Talk:PS1 Emulation

From PS3 Developer wiki
Jump to navigation Jump to search

PS1 Emulator Types and Revisions

PS1 Emulators Types and Revisions
ps1_emu.elf (decrypted)
Firmware Bytes MD5 Timestamp Rev
1.00 AV 10 296 408 981A7428C2A59219FA05861EDEEDBD4A 06/10/04/12:16 ?
1.02 10.296.408 C5FE03742A951194C336EE33783F5CD6 06/10/21/00:01 ?
1.10 10.296.408 C9C9D7D2E36F3E3579A5DF713E9ABE1E 06/11/09/06:09 ?
1.11 10.296.408 26271CCA29B77483DC3D7FDDE7B9CC3C 06/11/21/17:55 ?
1.30 10.296.496 E7932EC24E72B3005EE152B141A63690 06/12/05/05:34 ?
1.31 10.296.496 2244DE70C85093D7E37BC3D3F4278BE1 06/12/12/18:48 ?
1.32 10.296.496 601BCADBBBC0A2D0433C932A2D67C4EF 06/12/18/05:55 ?
1.50 10.303.536 F8050B006CDFCC64DF742D7BBDC03130 07/01/18/22:53 ?
? ? ? ? ?
? ? ? ? ?
? ? ? ? ?
1.90 6.974.864 478CFED0F7EE13C94F01C2A246C83D45 07/07/21/06:45 ?
? ? ? ? ?
? ? ? ? ?
? ? ? ? ?
3.66 2.824.832 95399A202003E216794511BD2D2E9DF6 11/06/16/03:52 ?
3.70 2.824.920 045D81147B9BDFB8C8A416FD5F5A0C56 11/08/05/03:42 same
~ Any
3.72 C745A30231103B83F04539021E4878FC 11/09/14/01:17
3.73 2.824.920 EB3AFF30B3206CFA6A8962AB393F773E 11/10/04/12:55 same
3.74 E2A77C3DC9FD5AD4264341196462D096 11/10/25/00:38
4.00 2.829.784 94A8E6A8063C08FAD8CA9B340CCCAE67 11/11/22/03:17 same
~ Any
4.11 02B7F6D5F517959161B2154135D4B3BC 12/02/11/07:13
4.15 ? ? ? ?
4.20 2.829.912 3778948C92F5FA12CB0AABE65BEE5465 12/06/15/02:09 same
4.21 B7B662397E3FFDD7C11F9617C1B41856 12/06/30/01:13
4.23 S 2.829.912 6E74CC51E0C6462DF1F9278ED9DB9593 12/07/31/00:22 ?
4.25 2.829.912 03EA65C3EA3F8DB04F236C49C6B6C0E1 12/09/07/07:03 same
? ? ? ? ?
? ? ? ? ?
? ? ? ? ?
4.78 2.765.488 354F1DEEDCA3C4CFA1B49B6B28B1648D 15/12/17/01:18 ?
4.80 ? ? ? ?
4.81 2.765.616 2123E3D6A8E81647CB41F51AFEE6CCD6 16/10/24/19:23 ?
4.82 2.765.616 64BFA4DBD595A20E317B2189B54BF673 17/08/24/15:42 ?

  ·  Decrypted (elf): changes every firmware version
  ·  Build label: yes, with timestamp, search for -sgpu-sspu-sli4
  ·  Target Firmware: yes repeated one time
  ·  Revision: unknown

ps1_netemu.elf (decrypted)
Firmware Bytes MD5 Timestamp Rev
1.00 ~ 1.50 No
? ? ? ? ?
? ? ? ? ?
? ? ? ? ?
1.90 6.853.368 8A5A3676B461C97A9A467D5651D6EAAD 07/07/21/06:47 ?
? ? ? ? ?
? ? ? ? ?
? ? ? ? ?
3.66 2.971.976 9586FC8B121E59526C31405DCFFB79CA 11/06/16/03:54 ?
3.70 2.972.168 AA1DB63461EE0BE021ED45F85A6EECE0 11/08/05/03:43 same
~ Any
3.72 32F45129EC2844D419582912E54CEB22 11/09/14/01:18
3.73 2.972.168 17063FFAB205B72ABF7F59582B8A7988 11/10/04/12:56 same
3.74 89C03D80ACE7C4FA914DD699621EB4F8 11/10/25/00:40
4.00 2.977.128 DBB8FB62BE3F2064D31332FCB7575DF1 11/11/22/03:19 same
4.01 9E60379FA979B0440C27C6AEE38754AF 11/12/23/01:10
4.10 2.977.208 B3CD41AB8235906AB41D3DA18D04F00E 12/02/05/23:19 same
4.11 4DDF2C3289AD9BEDF0719DBE1BDA971C 12/02/11/07:15
4.15 ? ? ? ?
4.20 2.977.432 363A2D5EE2246E9CEFCBF1078593C771 12/06/15/02:10 same
4.21 5E08C86EC07E4F227D3591DD9530CC95 12/06/30/01:15
4.23 S 2.977.416 149E5E6AD727B1B37E29D4E8D15D5BB0 12/07/31/00:23 ?
4.25 2.977.432 295B61D9EEE704077FEC870C8EAC7D35 12/09/07/07:04 same
? ? ? ? ?
? ? ? ? ?
? ? ? ? ?
4.78 2.913.480 398A7CA9F0E8449E15FCB33B87C96194 15/12/17/01:19 ?
4.80 ? ? ? ?
4.81 2.913.656 8765A00EE467B8635A13ECCBB1F85B89 16/10/24/19:24 ?
4.82 2.913.752 FCEB6595F9F8E5C77BA36C73C38397D9 17/08/24/15:43 ?

  ·  Decrypted (elf): changes every firmware version
  ·  Build label: yes, with timestamp, search for -sgpu-sli4
  ·  Target Firmware: yes repeated two times
  ·  Revision: unknown

ps1_newemu.elf (decrypted)
Firmware Bytes MD5 Timestamp Rev
1.00 ~ 1.90 No
? ? ? ? ?
? ? ? ? ?
? ? ? ? ?
3.66 2.708.864 9AB86CFAEB12675F3DB08FCAA3541534 11/06/16/03:54 ?
3.70 2.708.880 7AB7C32901778E3F0C9B8DB45296821B 11/08/05/03:44 same
~ Any
3.72 2863E9B70B4FB6C5A0938FF508C46057 11/09/14/01:18
3.73 2.708.880 871E256771632569D664FF2A1ECE82C3 11/10/04/12:57 same
3.74 8A8AC80CBA58561CC754C6CF66B059AB 11/10/25/00:40
4.00 2.713.832 F9E840430B2BC982CB1A71B7BDD7FC35 11/11/22/03:19 same
4.01 953090CBCB96626899731B711B3D5B6A 11/12/23/01:11
4.10 2.713.720 47E7FA52DB7BDEDF2187EB02D868834D 12/02/05/23:20 same
4.11 8A90DB2A206BE79423A99D4CF2458241 12/02/11/07:16
4.15 ? ? ? ?
4.20 2.713.904 8AC80356D1EFDDCFF7A7AD82136137D2 12/06/15/02:11 same
4.21 E482927E47B00C1478313E343DD652C4 12/06/30/01:15
4.23 S 2.713.888 A2CF9C4C00B40779FB5C529849E0D6A4 12/07/31/00:24 ?
4.25 2.713.904 24107753F0B02075DAB20492BA67167D 12/09/07/07:05 same
? ? ? ? ?
? ? ? ? ?
? ? ? ? ?
4.78 2.649.144 BF78A0DC74084B43777A7F8CE6C7B66A 15/12/17/01:20 ?
4.80 ? ? ? ?
4.81 2.649.272 0C76DE974439B12546EA494639C8EE9A 16/10/24/19:25 ?
4.82 2.649.288 C5957F268EE9E1429DE3AF0BC15F1395 17/08/24/15:44 ?

  ·  Decrypted (elf): changes every firmware version
  ·  Build label: yes, with timestamp, search for -sgpu-sspu-sli4
  ·  Target Firmware: yes repeated two times
  ·  Revision: unknown

ps1_rom.bin
Firmware Bytes MD5 Rev
1.00 ~ 1.90 No
? ? ? ?
3.66 ~ 3.74 4.089.584 FBB5F59EC332451DEBCCF1E377017237 ?
4.00 ~ 4.82 524.288 81BBE60BA7A3D1CEA1D48C14CBCC647B ?

  ·  Format: Not compiled or encrypted for every firmware
  ·  Build label: unknown
  ·  Revision: unknown


Command IDs mapping

All the PS1 emulators have some game settings hardcoded inside them organized in a table using a hierarchy, pretty much the same structure used by ps2_gxemu.self and ps2_softemu.self to store the CONFIGS
There is a point of the hierarchy where is indicated the number of commands and the offset where are located. Every command is composed by ID[4] and data[4] (where the data coould be another offset to load more data from a deeper level of the hierarchy)
That IDs differs in between the PS1 emulator versions because are not a direct ID, it seems every ID is mapped to a different ID 8probably static and common for all emu versions) in a separated table
In ps1_netemu.self from firmware 4.88 the table seem to be located over here (unknown) 

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

001651E0  00 00 00 01 00 00 00 08 00 00 00 10 00 00 00 09  ................
001651F0  00 00 00 02 00 00 00 03 00 00 00 0A 00 00 00 11  ................
00165200  00 00 00 18 00 00 00 20 00 00 00 19 00 00 00 12  ....... ........
00165210  00 00 00 0B 00 00 00 04 00 00 00 05 00 00 00 0C  ................
00165220  00 00 00 13 00 00 00 1A 00 00 00 21 00 00 00 28  ...........!...(
00165230  00 00 00 30 00 00 00 29 00 00 00 22 00 00 00 1B  ...0...)..."....
00165240  00 00 00 14 00 00 00 0D 00 00 00 06 00 00 00 07  ................
00165250  00 00 00 0E 00 00 00 15 00 00 00 1C 00 00 00 23  ...............#
00165260  00 00 00 2A 00 00 00 31 00 00 00 38 00 00 00 39  ...*...1...8...9
00165270  00 00 00 32 00 00 00 2B 00 00 00 24 00 00 00 1D  ...2...+...$....
00165280  00 00 00 16 00 00 00 0F 00 00 00 17 00 00 00 1E  ................
00165290  00 00 00 25 00 00 00 2C 00 00 00 33 00 00 00 3A  ...%...,...3...:
001652A0  00 00 00 3B 00 00 00 34 00 00 00 2D 00 00 00 26  ...;...4...-...&
001652B0  00 00 00 1F 00 00 00 27 00 00 00 2E 00 00 00 35  .......'.......5
001652C0  00 00 00 3C 00 00 00 3D 00 00 00 36 00 00 00 2F  ...<...=...6.../
001652D0  00 00 00 37 00 00 00 3E 00 00 00 3F 00 00 00 00  ...7...>...?....

001652E0  00 00 07 FF 00 00 07 FF 00 00 07 FF 00 00 07 FF  ...ÿ...ÿ...ÿ...ÿ
001652F0  FF FF F8 00 FF FF F8 00 FF FF F8 00 FF FF F8 00  ÿÿø.ÿÿø.ÿÿø.ÿÿø.

00165300  02 03 12 13 06 07 16 17 0A 0B 1A 1B 0E 0F 1E 1F  ................
00165310  02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 1E 1F  ................

00165320  00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00  ................
00165330  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 12  ................

00165340  00 00 00 7F 00 00 00 7F 00 00 00 7F 00 00 00 7F  ................
00165350  FF FF FF 80 FF FF FF 80 FF FF FF 80 FF FF FF 80  ÿÿÿ€ÿÿÿ€ÿÿÿ€ÿÿÿ€

How hardcoded config is read based on ps1emu.

Like mentioned above config is created from 2x u32 values. Lets call first value command, and second value param.
Command is used to calculate address for param, and only param is stored on obtained address.
Emulator then check for params, and if found (usually when not zero) apply settings based on them.

0x10BC8                 lwz       r0, 0(r9)       # load HASH
0x10BCC                 cmpw      cr7, r0, r27    # compare title HASH with one from DB
0x10BD0                 bne       cr7, loc_10BB8  # loop till HASH found
0x10BD4                 slwi      r0, r10, 4      # config number << 4 to get offset from first entry in table
0x10BD8                 addi      r24, r1, 0xAB0+var_A40
0x10BDC                 extsw     r0, r0
0x10BE0                 clrldi    r3, r24, 32
0x10BE4                 add       r29, r0, r8     # r29 now points to game entry in config table
0x10BE8                 lwz       r4, 4(r29)      # load pointer to game ID
0x10BEC                 bl        sub_137FF8
0x10BF0                 nop
0x10BF4                 lwz       r28, 8(r29)
0x10BF8                 cmpwi     cr7, r28, 0
0x10BFC                 ble       cr7, loc_10C58  # check config count is not 0 or less
0x10C00                 lwz       r26, 0xC(r29)   # r26 is now pointer to configs for game
0x10C04                 li        r30, 0
0x10C08                 li        r29, 0
0x10C0C                 lwz       r25, off_17B5D8 # "core.c: CoreCheckTitle: param[%d] = 0x%"...
0x10C10
0x10C10 read_conf_loop:                           # CODE XREF: CoreCheckTitle+2DC↓j
0x10C10                 add       r11, r30, r26   # r11 is now pointer to currently read config for game
0x10C14                 addi      r29, r29, 1     # count...
0x10C18                 clrldi    r11, r11, 32
0x10C1C                 mr        r3, r25         # just for print
0x10C20                 addi      r30, r30, 8     # add 8 so next time in loop we read new config (4),
0x10C20                                           # and new params (4) if game have more than one config
0x10C24                 lwz       r4, 0(r11)      # load command
0x10C28                 lwz       r0, 4(r11)      # load params
0x10C2C                 slwi      r9, r4, 2       # r9 = r4 << 2 so shift our command to the left by 2, and store in r9
0x10C30                 clrldi    r5, r0, 32      # just print again
0x10C34                 addi      r9, r9, 0x10    # add 0x10 to shifted command value
0x10C34                                           # to create address where param of config will be stored
0x10C38                 extsw     r4, r4
0x10C3C                 extsw     r9, r9
0x10C40                 add       r9, r9, r31     # r31 is value that change between emu versions. 
0x10C40                                           # That way emulator can keep correct config IDs without changes to table.
0x10C40                                           # r31 0x2B0930 + what we currently have in r9 after previous calculations.
0x10C44                 stw       r0, 4(r9)       # Store param on finally calculated address + 4. For example for config 04
0x10C44                                           # address will be 0x2B0954.
0x10C48                 bl        print_
0x10C4C                 nop
0x10C50                 cmpw      cr7, r28, r29   # r28 overall config count
0x10C50                                           # r29 currently read count
0x10C54                 bne       cr7, read_conf_loop

Known ps1emu.self commands

  • 0xB param is magic word for libcrypt, but emulator seems to not use it at all(?).
  • 0xE param is divider for 0x204CC00 (psx cpu speed), result is stored on fixed address and used by many functions.
  • 0x15 when param is set to 3, force game reload with ps1netemu. Is not known what other param values do.
  • 0x19 is related to cdrom, xCdromRead use it as first argument.
Retrieved from "http://www.psdevwiki.com/ps3/index.php?title=Talk:PS1_Emulation&oldid=64042"