of Legendia and Klonoa 2 set sticky flag bits to 0 and branch with sub.xyzw in delay slot (expecting that sub change status flag), Tamsoft engine games set sticky bits to 0 in branch delay slot, this was most ridiculous bug, because problematic branch was pointing to next opcode after delay slot, removing branch was enough. True Crime: NY is only known game where VU0 is affected by this bug. more..
| In corner cases emu select wrong block pipeline state while processing Flag VU opcodes. || This can cause various issues, mostly SPS, missing graphic, specific slowdowns, etc. For now it was only confirmed that FSAND opcode don't ask for exact pipeline state, but looking at assembly of other opcode this rather affect all of them. || Tales of Legendia, more..
|-
| CTC2 opcode write whole value to R register, while only 23 bits are writable. Rest is hardcoded to 0x3F800000. || Can cause many weird issues like broken physics, broken graphics. PCSX2 was also affected [[https://github.com/PCSX2/pcsx2/pull/6611 more]]. || The one game that is known to be affected, and is already patched, is Musashi: Samurai Legend.
|-
| CFC2 from R register should return only 23 lower bits. || CFC2 from R on real PS2 return only lower 23 bits. Originally found out by PCSX2 team  [[https://github.com/PCSX2/pcsx2/pull/8409 more]] and later confirmed to affect ps2_netemu in emu assembly. || There is only one game that is known to be affected, Onimusha Dawn of Dreams.
|-
| Missing floating point result overflow/underflow detection (U/O flags not set) || Since this affect all units (FPU/VU), many issues can occur. But in reality it seems to not affect any games. While this is easier to implement than on x86 system (full floats range, compared to ieee754), there is no way to do that by hardware way. Because SPU add/sub don't set those flags on single precision operations, and vmx have them disabled in spu compatibility mode. || Superman Returns.
|-
| DMA between SPR and VU1 memory cause emulator panic. || Currently cause is unknown. It seems that functions responsible for transfer don't check that VU is running. Manual state that dma can be performed only when VU is not active, and pcsx2 wait until VU end. Games affected in emulators on ps3 display this warning in pcsx2 if mtvu is enabled: "MTVU: SPR Accessing VU1 Memory". Affected games are fixed by rearranging code to do lq/sq loop instead of DMA. || Summoner 2 (SPRfrom to VU1 data mem), Kaena (SPRto from VU1 data mem).
|-
|-
| IOP SIF0/1 DMA IRQs can be disabled (masked), which is not true on real hardware. || IOP interrupts 0x2A and 0x2B should always trigger. Fixed by patches to IOP code. Ps2_emu seems to be unfacted, probably handled on real hw in CXD9208GP. || Knockout Kings 2001, DOA2: Hardcore.
|}
|}
===Software emulation bugs===
===Software emulation bugs===
Line 1,953: Line 2,248:
! Bug !! Description !! Known Affected Games
! Bug !! Description !! Known Affected Games
|-
|-
| No mipmapping support || Emulator does ignore the mipmap layers, probably for performance reasons. It is processing only the level 0 texture base pointer specified in the TEX0 register. There are games writing garbage data into that memory area, when the mipmap level is different than zero. As a result, a garbled texture is shown instead of a correct one. || Ace Combat series, Ape Escape 2, EA Sports F1 series, Harry Potter series, ICO (psuedo volumetric rays), Jak and Daxter series, Nickelodeon Barnyard and Nicktoons Unite (very strange implementation), Ratchet and Clank series and more.
| SCANMSK register ignored || Emulator does ignore the SCANMSK setting responsible for restricting the drawing primitives on the odd or even lines. It is used as a fake transparency effect in some games by merging the two display circuits. || Metal Gear Solid series (heavy used in the MGS2 on the water and reflection effects), Gran Turismo series (ghost cars).
|-
| SCANMSK register ignored || Emulator does ignore the SCANMSK setting responsible for restricting the drawing primitives on the odd or even lines. It is used as a fake transparency effect in some games by merging the two display circuits. || Metal Gear Solid series (water and reflection effects), Gran Turismo series (ghost cars), Raw Danger! (depth of field effect)
|-
|-
| Missing PCRTC feedback write support || PCRTC feature that writes back the image to the frame buffer is not supported or broken. Additional RGB to YCbCr conversion could be performed there. || Xenosaga Episode I: Der Wille zur Macht (black and white cut scenes)
| Lack of support for 4-bit tex GS downloads || L2H (Local to Host / GS to EE) PSMCT4, PSMCT4HL, PSMCT4HH transfers are not supported.
Transfer request for any of that format is just ignored. Same goes for any undocumented PSM.<br>
Note: Apparently PCSX2 also not support 4 bit formats download because they are "forbiden",
but i wasn't able to find any info about that in official PS2 documentation (maybe based on real HW tests?).  
|| None.
|-
|-
|}
|}
Line 2,414: Line 2,711:
==ps2_title_brute code==
==ps2_title_brute code==


A script to calculate cdvd key magic used in ps2emu, gxemu and softemu from given input title id.
A script to calculate whatever this encode is that is used in ps2emu, gxemu and softemu from given input title id.
On real PS2 this value seems to be stored at 0x1F402020-0x1F402024.
 
It contains code for bruting as well. Just call gen_sum with the title id in a specific format to get it.
It contains code for bruting as well. Just call gen_sum with the title id in a specific format to get it.


Line 2,593: Line 2,890:
print(hex(gen_sum2(ID)))
print(hex(gen_sum2(ID)))
</syntaxhighlight>
</syntaxhighlight>
Alternative implementation: https://github.com/PCSX2/pcsx2/blob/1a3d77b2c0c6b57313f0dceaf5ecc3f8cb453497/pcsx2/CDVD/CDVD.cpp#L545


==External References==
==External References==
Line 2,608: Line 2,904:
* http://wiki.pcsx2.net/index.php/Category:Software_rendering_only_games
* http://wiki.pcsx2.net/index.php/Category:Software_rendering_only_games


{{Reverse engineering}}<noinclude>
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
[[Category:Main]]
</noinclude>
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps3/PS2_Emulation"