PS2 Emulation
Jump to navigation
Jump to search
Description
PlayStation 2 emulation on the PlayStaion 4 is handled with little difference to the PlayStation 3, But still many issues that the PlayStation 3 faced have moved into the PlayStation 4 along with many new issues.
The fact of the matter is that the PS4 is too weak for emulation, For that reason alone, Sony had to sacrifice accuracy in order to gain performance, but the PS4's emu has more accuracy than PCSX2 in terms of GS since all emulation is done on the cpu, As for the other parts, PCSX2 is much better at emulating it, For instance PCSX2 syncs VU0 extremely well; the PS4 doesn't, and it's because it doesn't have the horsepower to do that, and that has to lead to games like Rayman 3 being unplayable without overclocking the EE at a specific offset.
Each PS2 game PS4 package file (.pkg) includes the emulator itself, there is no included emulator in the PS4 firmware. although The PS4 firmware has some PS2 emulator specific features, like the functions sceLncUtilIsPs2Emu, sceShellCoreUtilGetImposeMenuFlagForPs2Emu, sceSystemServiceAddLocalProcessForPs2Emu, or sceSystemServiceShowImposeMenuForPs2Emu.
Emulators are programmed to be accurate for the games that they were extracted from, and that alone provides a challenge for accurate emulation. since emulators include per title patches, and different default settings, and since the Playstation 2 hardware is known to be one of the most complex systems to emulate, any small change in configuration can have negative consequences in games.
Currently the most used emulator is Jakv2 since it is the most compatible, but for game crashes we use RECVX, and for VU accuracy we use roguev1.
Also note that the BIOS itself is included in the game's pkg and it is the exact same BIOS that was used in the ps2_netemu. Another important thing is the lack of encryption mechanism for PS2 game disc image file, this time it is just a plain ISO file, but the emulator still supports LIMG sector that allows the usage of non-2048 sector size discs. Memory card is also decrypted, but the emulator checks the crc of some of the regions to ensure that the memory card was Not modified. the PS2 Emulator supports LUA scripting by "Lua Bridge", and it is an extremely powerful interface that provide many possibilities to improve compatibility.
This is first time that Sony really cared about floats in their emulator. Compared to the PS3 CPU, x86-64 is doing a worse job in mimicing PS2 FPU, and VU floats calculation behavior. This is resolved by clamping, accurate math used per memory offset, and/or converting floats to double precision. the emulator uses openCL for GS, and probably other components.
Emulator Configuration
Files
Emulator configuration is handled by 4 files:
- config-emu-ps4.txt - Stores paths, basic video/audio settings in official packages. But unofficially can be also used for advanced settings for global effect in multi disc .pkg with all commands originally used in cli.conf file.
- XXXX-YYYYY_cli.conf - Stores per disc advanced settings. GS, VU, EE, IOP, FPU, COP2 emulation settings, are here. Also hacks, and hooks.
- XXXX-YYYYY_config.lua - Used for per disc advanced scripts. Patching EE/IOP memory, Conditional hooks.
- disc-swap-cli.conf - Stores info of multi disc games.
Commands
Known functions: Require cleanup.
The rest of the cli and lua commands can all be found inside of an emu's decrypted eboot.bin.
config-emu-ps4.txt commands
| Command | Values | Notes | Usage |
|---|---|---|---|
| Misc | |||
| --config-local-lua | --config-local-lua="" | ||
| --load-tooling-lua | --load-tooling-lua=0 | ||
| --max-console-spam | |||
| --path-snaps | dir/folder | Path to savestates folder | --path-snaps="/tmp/snapshots" |
| --path-recordings | dir/folder | --path-recordings="/tmp/recordings" | |
| --path-memcards | dir/folder | ||
| --path-vmc | dir/folder | --path-vmc="/tmp/vmc" | |
| --emulog-file | 0, 1 | Creates a log file with information that is Rarely useful | --emulog-file=1 |
| --path-emulog | dir/folder | Sets the directory of the emulog file, Requires --emulog-file=1 command | --path-emulog="/tmp/recordings" |
| --path-manual | dir/folder | ||
| --path-patches | dir/folder | Path to patches folder | --path-patches="/app0/patches" |
| --path-trophydata | dir/folder | --path-trophydata="/app0/trophy_data" | |
| --path-featuredata | dir/folder | Path to folder with XXXX-YYYYY_features.lua file | --path-featuredata="/app0/feature_data" |
| --path-postproc | dir/folder | Post-processing (shaders?) | |
| --path-toolingscript | dir/folder | --path-toolingscript="/app0/patches" | |
| --snapshot-name | |||
| --snapshot-datafile | |||
| --snapshot-restore | |||
| --snapshot-save | frameId(?) | ||
| --snapshot-mcd-files | |||
| --snapshot-repeat | repeat_count | ||
| --snapshot-modulo | |||
| --host-keyboard | slot [0-7] | --host-keyboard=4 | |
| --host-window-scale | scale/float | --host-window-scale=0.5 | |
| --host-window-pos | x,y | ||
| --host-display-mode | normal,full,4:3,16:9 | Set display mode | --host-display-mode=full |
| --host-graph | fps | Debug option that requires an unleaked debug ps2 bios | --host-graph=fps |
| --host-osd | verbose, minimal | --host-osd=0 | |
| --host-vsync | 0, 1 | Enable or disable vsync | --host-vsync=1 |
| --host-trophy-support | |||
| --rtc-epoch | unix_time (seconds since epoch) | --rtc-epoch=1523776362 | |
| --framelimiter | 0, 1 | Enable or disable Frame limiting | --framelimiter=1 |
| --framelimit-fps | FPS/float | framelimiter | --framelimit-fps=0.8 |
| --framelimit-scalar | scalar/float | scalar must be between 0.1 and 5.0 | --framelimit-scalar=3.2 |
| --framelimit-mode | slowest,slower,slow,normal,fast,fastest,turbo | A Standalone framelimiter | --framelimit-mode=fast |
| --ps2-lang | system | sets language, Might seem like a useless command, but a Tiny number of games refuse to boot without a selected language. | --ps2-lang=system |
| --ps2-title-id | XXXX-YYYYY Example: (SLUS-21515) | Sets title-id for patches, Requires the game's region code as value | --ps2-title-id=SLES-50366 |
| --gs-uprender | none, 2x2 | Internal resolution upscaler. | --gs-uprender=2x2 |
| --gs-upscale | none, gpu, edgesmooth, motionvec, point, motionvector, smooth, motion | upscaling type | --gs-upscale=EdgeSmooth |
| CDVD | |||
| --max-disc-num | 1-5 | numbers of discs in package (maximum=5) | --max-disc-num=1 |
| --boot-disc-id | 1-5 | sets boot disc for multi-disc pkg | --boot-disc-id=0 |
| --switch-disc-reset | 1 = Enables resetting the game upon disc swap 0 = Disables resetting the game upon disc swap |
0 Can be used to prevent Resetting the game when switching multiple discs, useful for games like Samurai warriors 2 that have Import data Feature, Sadly this command isn't supported by many emulators, but jakv2 is confirmed to support it |
--switch-disc-reset=1 |
| --cdvd-sector-read-cycles | 0.1 = Fastest, 80000 = Slowest |
Set DVD reading speed, higher values are slower, lower values are faster, Kinetica uses 40000, Psychonauts 4000, Red dead revolver 5000, Rise of kasai 31000, some games require moderate speed, too slow or too fast could cause audio problems. |
--cdvd-sector-read-cycles=40000 |
| --cdvd-sector-seek-cycles | 0.1 = Fastest, 80000 = Slowest |
Set the speed at which the emulated CDVD spins, higher values are slower, lower values are faster, fixes boot-up sometimes.More info here [1]. |
--cdvd-sector-seek-cycles=1 |
| --verbose-cdvd-reads | 0, 1 | Might improve disc reading if set to 1 | --verbose-cdvd-reads=0 |
| Audio | |||
| --host-audio-latency | msec/float | Audio latency must be between 0.010 and 4.0 | --host-audio-latency=1.5 |
| --path-audio-images | dir/folder | ||
| --record-audio | |||
| --record-audio-img | |||
| --record-audio-image | |||
| --record-audio-ext | |||
| --host-audio | 1,0,on,off,mono | --host-audio=1 | |
| --mute-audio | all,none,main,bgm | --mute-audio=all | |
| --mute-streaming-audio | all,none,main,bgm | --mute-streaming-audio=all | |
| Controllers | |||
| --ds4-deadzone-adjust | |||
| --ds4-diagonal-adjust | |||
| --host-pad-loses-focus | --host-pad-loses-focus=1 | ||
| --host-gamepads | 0, 1 | This command might have a function if multitap is set to byhost | --host-gamepads=1 |
| --pad-record | 0, 1 | Enables Logging pad info in emulog | |
| --pad-analog-to-digital | 0, 1 | Eternel ring Emu uses the value 0 | --pad-analog-to-digital=0 |
| --mtap1 | Disabled, Always, ByHost | Multitap switch, The values are correct but the multitap only works in certain games. | --mtap1=always |
| --mtap2 | Disabled, Always, ByHost | Multitap switch, some games require multitap to be selected only on second port (1, 2-a, 2-b, 2-c layout). To achieve that we need to disable first mtap. | --mtap2=always |
XXXX-YYYYY_cli.conf commands
Please note that commands listed here also work in config-emu-ps4.txt. But the official way to use them is by CLI file. The CLI file way is also needed for multi-disc packages, Some of the Commands are still not discovered, And some known commands are missing some of their values Due to them being not Discovered. The scene has named "CLI" with 3 names, including TXT, CLI, CONF. all 3 are the exact same thing.
All CLI commands are pre-made by sony, We sadly cannot create CLI commands out of thin air. The values of the commands are also pre-defined by sony and /or have a quota for possible values/ranges. Some CLI commands have no effect, and were added into the eboot.bin without being programmed by sony. and some useful commands were removed/added from different emu revisions. or their effects were changed.
CLI commands use SCE modules to change default emulator settings. for instance --cdvd-sector-seek-cycles is actually sceCdStSeek, but is still unclear how to use SCE modules in a lua
EE
Commands for the emulated Emotion Engine. these commands may assist you in gaining performance or better sync.
| Command | Values | Notes | Usage |
|---|---|---|---|
| Speedhacks | |||
| --ee-cycle-scalar | [Overclocking] (0.99 => 0.1) [Underclocking] (1.1 => 5.0) |
If set Higher than 1.0 the Emotion engine Begins skipping cycles, you might face Problems in FMVs if you skip too many cycles. but you will gain a better performance |
--ee-cycle-scalar=1.0 |
| --ee-context-switch-cycles | [Overclocking(?)] (0.99 => 0.1) [Cycle skipping(?)] (1.1 => ∞ ) |
It's still unknown what this command controls, but the higher it is, the more EE cycles are skipped, Doesn't work for jak emulators. |
--ee-context-switch-cycles=2700? |
| --ee-hook | AdvanceClock FastForwardClock Mfifodrain |
Hook a function to a EE offset. it can be used either as a speedhack or to improve sync, FastForwardClock seems to overclock ee at the specified offset, AdvanceClock will do the opposite, FastForwardClock does not need a value to be set, AdvanceClock does. |
--ee-hook=0x0028A7B0,AdvanceClock,,500 Example for usage: --ee-hook=offset,function,optional opcode,value for advanceclock only |
| Game fixes | |||
| --ee-jit-pagefault-threshold | 0-254 | Reduces the occurrence of crashes the higher it is, only accepts 1 byte values with 254 being the limit | --ee-jit-pagefault-threshold=40 |
| --ee-block-validation | PageProt, PageProtection, Hash, Full, none | way of validating that block been modified, and require recompilation. [Some info about PageProt way] | --ee-block-validation=None |
| --ee-shorthash-len | inst_count/integer | Length of shorthash in instruction/opcode count. Require --ee-block-validation=Hash | |
| --ee-const-folding | None,Gpr,Fpu,All | EE constant folding, All seems to be the default option, fpu will prevent game from starting for some reason | --ee-const-folding=none |
| --ee-ignore-segfault | none, read, write, readwrite | Ignore segmentation fault, may help with crashes but will probably cause graphical issues | --ee-ignore-segfault=readwrite |
| --ee-native-function | memcpy memset |
Seems to be a command that slows down offsets that use memset and memcpy to move data to VU1. Check redfaction's config for more details. |
--ee-native-function=memcpy,0x11e328 |
| Other | |||
| --ee-jit-disasm | 0 or 1 for mips and 2 for x86 | Emotion engine Just in Time disassembler mode (seems to be debug log option) | --ee-jit-disasm=1 |
| --ee-ignore-break | 0, 1 | Ignore Break instructions. | |
| --ee-break-as-nop | 0, 1 | Turns a break instruction into a nop Instruction (this seems to be rarely useful as Break usually mean eof) | --ee-break-as-nop=1 |
| --ee-jit-opt-debug | 0, 1 | ||
| --ee-pc-coherency | 0, 1 | A debug option that changes the latency of the program counter | |
| --ee-insn-flush-pc | 0, 1 | A debug option that changes the latency of the program counter | |
| --ee-inst-marking | 0,1? | ||
| --ee-insn-marking | 0,1? | ||
| --ee-kernel-hle | 0, 1 | High-level emulation kernel | |
| --ee-injection-kernel | 0, 1 | ||
| --ee-injection-title | 0, 1 | ||
| --ee-validate-kernel | 0, 1 | ||
| --ee-regalloc-scalar | 0,none,ReadOnly,WriteOnly,RW | register allocation setting | |
| --ee-regalloc-simd | readwrite, writeonly, readonly | register allocation setting | |
| --ee-regalloc-preserve-scalar | LoadOnly, LO, StoreOnly, SO, LoadStore, LS | EE JIT Scalar/Int Regalloc Mode | --ee-regalloc-preserve-scalar=LoadStore |
| --ee-regalloc-preserve-simd | ReadOnly, RO, WriteOnly WO, RW | EE JIT SIMD/XMM Regalloc Mode | --ee-regalloc-preserve-simd=RW |
| --ee-static-block-links | options Type,Type,... [Branch,Branches,JAL,COP2,All] | --ee-static-block-links=JAL,COP2 | |
| --vtune-ee | Could be support for intel vtune, Might be related to this | ||
| --ee-live32 | 0,1? | ||
| --ee-cache-breaks-block | 0,1? | ||
| --ee-evt-check-full | 0, 1 | ||
| --ee-peephole | 0, 1? | Use peephole optimization for the EE (?) could possibly be a speedhack | |
| --ee-load-rewrites | 0,1? | ||
| --ee-store-rewrites | 0,1? | ||
| --ee-precompile-trace | |||
| --ee-penalize-short-blocks | 0, 1 | ||
| --ee-mem-check-eob | EE memory check end of block | ||
| --ee-insn-callmark | |||
| --ee-inline-limit-full | insn_count/integer | ||
| --ee-inline-limit-partial | |||
| --ee-stlf-cycle-threshold | ? | ? | |
| --detect-idle-ee | 0, 1 | Enabled by default, Uknown what it does | --detect-idle-ee=1 |
FPU
The FPU is a fast single-precision unit that serves the EE. It's also called (COP1).
| Command | Values | Notes | Usage |
|---|---|---|---|
| Game fixes | |||
| --fpu-no-clamping | 1 = Enables clamping 0 = Disables clamping |
Setting it to 1 enables clamping for the FPU, Can be used to fix any game with FPU clamping issues, More here | --fpu-no-clamping=0 |
| --fpu-custom-min-max | 0, 1 | Custom Max/Mini logic for denormals, enabled by default, Disabling it might break some games |
--fpu-custom-min-max=0 |
| --fpu-accurate-range | start,end offset (0x0 - 0x1FFFFFF) | Accurate Mul/Div/Add/Sub Math instructions for the FPU by using software floats rather than hardware floats, used for full ee/fpu accuracy in specified range | --fpu-accurate-range=0x1acce0,0x2acce0 |
| --fpu-no-clamp-range | start,end offset (0x0 - 0x1FFFFFF) | Full clamping for fpu in selected memory range | --fpu-no-clamp-range=0x1acce0,0x2acce0 |
| --fpu-accurate-muldiv | 0 = Disabled 1 = Enabled |
Enable Accurate fpu divide/multiply by 0 for all offsets by using software floats rather than hardware floats | --fpu-accurate-muldiv=1 |
| --fpu-accurate-addsub | 0 = Disabled 1 = Enabled |
Enable Accurate fpu Add/Subtract instructions for all offsets by using software floats rather than hardware floats | --fpu-accurate-addsub=1 |
| --fpjk-muldiv-range | offset (0x0 - 0x1FFFFFF) | Bully uses this command, unknown usage, possibly even more accurate divide/multiply | --fpjk-muldiv-range=0x123456 |
| --fpu-accurate-muldiv-range | start,end offset (0x0 - 0x1FFFFFF) | Fix for games that divide/multiply by 0 in specified range by using software floats rather than hardware floats | --fpu-accurate-muldiv-range=0x1acce0,0x2acce0 |
| --fpu-accurate-addsub-range | start,end offset (0x0 - 0x1FFFFFF) | Accurate fpu Add/Subtract instructions in specified address range by using software floats rather than hardware floats | --fpu-accurate-addsub-range=0x1acce0,0x2acce0 |
| Speedhacks | |||
| --fpu-rsqrt-fast-estimate | 0, 1 | less accurate rsqrt possible speedhack, but can degrade accuracy, enabled by default, disable it to increase fpu accuracy | --fpu-rsqrt-fast-estimate=1 |
| --fpu-accurate-mul-fast | 0, 1 | A speed up option for --fpu-accurate-muldiv-range And only has an effect when muldiv command is being used. | --fpu-accurate-mul-fast=1 |
| Other | |||
| --fpu-custom-fused-madd | 0, 1 | Custom FMA (fused multiply-add), Disabled by default |
--fpu-custom-fused-madd=0 |
| --fpu-to-double | 0, 1 | Converts floats to double, enabling it while clamping is enabled will result in Full FPU clamping |
|
| --fpu-clamp-operands | 0, 1 | A clamping setting that is supposed to increase the fpu's clamping functionality when FPU clamping is enabled, but no difference is noticed for currently unknown reasons, Sony never used it in any official config, therefore no one is really sure of it's correct usage |
--fpu-clamp-operands=1 |
| --fpu-clamp-results | 0, 1 | A clamping setting that is supposed to increase the fpu's clamping functionality when FPU clamping is enabled, but no difference is noticed for currently unknown reasons, Sony never used it in any official config, therefore no one is really sure of it's correct usage |
--fpu-clamp-results=1 |
VIF
Decompresses vector data, uploads microprograms to the VUs, and sends graphical data to the GIF, VIF CLI commands are mostly used for fixing games that freeze.
| Command | Values | Notes | Usage |
|---|---|---|---|
| VIF | Game fixes | ||
| --vif-ignore-invalid-cmd | 0, 1 | Ignore invalid vif commands, can in some cases fix games that freeze while showing the same frame when set to 1 |
--vif-ignore-invalid-cmd=1 |
| --vif-thread-chunk-size | 1, 1000 | Can be used to fix freezing in some extreme cases. 1024 seems to be the limit, Integer values only. | --vif-thread-chunk-size=100 |
| --detect-idle-vif | 0, 1 | Enabled by default. Most likely turns off VIF when it's not needed when set to 0 | --detect-idle-vif=0 |
| VIF1 | Game fixes | ||
| --vif1-ignore-cmd-ints | 0, 1 | ignore cmd ints, can in some cases fix games that freeze while showing the same frame when set to 1 Games likes "Men in Black II - Alien Escape" and "Test Drive Unlimited" need it to be set to 1 to work |
--vif1-ignore-cmd-ints=1 |
| --vif1-instant-xfer | 1 = Instant transfers 0 = Delayed transfers |
Allows you to change VIF1 timing, 1 is the default one, but 0 is much more correct and recommended, can be used to fix graphical glitches or to prevent the game from freezing when set to 0. |
--vif1-instant-xfer=0 |
GS
GS stands for Graphics Synthesizer PlayStation®2 co-processor responsible for rendering the graphics (but is also used by some games for additional calculations and other purposes) The gs settings are rarely useful since the all rendering is done by software rather than hardware, meaning there will be much less graphical glitches than PCSX2's Hardware renderer, but sometimes autoflush and upscaling fixes will be necessary.
| Command | Values | Notes | Usage |
|---|---|---|---|
| Speedhacks | |||
| --gs-optimize-30fps | 0, 1 | Speedhack for gpu hungry games | --gs-optimize-30fps=1 |
| --gs-adaptive-frameskip | 0, 1 | Speedhack, skips frames when the Game starts demanding more resources than there are available. doesn't work on all emulators. confirmed to be working on jak emulators | --gs-adaptive-frameskip=1 |
| --gs-render-tile-threshold | 0, 3000000 | Sony uses it for Psychonauts, could be a potential speedhack for the GS |
--gs-render-tile-threshold=300000 |
| --threaded-gs | 0, 1 | Multi-threaded-gs ? unknown if it holds any performance benefits | --threaded-gs=1 |
| Gs settings / Behaviour | |||
| --gs-use-deferred-l2h | 0, 1 | Some delay option for L2H (local to host, GS to EE). |
--gs-use-deferred-l2h=1 |
| --gs-uprender | none,2x2 | Internal resolution upscaler. | --gs-uprender=2x2 |
| --gs-upscale | none, gpu, edgesmooth, smooth, motion, motionvec, motionvector, point | Upscaling type Selector | --gs-upscale=EdgeSmooth |
| --gs-kernel-cl-up | "DarkCloud2" "h2lpool2x2", "OptRightTri", "clutmerge2x2", "mipmap2x2", "up2x2simple", "up2x2skipinterp", "up2x2tc", "up2x2", default | Kernel Variant Color lookup Upscaler (?), Mipmap and clutmerge and h2l will have to be enabled first before using their options |
--gs-kernel-cl-up="clutmerge2x2" |
| --gs-override-small-tri-area | 0, 1 | Enabling it might fix missing text. | --gs-override-small-tri-area=1 |
| --gs-dirty-page-policy | 0, 1 | --gs-dirty-page-policy=1 | |
| --gs-ignore-dirty-page-border | 0, 1 | Could potentially help with lines on the edge of the screen (??) | --gs-ignore-dirty-page-border=1 |
| --gs-ignore-rect-correction | 0, 1 | --gs-ignore-rect-correction=1 | |
| --gs-opt-frbuff-switch | 0, 1 | --gs-opt-frbuff-switch=0 | |
| --gs-kernel-cl | h2lpool, clutmerge, mipmap, DarkCloud2, fantavision, Mipmap and clutmerge and h2l will have to be enabled first before using their options |
Kernel Variant Color lookup(?), you can upscale any option here if you use --gs-kernel-cl-up with it |
--gs-kernel-cl="clutmerge" |
| --force-frame-blend | 0, 1 | Fix for shaking screens (Deinterlacing), seems to be one of Pcsx2's Blend tff or Blend bff deinterlacing options | --force-frame-blend=1 |
| --force-pal-60hz | 0, 1 | Force 60hz PAL mode, it is recommended to use it on Pal games as it can fix graphical corruptions |
--force-pal-60hz=1 |
| --gs-use-clut-merge | 0, 1 | CLUT = Color lookup table, it could possibly solve graphical issues or improve the quality of the colors. it is Required for CL kernels using merging CLUT | --gs-use-clut-merge=1 |
| --gs-use-mipmap | 0, 1 | Mipmapping enabler/disabler, Can be used to fix graphics sometimes. |
--gs-use-mipmap=1 |
| --gs-progressive | 0, 1 | Force progressive scan, it's used to fix Graphical glitches/double screen issues when used | |
| --gs-vert-precision | 8, 16 | 3D Rendering vertex precision, the eboot expects the value of 8 or 16 , any other value will cause a blue screen crash. | --gs-vert-precision=8 |
| --gs-force-bilinear | 0, 1 | force bilinear filtering. Can fix ghosting problems. but it's not recommended in games that use 2D images | --gs-force-bilinear=1 |
| --gs-skip-dirty-flush-on-mipmap | 0, 1 | Skip flushing the texture cache when mipmap settings change (?) Require mipmap GS CL kernel | --gs-skip-dirty-flush-on-mipmap=1 |
| --gs-packed15-fmv-opt | 0, 1 | --gs-packed15-fmv-opt=1 | |
| --gs-fieldswap-delay | 0, 254 | Wait longer than usual to change field, reduces Sharpness | |
| --gs-uv-shift-pointsampling | 0, 1 | Can be used with games like manhunt that have issues with UV light | --gs-uv-shift-pointsampling=1 |
| --gs-aspect-ratio | aspect/float (default=0.81) | --gs-aspect-ratio=0.65 | |
| --gs-frontend-opt-mode | 0, 1, 2 | Seems to be an optimization for the gs with 1 being safe and 2 being unstable but with good performance | --gs-frontend-opt-mode=1 |
| --gs-motion-factor | 25, 50 | --gs-motion-factor=25 | |
| --gs-scanout-delay | 0, 200 | --gs-scanout-delay=200 | |
| --gs-scanout-offsetx | relative offset/ignored | Directly overwrite GS register? | --gs-scanout-offsetx=27 |
| --gs-scanout-offsety | relative offset/ignored | Directly overwrite GS register? | --gs-scanout-offsety=27 |
| --gs-flush-ad-xyz | always, safe, safeZwrite, off, 0 | Force a primitive flush when a framebuffer is also an input texture, fixes some processing effects but it's very heavy on the GS and will cost you performance, GTA: SA and Jak games need this command. | --gs-flush-ad-xyz=safe |
| --gs-check-trans-rejection | 0, 1 | Check transfer rejection ? | --gs-check-trans-rejection=1 |
| --gs-check-trans-rejection68 | 0, 1 | --gs-check-trans-rejection68=1 | |
| --safe-area-min | area/float (range 0.9 to 1.0) any other values outside of that range will not be accepted by the emulator | --safe-area-min=0.9 | |
| --l2h-2d-params | TRXREG,BITBLTBUF,height | --l2h-2d-params=0x0000000800000001,0x000000003a0a2300,512,2 | |
| --gs-h2l-accurate-hash | 0, 1 | Used with h2l Upscaler | --gs-h2l-accurate-hash=1 |
| --gs-h2l-list-opt | 0, 1 | Used with h2l Upscaler | --gs-h2l-list-opt=1 |
| Other | |||
| --framelimit-mode | slowest,slower,slow,normal,fast,fastest,turbo | a Standalone Framelimiter | --framelimit-mode=fast |
| --gs-hdr-support | 0, 1? | Enable hdr support ? |
VU
Custom DSPs used to process vertex data, physics calculations, and other related tasks. Settings found here affect VU1 & VU0 & COP2
| Command | Values | Notes | Usage |
|---|---|---|---|
| Graphical fixes | |||
| --vu-xgkick-delay | Limit is between (0 => 31) |
Delay xgkick instruction execution, PCSX2 uses 6 cycles, PS3 uses 2-8 cycles depending on the game, Can be used to either cause or repair missing graphics, 0 is the most compatible |
--vu-xgkick-delay=8 |
| --vu-custom-min-max | 0, 1 | Custom Max/Mini logic for denormals, Disabled on pcsx2 by default. But enabled by default on some emus like jakv2, Disabling it might cause/repair missing graphics, Setting it to 0 managed to fix missing graphics in Auto Modellista, and would probably fix many games with a similar problem |
--vu-custom-min-max=0 |
| Game fixes | |||
| --vu-hack-triace | 0, 1 | Special hack for games that were Developed by Tri Ace, correct VU addi calculation. Without it result is one bit off, which is enough to break game decryption algo, and thus crashing the game. | --vu-hack-triace=1 |
| --vu-branch-hazard | 0, 1 | Disabling it managed to prevent Batman - Rise of Sin Tzu from Crashing | --vu-branch-hazard=0 |
| --vu-evil-branches | 0, 1 | Take in count branch in delay slot, or not. More Info | |
| --vu-to-double | 0, 1 | Converts floats to double, enabling it while clamping is also enabled will results in Full VU clamping |
|
| --vu-custom-fused-madd | 0, 1 | Custom FMA (fused multiply-add), Disabled by default |
--vu-custom-fused-madd=1 |
| Speedhacks | |||
| --vu-opt-sf-check | 0, 1 | Updates status flags only on blocks which will read them, known in pcsx2 as mVU flag hack (Speedhack), Won't work with most emulators, confirmed to be supported by Arc Twilight of the Spirits™ | --vu-opt-sf-check=1 |
| --vu-opt-jr-caching | 0, 1 | Optimize Jump Register caching. (vi15). Won't work with most emulators, confirmed to be supported by Arc Twilight of the Spirits™ | --vu-opt-jr-caching=1 |
| Other | |||
| --vu-d-bit | 0, 1 | Debug break. Halts the VU and sends an interrupt to the EE. | --vu-d-bit=0 |
| --vu-t-bit | 0, 1 | Debug halt. Acts similarly to D-bit | --vu-t-bit=0 |
| --vu-inst-mflag | 0, 1 | instant mac flag, enabled by default |
--vu-inst-mflag=1 |
| --vu-inst-cflag | 0, 1 | instant clip flag enabled by default |
--vu-inst-cflag=1 |
| --vtune-vu | ? | ? | |
| --vu-jit-disasm | 0, 1, 2 | VU Just-in-time Dissassembler? Seems to be a debug option, both 0 and 1 are mips, 2 is x86 | --vu-jit-disasm=1 |
| --vu-range-merge | vu_inst_cnt | ? |
VU1
VU1 is the GS’s alternate processing unit, Commands here can possibly improve performance, Prevent crashes, and resolve SPS issues.
| Command | Values | Notes | Usage |
|---|---|---|---|
| Speedhacks | |||
| --vu1-mpg-cycles | 0.1 = Slowest 100 = Default 1000 = 30 FPS |
Set initial speed for VU1 Micro-programs, 100 is default value, Increase the value for better VU1 performance, With no downsides to FMVs, or reduce it to potentially resolve sps issues in rare cases such as tony hawk games or star wars battlefront 2 or auto modellista, There are no limitations to how high of a value you can add, only how low, you can set the value more than 1000 though it's not recommended. sometimes increasing this value can help games that require MTVU to be disabled |
--vu1-mpg-cycles=1000 |
| --vu1-di-bits | 0, 1 | 0 to skip setting Invalid, and Div by zero flags in status register. Can be used as speedhack as it skips costly calculations, but at the same time can cause issues like broken geometry. however, it has never been found to cause any issues as of yet. | --vu1-di-bits=0 |
| --vu1-const-prop | 0, 1 | The constant propagation speedhack is enabled by default. 1 will enable the speedhack and thus improve performance, and 0 will disable it and cause performance issues.More info | --vu1-const-prop=1 |
| --vu1-opt-flags | 0, 1, 2 | Optimize flags instances when do VU recompilation (1 is safe, 2 update sticky, and mac flag on every status flag update) More Info | --vu1-opt-flags=0 |
| --vu1-opt-vf00 | 0, 1, 2 | Optimization for the vf00 register. Setting it to 1 is safe but setting it to 2 is highly unstable. | --vu1-opt-vf00=2 |
| --vu1-jr-cache-policy | newprog, sameprog, auto, new, same | PCSX2 uses newprog as default setting.Info | --vu1-jr-cache-policy=sameprog |
| --vu1-jalr-cache-policy | newprog, sameprog, auto, new, same | PCSX2 uses newprog as default setting.Info | --vu1-jalr-cache-policy=sameprog |
| Game fixes / Graphical fixes | |||
| --vu1 | jit-sync, jit, trans, jit-async | Selector between IR/JIT and it modes, jit-sync works similarly to disabling MTVU, but for some reason can sometimes cause massive graphical issues in some games. as for the options jit, trans, jit-async, it's still unknown if they have any effect |
--vu1=jit-sync |
| --vu1-no-clamping | 1 = Enables clamping 0 = Disables clamping |
Can be used to fix graphical glitches, Some emulators like roguev1 or KOF2000 prefer clamping to be turned off. |
--vu1-no-clamping=0 |
| --vu1-clamp-range | vu1 memory offset start,end (0x0 - 0x3FF) | Values must be 2 bytes or lower and should not exceed 0x0800 | |
| --vu1-accurate-addsub-range | vu1 memory offset start,end (0x0 - 0x3FF) | Accurate VU1 Add/Subtract Instructions in specified Address Range by using software floats rather than hardware floats, Values must be 2 bytes or lower and should not exceed 0x0800 | --vu1-accurate-addsub-range=0x0000,0x0600 |
| --vu1-mul0fix-range | vu1 memory offset start,end (0x0 - 0x3FF) | Enables VU1 to accurately multiply by 0 in specified range | --vu1-mul0fix-range=0x123,0x123 |
| --vu1-injection | 0, 1 | unknown |
--vu1-injection=1 |
| --vu1-native-patch | 0, 1 | Use native patches from recompiler, not compatible with jak emus, Could be VU1 round mode since sony uses it for their official release of Primal, and Primal is known to require that mode to work correctly. |
--vu1-native-patch=1 |
| Other | |||
| --vu1-inst-p | 0, 1 | instant P, no stalling on WAITP, or instances of P | --vu1-inst-p=1 |
| --vu1-use-rcp | 0, 1 | Use sse rcp, Disabled by default |
|
| --vu1-use-rsqrt | 0, 1 | Use sse rsqrt, Enabeled by default |
|
| --vu1-clamp-operands | 0, 1 | A clamping setting that is supposed to increase the vu1's clamping functionality when vu1 clamping is enabled, but no difference is noticed for currently unknown reasons, Sony never used it in any official config, therefore no one is really sure of it's correct usage |
--vu1-clamp-operands=1 |
| --vu1-clamp-results | 0, 1 | A clamping setting that is supposed to increase the vu1's clamping functionality when vu1 clamping is enabled, but no difference is noticed for currently unknown reasons, Sony never used it in any official config, therefore no one is really sure of it's correct usage |
--vu1-clamp-results=1 |
| --vu1-inst-q | 0, 1 | Can fix or cause SPS depending on game. instant Q, no stalling on WAITQ, or instances of Q, it's recommended for advanced users only since over 90% of the time this command will not be needed |
--vu1-inst-q=1 |
| --assert-path1-ad | 0, 1 | Path 1 is how the GIF takes data from VU1 via XGKICK instruction. It's unknown what this command does but it's related to VU1 | --assert-path1-ad=1 |
VU0
VU0 is the EE’s alternate processing unit , it is also called "micro-mode"
| Command | Values | Notes | Usage |
|---|---|---|---|
| Speedhacks | |||
| --vu0-mpg-cycles | 0.1 = Slowest 100 = Default 1000 = Fast |
Set cycle speed for VU0 Micro-programs, 100 is default value, increase the value for better VU0 performance though it won't improve performance as much as vu1, There are no limitations to the values, you can set the value more than 1000 though it's not recommended |
--vu0-mpg-cycles=1000 |
| --vu0-di-bits | 0, 1 | 0 to skip setting Invalid, and Div by zero flags in status register. Can be used as speedhack as it skips costly calculations, but at the same time can cause issues like broken geometry, and weird physics behavior. Depending per game. | --vu0-di-bits=0 |
| --vu0-const-prop | 0, 1 | Constant propagation, can Be used as speedhack for VU0 hungry games when set to 1 More info | --vu0-const-prop=1 |
| --vu0-opt-vf00 | 0, 1, 2 | Optimization for the vf00 register. Setting it to 1 is safe but setting it to 2 is highly unstable. | --vu0-opt-vf00=1 |
| --vu0-opt-flags | 0, 1, 2 | Optimize flags when do VU recompilation (1 is safe, 2 update sticky, and mac flag on every status flag update) More Info | --vu0-opt-flags=1 |
| --vu0-jr-cache-policy | newprog, sameprog, auto, new, same | PCSX2 use newprog as default setting Info | --vu0-jr-cache-policy=sameprog |
| --vu0-jalr-cache-policy | newprog, sameprog, auto, new, same | PCSX2 use newprog as default setting Info | --vu0-jalr-cache-policy=sameprog |
| Game fixes | |||
| --vu0-clamp-range | start, end offset (0x0 - 0xA000) | per range clamping for VU0 | --vu0-clamp-range=0x100,0x120 |
| --vu0-no-clamping | 1 = Enables clamping 0 = Disables clamping |
Can be used to fix graphical glitches, Some emulators like roguev1 or KOF2000 prefer clamping to be turned off. |
--vu0-no-clamping=0 |
| --vu0-accurate-addsub-range | offset (0x0 - 0xA000) | Accurate VU0 Add/Subtract Instructions in specified Address range by using software floats rather than hardware floats | |
| --vu0-mul0fix-range | vu0 memory offset start,end (0x0 - 0xA000) | Fix for games that multiply by zero | |
| Other | |||
| --vu0-injection | 0, 1 | Uknown usage. | --vu0-injection=1 |
| --vu0-inst-q | 0, 1 | instant Q, no stalling on WAITQ, or instances of Q | --vu0-inst-q=1 |
| --vu0-inst-p | 0, 1 | instant P, not stalling on WAITP, or instances of P | --vu0-inst-p=1 |
| --vu0-use-rcp | 0, 1 | use sse rcp | --vu0-use-rcp=1 |
| --vu0-use-rsqrt | 0, 1 | use sse rsqrt | --vu0-use-rsqrt=1 |
| --vu0-clamp-operands | 0, 1 | A clamping setting that is supposed to increase the vu0's clamping functionality when vu0 clamping is enabled, but no difference is noticed for currently unknown reasons, Sony never used it in any official config, therefore no one is really sure of it's correct usage |
--vu0-clamp-operands=1 |
| --vu0-clamp-results | 0, 1 | A clamping setting that is supposed to increase the vu0's clamping functionality when vu0 clamping is enabled, but no difference is noticed for currently unknown reasons, Sony never used it in any official config, therefore no one is really sure of it's correct usage |
--vu0-clamp-results=1 |
COP2
COP2, Also known as VU0 Macro-mode. these commands "may" only be useful for games that use M-bit
| Command | Values | Notes | Usage |
|---|---|---|---|
| Speedhacks | |||
| --cop2-opt-flags | 0, 1 ,2 | Optimize flags when do VU recompilation (1 is safe, 2 update sticky, and mac flag on every status flag update) More Info | --cop2-opt-flags=1 |
| --cop2-opt-vf00 | 0, 1, 2 | Optimization for the vf00 register. Setting it to 1 is safe but setting it to 2 is highly unstable. | --cop2-opt-vf00=1 |
| --cop2-const-prop | 0, 1 | Constant propagation, Can Be Used as speedhack for cop2 hungry games when set to 1 More info | --cop2-const-prop=1 |
| --cop2-di-bits | 0, 1 | 0 to skip setting Invalid, and Div by Zero flags in status register, and therefore improve performance. Can be used as speedhack as it skip costly calculations. | --cop2-di-bits=0 |
| Game fixes | |||
| --cop2-no-clamping | 1 = Full clamping 0 = No clamping |
Can be used to fix graphical glitches, Some emulators like roguev1 or KOF2000 prefer clamping to be turned off. |
--cop2-no-clamping=0 |
| --cop2-accurate-range | start,end offset (0x0 - 0x1FFFFFF) | Accurate COP2 Assembly instructions in the cop2 Address range by using software floats rather than hardware floats, Can be used to fix SPS | --cop2-accurate-range=0x123456,0x134567 |
| --cop2-no-clamp-range | start,end offset (0x0 - 0x1FFFFFF) | Full clamping for COP2 in selected range | --cop2-no-clamp-range=0x123456,0x134567 |
| --cop2-accurate-mul-range | start,end offset (0x0 - 0x1FFFFFF) | Accurate Multiplication instructions in the cop2 Address range by using software floats rather than hardware floats | --cop2-accurate-mul-range=0x123456,0x134567 |
| --cop2-accurate-mul | 1 = Enabled 0 = Disabled |
Accurate Multiplication instructions for all offsets by using software floats rather than hardware floats | --cop2-accurate-mul=1 |
| --cop2-accurate-addsub | 1 = Enabled 0 = Disabled |
Accurate Add/Subtract instructions for all offsets by using software floats rather than hardware floats | --cop2-accurate-addsub=1 |
| --cop2-accurate-addsub-range | start,end offset (0x0 - 0x1FFFFFF) | Accurate Add/Subtract instructions in the cop2 Address range by using software floats rather than hardware floats | --cop2-accurate-addsub-range=0x123456,0x134567 |
| Other | |||
| --cop2-regalloc | 0, 1 ? | PCSX2 seems to have this enabled by default. | |
| --cop2-inst-q | 0, 1 | instant Q, no stalling on VWAITQ, or instances of Q. | |
| --cop2-inst-p | 0, 1 | instant P, no stalling on VWAITP, or instances of P. | |
| --cop2-use-rcp | 0, 1 | use sse rcp | |
| --cop2-use-rsqrt | 0, 1 | use sse rsqrt | --cop2-use-rsqrt=0 |
| --cop2-clamp-operands | 0, 1 | A clamping setting that is supposed to increase the cop2's clamping functionality when cop2 clamping is enabled, but no difference is noticed for currently unknown reasons, Sony never used it in any official config, therefore no one is really sure of it's correct usage |
--cop2-clamp-operands=1 |
| --cop2-clamp-results | 0, 1 | A clamping setting that is supposed to increase the cop2's clamping functionality when cop2 clamping is enabled, but no difference is noticed for currently unknown reasons, Sony never used it in any official config, therefore no one is really sure of it's correct usage |
--cop2-clamp-results=1 |
CDVD
Commands for changing the nature of CDVD emulation.
| Command | Values | Notes | Usage |
|---|---|---|---|
| Game fixes | |||
| --cdvd-sector-read-cycles | 0.1 = Fastest, 80000 = Slowest |
Set DVD reading speed, higher values are slower, lower values are faster, Kinetica uses 40000, Psychonauts 4000, Red dead revolver 5000, Rise of kasai 31000, some games require moderate speed, too slow or too fast could cause audio problems. |
--cdvd-sector-read-cycles=40000 |
| --cdvd-sector-seek-cycles | 0.1 = Fastest, 80000 = Slowest |
Set the speed at which the emulated CDVD spins, higher values are slower, lower values are faster, fixes boot-up sometimes.More info here [2]. |
--cdvd-sector-seek-cycles=1 |
| Misc | |||
| --max-disc-num | 1-5 | Numbers of discs in package (maximum=5) | --max-disc-num=1 |
| --boot-disc-id | 1-5 | Sets boot disc for multi-disc pkg | --boot-disc-id=0 |
| --switch-disc-reset | 1 = Enables resetting the game upon disc swap 0 = Disables resetting the game upon disc swap |
0 Can be used to prevent Resetting the game when switching multiple discs, useful for games like Samurai warriors 2 that have Import data Feature, Sadly this command isn't supported by many emulators, but jakv2 is confirmed to support it |
--switch-disc-reset=1 |
| --cdvd-determinism | 0, 1 | (?) | --cdvd-determinism=1 |
| --verbose-cdvd-reads | 0, 1 | Seems to slightly improve reading speed when enabled (?) | --verbose-cdvd-reads=1 |
IOP
The emulated I/O Processor (IOP) settings, Commands here are rarely useful, since the ps4 emulates it very accurately, very few games will require these options. the iop controls the emulated DEV9, SPU2, USB, Memory cards, CDVD, Firewire, along with other input/output Devices
| Command | Values | Notes | Usage |
|---|---|---|---|
| Game fixes | |||
| --iop-cycle-scalar | [Overclocking] (0.99 => 0.1) [Underclocking] (1.1 => 5.0) |
Not a Speedhack, when you lower it below 1.0 the iop is overclocked, when you increase it above 1.0 the iop is underclocked. the only thing you will notice from this is faster/slower loading speed | --iop-cycle-scalar=1.0 |
| --iop-const-folding | None,Gpr,All | IOP constant folding More info | --iop-const-folding=All |
| --iop-tight-slice-count | 0, 2000 | Seems to slow down the iop the higher the value, Can be used in games such as the godfather or gran turismo 4 to solve stuttering fmvs due to very fast iop cycles | --iop-tight-slice-count=12 |
| --iop-hook | AdvanceClock, FastForwardClock | IOP native hook, Sony uses it on their official release of Red dead revolver |
--iop-hook=0x0086ac,FastForwardClock |
| --iop-block-validation | IsC, ShortHash, Hash | Way of validating that block been modified, and require recompilation, other Possible values include PageProt, None, PageProtection | --iop-block-validation=IsC |
| Other | |||
| --iop-validate-kernel | 0, 1 | ||
| --iop-shorthash-len | inst_count/integer | Length of shorthash in instruction/opcode count. Require --iop-block-validation=ShortHash | |
| --iop-pc-coherency | 0, 1 | Most likely updates the (Program counter) more frequently for the iop (?) | |
| --iop-inst-marking | 0, 1? | ||
| --detect-idle-iop | 0, 1 | enabled by default, set to 0 in order to disable it | --detect-idle-iop=0 |
| --iop-jit-disasm | |||
| --iop-evt-check-full |
SIF
The SIF is how the EE and IOP communicate with each other. SIF has some mailbox hardware registers that the CPUs can use to pass values to each other, which happens during SIF initialization. However, once both sides have booted, they use the SIF0 (IOP->EE) and SIF1 (EE->IOP) DMA channels to communicate. Despite common belief, these commands have no effect on performance, and are rarely ever useful.
| Command | Values | Notes | Usage |
|---|---|---|---|
| SIF1 (IOP) | |||
| --iop-sif1-cycle-scalar | [Overclocking] (0.99 => 0.1) [Underclocking] (1.1 => ∞ ) |
It controls how much data the IOP recieves from the EE | --iop-sif1-cycle-scalar=0.1 |
| --ee-sif1-cycle-scalar | [Overclocking] (0.99 => 0.1) [Underclocking] (1.1 => ∞ ) |
It controls how much data the EE sends to the IOP | --ee-sif1-cycle-scalar=0.1 |
| SIF0 (EE) | |||
| --iop-sif0-cycle-scalar | [Overclocking] (0.99 => 0.1) [Underclocking] (1.1 => ∞ ) |
It controls how much data the IOP sends to the EE | --iop-sif0-cycle-scalar=0.1 |
| --ee-sif0-cycle-scalar | [Overclocking] (0.99 => 0.1) [Underclocking] (1.1 => ∞ ) |
It controls how much data the EE recieves from the IOP | --ee-sif0-cycle-scalar=0.1 |
Misc
| Command | Values | Notes | Usage |
|---|---|---|---|
| --idec-cycles-per-qwc | int/multiplier | Probably related to the ipu | --idec-cycles-per-qwc=768 |
| --mfifo-manual-drain | 0.1/5.0 | A command for changing the functionality of --ee-hook=0x0,Mfifodrain | --mfifo-manual-drain=0.30 |
| --mfifo-chunk-drain-cycles | 1/400000 | A command for changing the functionality of --ee-hook=0x0,Mfifodrain | --mfifo-chunk-drain-cycles=210000 |
| --pcr0-delta-hack | 0.1 , 400000 | --pcr0-delta-hack=1 | |
| --jitproc-use-aslr | |||
| --detect-idle-intc | 0, 1 | enabled by default, set to 0 in order to disable it | --detect-idle-intc=0 |
| --detect-idle-chcr | 0, 1 | enabled by default, set to 0 in order to disable it | --detect-idle-chcr=0 |
| --rom | location of the bios that's inside of the fpkg |
Could allow to use custom bios, though still not working |
--rom="PS20220WD20050620.crack" or --rom="/roms/PS20220WD20050620.crack" |
PCSX2's gameindex
Current Gameindex.yaml
Old Gameindex.yaml files in case these settings get deleted from PCSX2
This list includes the gameindex's equivalent commands in the ps4. These commands are fully tested. there's no need to edit them
| PCSX2 | PS4 | Notes |
|---|---|---|
| XGKickHack | --vu-xgkick-delay=0 | Limit is between (0 => 31) |
| VuAddSubHack | --vu-hack-triace=1 | Required for every single game developed by TriAce |
| vuClampMode: 2 | --vu1-no-clamping=0 --vu0-no-clamping=0 --cop2-no-clamping=0 |
|
| vuClampMode: 3 | --vu1-no-clamping=1 --vu0-no-clamping=1 --cop2-no-clamping=1 |
|
| vu0ClampMode: 2 | --vu0-no-clamping=0 --cop2-no-clamping=0 |
|
| vu0ClampMode: 3 | --vu0-no-clamping=1 --cop2-no-clamping=1 |
|
| vu1ClampMode: 2 | --vu1-no-clamping=0 | |
| vu1ClampMode: 3 | --vu1-no-clamping=1 |
|
| eeClampMode: 2 | --fpu-no-clamping=0 | |
| eeClampMode: 3 | --fpu-no-clamping=1 |
|
| FpuNegDivHack & FpuMulHack | --fpu-accurate-muldiv=1 | it'll probably make game lose performance therefore use this with it --fpu-accurate-mul-fast=1 |
| cpuCLUTRender: 1 | --gs-uv-shift-pointsampling=1 | |
| MTVUSpeedHack: 0 | --vu1=jit-sync | |
| IbitHack | --vu1-di-bits=0 --vu1-const-prop=1 |
Note: this emulator has this hack enabled by default for all games and emulators, these 2 commands are only provided to assist games that need that hack with performance and is not the equivalent of this hack. |
| roundSprite: 1 | --gs-use-clut-merge=1 | Note: Works very similar but not the equivalent |
mergeSprite: 1 |
--gs-kernel-cl-up="up2x2simple" | Note: Works very similar but not the equivalent |
| cpuSpriteRenderBW: 4 | --gs-opt-frbuff-switch=1 | Note: Works very similar to it, But it's not exactly the same |
| mipmap: 1 | --gs-use-mipmap=1 |
|
| autoFlush: 1 | --gs-flush-ad-xyz=safe | Possible values include always, safe, off, 0 |
| VIF1StallHack | --vif1-instant-xfer=0 | if that doesn't work you can always use
the lua command eeObj.SchedulerDelayEvent("vif1.dma", 0x9000)
|
| VIFFIFOHack | --vif1-ignore-cmd-ints=1 | |
| wildArmsHack: 1 | --gs-kernel-cl-up="DarkCloud2" | |
| deinterlace: | --force-frame-blend=1 |
Emulators
Every emulator is programmed in a different way, sometimes choosing the right emulator is the only possible way to fix a game, emulators are not provided pre-installed on your ps4, they have to be unpacked from your ps2classics backup that's downloaded from the ps store from that specific game. this list includes The typical usage of some of The emulators. and by emulator we mean the fpkg's Eboot.bin
| Emulator | Usage | API Version | Similar emulators (Usage) |
|---|---|---|---|
| 2017 | |||
Jak v2 |
Good compatibility with most ps2 games, and it has a very high api version which means more LUA commands are supported. | 2.2 | JakX, Jak 2, Jak 3, Parappa. |
AOFA |
Works similarly to RECVX, It managed to fix Coraline | ||
RECVX |
Fixes Games like Jackie chan Adventures, Pac-man World 3, Yu-Gi-Oh: Capsule monsters freezing at the splash screen Most likely due to the way it emulates Vector unit 1 | 1.7 | Fatal Fury, Redfaction, AOFA. |
| 2016 | |||
Redfaction |
It is a very good emulator to use for games that are sensitive to VU1, it was used to fix Tony hawk games suddenly crashing, probably has something similar vu1roundmode 0. | 1.6 | Max payne |
Forbidden siren |
The only emulator that fixed Ice age 2 being stuck at splash screen using kozarovv's patch, it also fixed Gran turismo 4 running EXTREMELY slow, this emu possibly has EE cache support | 0.1 | |
KOF2000 |
Fixes graphical issues and sps in games such as Crash Twinsanity, and prevents Koei tecmo games from suddenly freezing when battle starts, since it emulates COP2/VU1/VU0 timing much more accurately than other emulators | 1.2 | Roguev1 and KOF98 |
rise of the kasai |
Fixed most of the Harry potter games | Also referred to as rotk | |
| 2015 | |||
War of the monsters v1 |
Probably the most GS accurate emulator we have on the PS4, Fixed Enter the Matrix crashing with upscaling on, and fixed Devil may cry 2 characters having missing faces, fixed Tekken 5 having graphical corruptions in some levels, Fixed the bard's tale crashing, it also happens to be the default emulator for PS2ClassicsGUI | 0.1 | |
GTA 3 |
Fixed the pal Version of Genji: Dawn of the Samurai, Could be the most GIFIFO accurate emu we have. | ||
Parappa |
The only emulator that was able to Boot Spyro: A Hero's Tail | ||
Star wars racer revenge |
Seems to be the most similar emulator to the ps3. useful for debugging games as it also shows useful information such as pagefault | 0.1 |
All you have to do to make these emulators work for your game is to replace your Fpkg backup's iso with that game's iso
XXXX-YYYYY_config.lua
It is the most powerful Configuration on the emulator, it Allows direct patching of EE/IOP/VU memory, hooks registers, hook dma, almost Everything can be done here. If needed it can hook registers by using register names from alias files. Alias files (ee-cpr0-alias.lua, ee-gpr-alias.lua, ee-hwaddr.lua) are stored in lua_include folder, and can be included to config by using require ( "alias file name" ).
Known functions: Require cleanup.
ApiRequest
The most important part of a lua. without it the lua will crash the game.
| Command | Usage | Notes |
|---|---|---|
| apiRequest | apiRequest(0.1) | apiRequest(<api version>)
Different emu versions support different highest api. Calling api is mandatory. some commands require higher version. Highest known version is 2.3 api from JAK 2,3,X game emulator. |
(Emulator) EmuObject
Commands for the emulator
| Command | Usage | Notes |
|---|---|---|
| Object calling class | ||
| getEmuObject | local emuObj = getEmuObject() | Required for all functions using emuObj, that include: LoadConfig SaveConfig GetPad AddVsyncHook RemoveVsyncHook AddEntryPointHook RemoveEntryPointHook AddLoginHook RemoveLoginHook AddLogoutHook RemoveLogoutHook CheckEntitlement AddImageHook AddGifTagHook SwapMemCard SetFormattedCard OpenDiscTray CloseDiscTray SwitchDisc EnableImposeMenu GetDiscId GetDiscTitleId AddSectorReadHook AddMCWriteHook ShowDiscSwitchInfo GetPs4SystemLang SetPs2Lang ThrottleNorm ThrottleFast ThrottleMax AddAssertionHook SetGsTitleFix SetDeinterlace SetDisplayAspectWide SetDisplayAspectNormal ForceRefreshRate LoadFsShader SetDisplaySafeArea PadSetLightBar AddPadHook PadPressureStickRemap SetVolumes GetVolumes SetAudioRoute GetAudioRoute AddSnapshotLoadedHook RemoveSnapshotLoadedHook IsNeoMode IsToolingVerbose emuMediaPatch |
| Hooks | ||
| AddVsyncHook | emuObj.AddVsyncHook(<task to be done every vsync>) | emuObj.AddVsyncHook(my_function)
my_function can be anything, from simple patches, to extensive hook. Example usage can be found in SLUS-21550 features file. some games are not compatible with it and will crash upon startup. |
| RemoveVsyncHook | emuObj.RemoveVsyncHook(<previously added task to be removed>) | emuObj.RemoveVsyncHook(my_function) |
| AddEntryPointHook | emuObj.AddEntryPointHook(<task>) | Task to be done at ps2 game main elf entry point (right where game is loaded). |
| RemoveEntryPointHook | ||
| AddLoginHook | ||
| RemoveLoginHook | ||
| AddLogoutHook | ||
| RemoveLogoutHook | ||
| AddImageHook | ||
| AddGifTagHook | ||
| AddSectorReadHook | emuObj.AddSectorReadHook(<sector, unk, task>) | Hook to do task when disc image sector is read. Not all values are known (ex. emuObj.AddSectorReadHook(776480, 32, <task/function>) ) |
| AddMCWriteHook | emuObj.AddMCWriteHook() | |
| AddAssertionHook | emuObj.AddAssertionHook() | |
| AddSnapshotLoadedHook | ||
| RemoveSnapshotLoadedHook | ||
| AddPadHook | emuObj.AddPadHook() | |
| Audio | ||
| SetVolumes | emuObj.SetVolumes('global', 'main', 'bgm') | Set volume, usually setting global is enough. Example: emuObj.SetVolumes(0.31, 1.0, 1.0) values, in floats 1.0 = 100% |
| GetVolumes | emuObj.GetVolumes() | Return current volume levels for ('global', 'main', 'bgm') in floating point values. |
| SetAudioRoute | ||
| GetAudioRoute | ||
| Game loading speed | ||
| ThrottleNorm | emuObj.ThrottleNorm() | Enable default framelimiter (50/60 fps depend on region). |
| ThrottleFast | emuObj.ThrottleFast() | Faster than default, but exact value is unknown. |
| ThrottleMax | emuObj.ThrottleMax() | Disable framelimiter During loading screens, This setting can sometimes be harmful when used globally in config files. Loading times are faster, but the game also runs faster than it should when the PS4 has enough free cpu power. |
| CDVD | ||
| OpenDiscTray | ||
| CloseDiscTray | ||
| SwitchDisc | emuObj.SwitchDisc(<disc ID>) | ID can be provided as is, or for example read from memory or register when needed. |
| GetDiscId | emuObj.GetDiscId() | Return DiscId in XXXX_YYY.ZZ format |
| GetDiscTitleId | ||
| ShowDiscSwitchInfo | emuObj.ShowDiscSwitchInfo() | |
| Other | ||
| EnableImposeMenu | emuObj.EnableImposeMenu(<true/false>) | EnableImposeMenu(false) |
| LoadConfig | ||
| SaveConfig | ||
| GetPad | emuObj.GetPad(<gamepad button by bits>) | example usage for reading input:
local CheckInputs = function() local pad_bits = emuObj.GetPad() local UP = pad_bits & 0x0010 local DOWN = pad_bits & 0x0040 local LEFT = pad_bits & 0x0080 local RIGHT = pad_bits & 0x0020 local Triangle = pad_bits & 0x1000 local Cross = pad_bits & 0x4000 local Square = pad_bits & 0x8000 local Circle = pad_bits & 0x2000 local L1 = pad_bits & 0x0400 local L2 = pad_bits & 0x0100 local L3 = pad_bits & 0x0002 local R1 = pad_bits & 0x0800 local R2 = pad_bits & 0x0200 local R3 = pad_bits & 0x0004 local Select = pad_bits & 0x0001 local Start = pad_bits & 0x0008 if (L2 ~= 0) then <here function that should be done when L2 is pushed> end end emuObj.AddVsyncHook(CheckInputs) <to trigger check at every vsync> |
| SwapMemCard | ||
| SetFormattedCard | emuObj.SetFormattedCard(<"file name">) | emuObj.SetFormattedCard("custom_formatted.card")
Allow to use custom memory card. |
| GetPs4SystemLang | emuObj.GetPs4SystemLang() | Return PS4 system language (in unknown format). |
| SetPs2Lang | emuObj.SetPs2Lang(<Lang ID>) | Set emulated PS2 language, correct Lang IDs are 0-18, Strangely, Some Games can Crash if their Specific Language is not selected
0 - japanese 1 - english 2 - french 3 - spanish 4 - german 5 - italian 6 - dutch 7 - portuguese 8 - russian 9 - korean 10 - traditonal-chinese 11 - simplified-chinese 12 - finnish 13 - swedish 14 - danish 15 - norwegian 16 - polish 17 - portuguese-brazil 18 - english-uk |
| PadSetLightBar | emuObj.PadSetLightBar(<port, red, green, blue>) | Set DS4 light bar color. Correct port values are 0-3, correct light values are 0-255. |
| PadPressureStickRemap | emuObj.PadPressureStickRemap() | |
| IsNeoMode | emuObj.IsNeoMode() | Check that PS4 run in NEO (PRO) mode. Return 1/0 |
| IsToolingVerbose | ||
| CheckEntitlement | ||
| emuMediaPatch | emuMediaPatch(disc sector, 12/24 + offset, { original data }, { replace data }) | Replace 4 bytes from loaded iso file. For unknown reason we always need to add 12 to real offset for DVD game, and 24 for CD game. |
| GS related | ||
| CountFrameOnPS2 | emuObj.CountFrameOnPS2() | updates FRAPS/Actual FPS reading in olympus |
| SetGsTitleFix | emuObj.SetGsTitleFix() | More info |
| SetDisplayAspectWide | emuObj.SetDisplayAspectWide() | Force display area to 16:9 (If game not support widescreen, it will be stretched). |
| SetDisplayAspectNormal | emuObj.SetDisplayAspectNormal() | Force display area to 4:3. |
| ForceRefreshRate | emuObj.ForceRefreshRate(<hz>) | emuObj.ForceRefreshRate(50) correct values are 0, 50, 60 where 0 = default. |
| LoadFsShader | emuObj.LoadFsShader(<slot?>, "<path>") | Shaders must be loaded right after GS has been initialized. Example: Global_InitGpuResources = function() emuObj.LoadFsShader(1, "./shader.sb") end That only load Fragment Shader to program memory, to use it we need BindFragmentShader, and if depend on shader SetShaderParams. |
| SetDisplaySafeArea |
(EE) EEObject
Commands for the emulated Emotion Engine
| Command | Usage | Notes |
|---|---|---|
| Object calling class | ||
| getEEObject | local eeObj = getEEObject() | Required for all functions using eeObj |
| Memory editing | ||
| ReplaceMem64 | eeObj.ReplaceMem64(<address>, <value>) | |
| ReplaceMem32 | eeObj.ReplaceMem32(<address>, <value>) | Permanently replace an offset without needing addvsynchook |
| ReplaceMem16 | eeObj.ReplaceMem16(<address>, <value>) | |
| ReplaceMem8 | eeObj.ReplaceMem8(<address>, <value>) | |
| ReadMemFloat | eeObj.ReadMemFloat(<address>) | eeObj.ReadMemFloat(0x258c3c) |
| WriteMemFloat | eeObj.WriteMemFloat(<address>, <value>) | eeObj.WriteMemFloat(0x365364, 1.3333333) |
| ReadMem128 | eeObj.ReadMem128(<ee memory offset>) |
Read 16 bytes from offset, examples: eeObj.ReadMem128(0x100198) |
| ReadMemFloat128 | eeObj.ReadMemFloat128(<ee memory offset>) |
return 16 bytes from offset in float form |
| WriteMem128 | ||
| WriteMemFloat128 | ||
| ReadMem64 | eeObj.ReadMem64(<ee memory offset>) |
Read 8 bytes from offset, examples: eeObj.ReadMem64(0x100198) |
| WriteMem64 | eeObj.WriteMem64(<ee memory offset>, <data>) |
|
| ReadMem32 | eeObj.ReadMem32(<ee memory offset>) |
Read 4 bytes from offset, examples: eeObj.ReadMem32(0x100198)
eeObj.ReadMem32(gp - 31348) |
| WriteMem32 | eeObj.WriteMem32(<ee memory offset>, <data>) |
Write 4 bytes to offset, example: eeObj.WriteMem32(0x2c89ac, 0x001b70f0) |
| ReadMem16 | eeObj.ReadMem16(<ee memory offset>) |
Read 2 bytes from offset, example: eeObj.ReadMem16(0x100198) |
| WriteMem16 | eeObj.WriteMem16(<ee memory offset>, <data>) |
Write 2 bytes to offset, example: eeObj.WriteMem16(0x2c89ac, 0x70f0) |
| ReadMem8 | eeObj.ReadMem8(<ee memory offset>) |
Read 1 byte from offset, example: eeObj.ReadMem8(0x100198) |
| WriteMem8 | eeObj.WriteMem8(<ee memory offset>, <data>) |
Write 1 byte to offset, example: eeObj.WriteMem8(0x2c89ac, 0xf0) |
| ReadMemStr | eeObj.ReadMemStr(address/register) | Read string from address until null terminator |
| WriteMemStr | eeObj.WriteMemStr(address, string) | |
| WriteMemStrZ | eeObj.WriteMemStrZ(string pointer, string) . Pointer can be read from GPR | |
| GPR require (Necessary for register related commands) | ||
| local gpr = require( "ee-gpr-alias" ) | ||
| GetGpr64 | eeObj.GetGPR64(<gpr register>) | example: eeObj.GetGPR64(t3) |
| SetGpr64 | ||
| GetGprFloat | Get gpr value as float value | |
| SetGprFloat | Set gpr value as float value | |
| GetGpr | eeObj.GetGPR(<gpr register>) | eeObj.GetGPR(t3) |
| SetGpr | eeObj.SetGPR(<gpr register> ,<value>) | example: eeObj.SetGPR(gpr.a3 ,1)
Require defined getEEObject() as eeObj |
| GetFprHex | eeObj.GetFprHex(<FPU register (0-31)>) | Get/return floating point register value as hex string |
| SetFprHex | eeObj.SetFprHex(<FPU register (0-31), value (u32)>) | Set floating point register value as hex string |
| GetFpr | eeObj.GetFpr(<register number>) | example eeObj.GetFpr(14) |
| SetFpr | eeObj.SetFpr(<fpr register number>, <value>) | Simple example eeObj.SetFpr(14, 50.0) will set frp 14 to 50.0
But we can also combine commands to add/sub from registers eeObj.SetFpr(14, eeObj.GetFpr(14) + 50.0) this will add 50.0 to current fpr 14 value |
| GetPc | eeObj.GetPc() | This command is very helpful as it will return to you the current EE address that's being read. can be used also with additional var. like eeObj.GetPc()+4 |
| SetPc | eeObj.SetPC(<PC>) | eeObj.SetPC(0x266B80) |
| GetCPR0 | eeObj.GetCPR0(<COP0 register>) | |
| SetCPR0 | eeObj.SetCPR0(<COP0 register>) | |
| Hooks | ||
| AddHook | eeObj.AddHook(<ee offset>, <original opcode>, <definied hook name>) | example: local W1 = function() emuObj.SetDisplayAspectNormal() end local ws1 = eeObj.AddHook(0x1c9840, 0xaf808c78, W1) |
| RemoveHook | ||
| AddPreHook | ||
| AddPostHook | ||
| RemovePreHook | ||
| RemovePostHook | ||
| AddJitResetHook | ||
| RemoveJitResetHook | ||
| AddHookJT | eeObj.AddHookJT(Offset, offset opcode, ???) | Seems to somehow be related to gpr registers |
| Dma | ||
| DmaAddHook | eeobj.DmaAddHook(channel=%d key=%x) |
Possible Dma channel numbers (?)
GIF = 0 VIF0 = 1 VIF1 = 2 SIF0 = 4 SIF1 = 5 IPU0 = 6 IPU1 = 7 Possible values for hooks DmaTransfer [VIF0/VIF1], RaiseIntc [VIF0/VIF1], NormalTransfer [SIF0/SIF1]. |
| DmaRemoveHook | ||
| Speedhacks | ||
| FastForwardClock | eeObj.FastForwardClock() | Skip Emotion engine Cycles |
| AdvanceClock | eeObj.AdvanceClock() | it is still unknown how to use this command, check Psychonauts lua for more details. |
| GetClock | eeObj.GetClock() | Returns the value of how many cycles the iop is ahead of normal clock (?) |
| Vu1MpgCycles | eeObj.Vu1MpgCycles(<cycles>) | Works just like the cli command --vu1-mpg-cycles=, setting it to eeObj.Vu1MpgCycles(1000) would skip 50% of frames When the game enters a VU1 Heavy area and will return to normal framerate when VU1 is not being under heavy usage. |
| Other | ||
| CallPredicate | ||
| SchedulerDelayEvent | eeObj.SchedulerDelayEvent("event", cycles) | Parrapa use eeObj.SchedulerDelayEvent("vif1.dma", 0x6500) other events are gif.dma, vif0.dma, vif1.dma, sif0.dma, Sif0-NormalTransfer, sif1.dma, Sif1-NormalTransfer, ipu0.dma, ipu1.dma . This command allow to delay certain DMA transfer by cycles. |
| WaitVu1 | eeObj.WaitVu1() | most likely this is --vu1=jit-sync, adding it will Sync the EE with the VU1, Pcsx2 has a similar gamefix called VU Sync which syncs both VU1 and VU0 with the EE. |
| GetPcRingBuffer | ||
| Precompile | Requires unknown values | |
| CalcInsnHash | ||
| getOverlayObject | eeObj.getOverlayObject() | Can be used to get Current EE Offset (???) local eeOverlay = eeObj.getOverlayObject() |
| GetVif1Cycles | eeObj.GetVif1Cycles() | local vif1_cycles = eeObj.GetVif1Cycles() create vif_cycles value that can be used later, you can rename it as you wish. |
(IOP) IOPObject
Commands for the emulated input-output processor
| Command | Usage | Notes |
|---|---|---|
| Object calling class | ||
| getIOPObject | local iopObj = getIOPObject() | Required for all functions using iopObj, that include: ReplaceMem64 ReplaceMem32 ReplaceMem16 ReplaceMem8 ReadMemFloat WriteMemFloat WriteMem64 WriteMem32 WriteMem16 WriteMem8 ReadMemStr AddHook RemoveHook GetGpr SetGpr GetPc SetPc GetCPR0 SetCPR0 |
| Memory editing | ||
| ReplaceMem64 | iopObj.ReplaceMem64(<address>, <value>) | |
| ReplaceMem32 | iopObj.ReplaceMem32(<address>, <value>) | |
| ReplaceMem16 | iopObj.ReplaceMem16(<address>, <value>) | |
| ReplaceMem8 | iopObj.ReplaceMem8(<address>, <value>) | |
| ReadMemFloat | iopObj.ReadMemFloat(<address>) | iopObj.ReadMemFloat(0x28c3c) |
| WriteMemFloat | iopObj.WriteMemFloat(<address>, <value>) | iopObj.WriteMemFloat(0x65364, 1.3333333) |
| ReadMem128 | iopObj.ReadMem128(<iop memory offset>) | |
| WriteMem128 | iopObj.WriteMem128(<iop memory offset>, <value>) | |
| ReadMemFloat128 | iopObj.ReadMemFloat128(<iop memory offset>) | |
| WriteMemFloat128 | iopObj.WriteMemFloat128(<iop memory offset>, <value>) | |
| ReadMem64 | iopObj.ReadMem64(<iop memory offset>) |
Read 8 Bytes From offset |
| WriteMem64 | iopObj.WriteMem64(<iop memory offset>, <data>) |
Write 8 Bytes From offset |
| ReadMem32 | iopObj.ReadMem32(<iop memory offset>) |
Read 4 bytes from offset, examples: iopObj.ReadMem32(0x1198)
iopObj.ReadMem32(gp - 348) |
| WriteMem32 | iopObj.WriteMem32(<iop memory offset>, <data>) |
Write 4 bytes to offset, example: iopObj.WriteMem32(0x89ac, 0x001b70f0) |
| ReadMem16 | iopObj.ReadMem16(<iop memory offset>) |
Read 2 bytes from offset, example: iopObj.ReadMem16(0x1198) |
| WriteMem16 | iopObj.WriteMem16(<iop memory offset>, <data>) |
Write 2 bytes to offset, example: iopObj.WriteMem16(0x89ac, 0x70f0) |
| ReadMem8 | iopObj.ReadMem8(<iop memory offset>) |
Read 1 byte from offset, example: iopObj.ReadMem8(0x1198) |
| WriteMem8 | iopObj.WriteMem8(<iop memory offset>, <data>) |
Write 1 byte to offset, example: iopObj.WriteMem8(0x89ac, 0xf0) |
| ReadMemStr | ||
| GetGpr | iopObj.GetGPR(<gpr register>) | iopObj.GetGPR(a1) |
| SetGpr | iopObj.SetGPR(<gpr register> ,<value>) | example: iopObj.SetGPR(gpr.v0 ,3) |
| GetPc | iopObj.GetPc() | can be used also with additional var. like iopObj.GetPc()+8 |
| SetPc | iopObj.SetPC(<PC>) | iopObj.SetPC(0x6B80) |
| GetCPR0 | iopObj.GetCPR0(<COP0 register>) | |
| SetCPR0 | iopObj.SetCPR0(<COP0 register>) | |
| Clock speed | ||
| FastForwardClock | iopObj.FastForwardClock() | |
| AdvanceClock | iopObj.AdvanceClock() | Increase Iop Clock speed at hooked iop offset |
| GetClock | iopObj.GetClock() | Returns the value of how many cycles the iop is ahead of normal clock (?) |
| Hooks | ||
| AddHook | iopObj.AddHook() | |
| RemoveHook | iopObj.RemoveHook() |
(GS) GsObject
Commands for the emulated Graphics synthesizer
| Command | Usage | Notes |
|---|---|---|
| Object calling class | ||
| getGsObject | local gsObj = getGsObject() | |
| Graphical fixes / Improvement | ||
| SetL2HMode | gsObj.SetL2HMode() | |
| SetUprenderMode | gsObj.SetUprenderMode(1) | Set uprender mode. Overrides CLI, 0=none, 1=2x2 |
| SetUpscaleMode | gsObj.SetUpscaleMode() | |
| GetFramesInQueue | gsObj.GetFramesInQueue() | Returns the value of the frames that are still in queue |
| SetFrameSkipping | gsObj.SetFrameSkipping(true) | false and true are the values. |
| SetDeinterlaceShift | gsObj.SetDeinterlaceShift(0) | The values are 1 and 0, Enable or disable interlacing, requires emulators with high api |
Does not require Object calling or Uknown
| Command | Usage | Notes |
|---|---|---|
| eeInsnReplace | eeInsnReplace(EE memory offset, Original opcode (BE), Replace opcode (BE)) | Replace 4 bytes opcode in ee memory, correct memory range is 0x0 to 0x1FFFFFFF |
| vuInsnReplace | vuInsnReplace(vu 0/1, vu memory offset divided by 8, (original opcode<<32) | original opcode, (replace opcode<<32) | replace opcode) |
Replace 2 x 4 bytes in VU memory, correct memory range depend on selected VU, left shift by 32 is used for VU lower opcodes. Command will fail if size is above 254. example: vuInsnReplace(0, 0x167, (0x000002ff << 32) | 0x520507ff,(0x000002ff << 32) | 0x8000033c) Replace 64 bits of VU0 at offset 0xB38 |
| iopInsnReplace | iopInsnReplace(IOP memory offset, Original opcode, opcode replacement) | Replace 4 bytes in iop memory, correct memory range is 0x0 to 0x1FFFFF, iopInsnReplace(0x1FFFFF, 0x0, 0x0803fff0) |
| eeNativeFunction | eeNativeFunction(<ee offset>, <original opcode>, <function>) | eeNativeFunction(0x11fa9c, 0x0080402d, 'memcpy')
Different emulators can have different functions included, vide SO3. Require api 1.4 or higher. But functions from this list should be available in every emu: ieee754_acosf ieee754_asinf ieee754_sqrtf fabs cosf fabsf sinf acosf asinf sqrtf fptoui fptodp litodp dptoli dptofp memcpy memset strlen |
| eeNativeHook | eeNativeHook(<ee ofset>, <original opcode>, <action>) | eeNativeHook require apiRequest(1.4) or higher. |
| GsCustomShader | ||
| Unlock | ||
| IsUnlocked | ||
| InsnOverlay | InsnOverlay({<opcode, opcode, opcode...>}) | example: InsnOverlay({
0x27bdfff0, -- addiu $sp, -0x10
0xffbf0000, -- sd $ra, 0(sp)
0xffb00008, -- sd $s0, 8(sp)
0x3c05000f, -- lui $a1, 0x000f
0x34a57000, -- ori $a1, 0x7000
0x0c0db8b6, -- jal Script::State::DoString
0x0080802d, -- move $s0, $a0
0x24050001, -- li $a1, 1
0x0c0dba4c, -- jal Script::State::IsNull(int)
0x0200202d, -- move $a0, $s0
0xdfb00008, -- ld $s0, 8(sp)
0xdfbf0000, -- ld $ra, 0(sp)
0x03e00008, -- jr ra
0x27bd0010 -- addiu $sp, 0x10
}) |
| eeDebugBreak | ||
| CsBindShader | ||
| CsSetParamInt32 | ||
| CsSetParamFloat | ||
| CsResetContext | ||
| CsPrintContext | ||
| PsBindShader | ||
| PsSetParamInt32 | ||
| PsSetParamFloat | ||
| PsResetContext | ||
| PsPrintContext |
Note: eeObj, emuObj, gsObj, etc are described as required, this is not really true. You can set functions locals they use as whatever you want, but due to specify of that emulator it will be better to keep official naming used in official configs.
Other objects
| Command | Usage | Notes |
|---|---|---|
| getGLSObject class | ||
| getGLSObject | ||
| Enable | ||
| EnableServerRecording | ||
| Pause | ||
| getGsObject class | ||
| getAudioObject class | ||
| getAudioObject | ||
| muteStreamingAll | ||
| muteStreamingMain | ||
| muteStreamingBGM | ||
| getRemotePlayObject class | ||
| getRemotePlayObject | ||
| Enable | ||
| getVideoRecordingObject class | ||
| getVideoRecordingObject | ||
| Enable | ||
| getSharePlayObject class | ||
| getSharePlayObject | ||
| Enable | ||
| getSpriteObject group | ||
| getSpriteObject | ||
| Enable | ||
| Disable | ||
| BindFragmentShader | ||
| SetShaderParams | Is not clear that params depend on shader, or are somehow hardcoded.
Example usage:
local sprite0 = getSpriteObject(0)
local scanlineParams = {
240.0, -- float scanlineCount
0.7, -- float scanlineHeight;
1.5, -- float scanlineBrightScale;
0.5, -- float scanlineAlpha;
0.5 -- float vignetteStrength;
}
sprite0.SetShaderParams(scanlineParams) | |
| BindTexture | ||
| SetPosXY | ||
| SetSizeXY | ||
| SetPosUV | ||
| SetSizeUV | ||
| PrintContext | ||
| SetBlendColor | sprite<X>.SetBlendColor(<R,G,B,A>) in floats, max val. 1.0 | local sprite0 = getSpriteObject(0) sprite0.SetBlendColor(1.0,1.0,1.0,1.0) |
| getTrophyObject | local trophyObj = getTrophyObject() | Required for all functions using trophyObj |
| getDmaObject | local dmaObj = getDmaObject() | Depreciated API - use EE:DmaAddHook / EE:DmaRemoveHook instead. Is not clear when it was depreciated, JAK emu don't use it. |
| getScreenShotObject |
Registers for hook
Registers defined in alias files.
GetGpr/SetGpr
gpr.zero gpr.at gpr.v0 gpr.v1 gpr.a0 gpr.a1 gpr.a2 gpr.a3 gpr.t0 gpr.t1 gpr.t2 gpr.t3 gpr.t4 gpr.t5 gpr.t6 gpr.t7 gpr.s0 gpr.s1 gpr.s2 gpr.s3 gpr.s4 gpr.s5 gpr.s6 gpr.s7 gpr.t8 gpr.t9 gpr.k0 gpr.k1 gpr.gp gpr.sp gpr.fp gpr.ra gpr.lo gpr.hi gpr.sa example: eeObj.GetGpr(gpr.a1)
GetCPR0/SetCPR0
cpr.index cpr.pagemask cpr.random cpr.wired cpr.entrylo0 cpr.badvaddr cpr.entrylo1 cpr.count cpr.context cpr.entryhi cpr.compare cpr.config cpr.taglo cpr.status cpr.badpaddr cpr.taghi cpr.cause cpr.hwbk cpr.errorepc cpr.epc cpr.pccr cpr.prid example: eeObj.GetCPR0(cpr.status)
SetGsTitleFix
One of the most important commands in lua, allows to change the GS's behavior. Part of EmuObject() class, used frequently in official configs.
Examples
-- fix vision logo (Wild Arms 3)
local thresholdArea = 0 -- ignore alls items : fix #112276
emuObj.SetGsTitleFix( "ignoreUpRender", thresholdArea , { texType = 3, cbp = 0x2390, tbp = 0x288000} )
------------------------------------------------------------------------------------------------------
-- Ignore up-render shift for triangles when writing mask = write alpha only . Will fix shadows (bug# 6724).
emuObj.SetGsTitleFix( "ignoreUpShiftTri", "reserved" , { fbmask = 0x00FFFFFF } )
------------------------------------------------------------------------------------------------------
-- Performance fix ( bug# 9474 )
if 0 then -- emuObj.IsNeoMode() then -- neo mode check disabled, due to bug #10442
emuObj.SetGsTitleFix( "globalSet", "reserved", { workLoadThreshold = 125000} )
else
emuObj.SetGsTitleFix( "globalSet", "reserved", { workLoadThreshold = 100000} )
end
------------------------------------------------------------------------------------------------------
-- bug# 9972
emuObj.SetGsTitleFix( "ignoreSubBuffCov", "reserved", { } )
------------------------------------------------------------------------------------------------------
-- Bully bug 9392
-- Performace fix
local thresholdArea = 600
emuObj.SetGsTitleFix( "ignoreUpRender", thresholdArea , {alpha=0x80000044 , zmsk=1 , tw=4, th=4 } )
------------------------------------------------------------------------------------------------------
-- Bug#9174 -
emuObj.SetGsTitleFix( "ignoreSubBuffCov", "reserved", { } )
------------------------------------------------------------------------------------------------------
-- Bug#9240 (Light maps uprender)
-- Copy z-buffer for future use with light maps. psm = SCE_GS_PSMZ24 (49)
emuObj.SetGsTitleFix( "forceSimpleFetch", "reserved", {tw=9, th=9, psm=49, zmsk=1 } )
------------------------------------------------------------------------------------------------------
-- Apply light maps texMode=2 (bilinear) psm= SCE_GS_PSMCT32 (0)
emuObj.SetGsTitleFix( "forceSimpleFetch", "reserved", {tw=8, th=8, psm=0, ztst=1, texMode=2 } )
------------------------------------------------------------------------------------------------------
-- Performace fix (bug #9785 )
emuObj.SetGsTitleFix( "globalSet", "reserved", { waveThreshold = 90000} )
emuObj.SetGsTitleFix( "ignoreAreaUpdate", 0, { } )
------------------------------------------------------------------------------------------------------
-- Accumulate fill area only when conditions are met
emuObj.SetGsTitleFix( "includeAreaUpdate", "reserved" , {alphaIsNot = 0, zmsk = 1, tw = 6, th = 6 , tbp = 0x00302000} )
emuObj.SetGsTitleFix( "ignoreUpRender", 130 , { totalArea= 700} )
------------------------------------------------------------------------------------------------------
-- Fix shadow
emuObj.SetGsTitleFix( "forceSimpleFetch", "reserved", { texMode=1 } )
------------------------------------------------------------------------------------------------------
-- Reduce flush count
emuObj.SetGsTitleFix( "SetSelfRender", "reserved", { fbmask= 0x00FFFFFF , renderSelf=1 , zmsk=1 , alpha=0 , texMode=1 } )
------------------------------------------------------------------------------------------------------
-- Disable post-processing
emuObj.SetGsTitleFix( "ignoreSprite", "reserved", { texType=1 , tw=5 , th=8, zmsk=1 , alpha=0x80000044 } )
------------------------------------------------------------------------------------------------------
-- Small triangle rejection. Works in conjunction with CLI setting gs-override-small-tri-area=1
-- keep default area for texture 256x256 ( no blend) (Anakin face)
emuObj.SetGsTitleFix( "setRejectionArea", 500,{twIsNot=8, thIsNot=8 } )
------------------------------------------------------------------------------------------------------
-- Set triangle rejection area= 1000 when alpha blend is not 0 ( i.e blend is On)
emuObj.SetGsTitleFix( "setRejectionArea", 1000, {alphaIsNot=0 } )
------------------------------------------------------------------------------------------------------
-- Performace fix
local thresholdArea = 600
emuObj.SetGsTitleFix( "ignoreUpRender", thresholdArea , {alpha=0x80008068 , zmsk=1 } )
------------------------------------------------------------------------------------------------------
-- Performace fix
local thresholdArea = 700
emuObj.SetGsTitleFix( "ignoreUpRender", thresholdArea , {alpha=0x80000044 , zmsk=1 } )
------------------------------------------------------------------------------------------------------
-- Disable uprender on the draw command which samples the framebuffer (0x3200) using bilinear sampling (texMode=2)
-- All lighting effects use TriFan prim type, so use that as well to filter against.
emuObj.SetGsTitleFix( "forceSimpleFetch", "reserved", {prim=5, texMode=2, tbp=0x320000} )
Commands
| Command | Notes |
|---|---|
| globalSet | used with workLoadThreshold or waveThreshold or loadThreshold |
| reserved | |
| forceBiLinear | |
| ignoreSubBuffCov | ignore ? buffer coverage |
| trianglesAsParticles | |
| ignoreAreaUpdate | |
| SetSelfRender | |
| ignoreSprite | |
| clipScissors | |
| forcePoint | |
| forcePointSampling | |
| setRejectionArea | |
| ignoreUpRender | Ignore uprender for texture type described in params |
| includeAreaUpdate | |
| forceSimpleFetch | Used Frequently To Fix Graphical Corruptions, emuObj.SetGsTitleFix( "forceSimpleFetch", "reserved", {psm=0} ) |
| fetchFromCurrBuff | emuObj.SetGsTitleFix( "fetchFromCurrBuff", "reserved", {psm=0} ) |
| ignoreUpShiftTri | emuObj.SetGsTitleFix( "ignoreUpShiftTri", "reserved", {psm=0} ) |
| skipPacked | |
| changeAlpha | |
| ignoreUpRenderTimeout |
Arguments/variables
| Argument | Notes |
|---|---|
| alpha_mask | |
| alphaIsNot | alpha - is not X |
| texMode | 1 - Point? , 2 - bilinear |
| twIsLess | texture width - is less than X |
| thIsLess | texture height - is less than X |
| twIsNot | texture width - is not X |
| thIsNot | texture width - is not X |
| psmIsNot | texture pixel storage format - is not X
PSMCT32 = 0 PSMT4HL = 36 PSMCT24 = 1 PSMT4HH = 44 PSMCT16 = 2 PSMZ32 = 48 PSMCT16S = 10 PSMZ24 = 49 PSMT8 = 19 PSMZ16 = 50 PSMT4 = 20 PSMZ16S = 58 PSMT8H = 27 |
| zmsk | Z (depth) draw mask
update Z buffer = 0 don't update Z buffer = 1 When 1 depth test result will be ignored |
| tw | texture width |
| th | texture height |
| ztst | Z (depht) test method
ZNOUSE = 0 ZALWAYS = 1 ZGEQUAL = 2 ZGREATER = 3 0 - All pixels fail 1 - All pixels pass 2 - Pass if Z grater or equal to Z buffer 3 - Pass if Z grater than Z buffer |
| mipIsGt | mip level is grater than X (?) |
| mmin | MMIN flag
NEAREST = 0 LINEAR = 1 NEAREST_MIPMAP_NEAREST = 2 NEAREST_MIPMAP_LINEAR = 3 LINEAR_MIPMAP_NEAREST = 4 LINEAR_MIPMAP_LINEAR = 5 |
| prim | GS primitive type
Point = 0 Line = 1 LineStrip = 2 Triangle = 3 TriangleStrip = 4 TriangleFan = 5 Sprite = 6 |
| primIsNot | GS primitive type - is not
Point = 0 Line = 1 LineStrip = 2 Triangle = 3 TriangleStrip = 4 TriangleFan = 5 Sprite = 6 |
| fillArea | |
| frameW | |
| renderSelf | |
| hasClut | |
| alphaTest | |
| primTest | |
| workLoadThreshold | |
| alpha | example: alpha=0x80000044 alpha=0 |
| texType | (1-3, more? ) |
| tbp | texture base pointer |
| cbp | CLUT buffer base pointer |
| psm | texture pixel storage format
PSMCT32 = 0 PSMT4HL = 36 PSMCT24 = 1 PSMT4HH = 44 PSMCT16 = 2 PSMZ32 = 48 PSMCT16S = 10 PSMZ24 = 49 PSMT8 = 19 PSMZ16 = 50 PSMT4 = 20 PSMZ16S = 58 PSMT8H = 27 |
| mxl | maximum mip level (0-6) |
| fbmask | ? |
| totalArea | |
| packedRegs | |
| packedRegsLo | |
| packedRegsHi | |
| packedRegsNum | |
| packedFlags | |
| packedPrim | |
| areaNumFrames | |
| waveThreshold | |
| loadThreshold | |
| fixSpriteDivTab |
Official examples
You can find the rest of them here
Canis Canem Edit
SLES 535.61
LUA
require( "ee-gpr-alias" ) -- you can access EE GPR by alias (gpr.a0 / gpr["a0"])
apiRequest(0.1)
-- EA sports cricket 07 bug 9392
-- Performance fix
local emuObj = getEmuObject()
local thresholdArea = 600
emuObj.SetGsTitleFix( "ignoreUpRender", thresholdArea , {alpha=0x80000044 , zmsk=1 , tw=4, th=4 } )
Custom config.lua examples
Here is the first custom lua config created by the community:
apiRequest(0.1) -- Fix black screen SLUS-20064 eeInsnReplace(0x1CF3CC, 0x4100ffff, 0x00000000) -- bc0f 0x1CF3CC to nop
This is very basic command to replace part of EE memory with other instruction.
- apiRequest(0.1) - Is required for every config. Used version depend on your original eboot highest supported api. 0.1 seems to be enough for basic patches like here. 2.3 is highest known for now.
- -- Fix black screen SLUS-20064 is comment
- eeInsnReplace(0x1CF3CC, 0x4100ffff, 0x00000000) is our true command here. We are replacing the value 0x4100FFFF to 0x00000000 at the offset of 0x1CF3CC . Like you can see we need to add what opcode is replaced. Not only patch, and memory offset.
- -- bc0f 0x1CF3CC to nop is just another comment, in this case explaining what is changed
Other custom configurations made by users can be found here
Memory Mapping
| Name | From | To |
|---|---|---|
| EE Flat Memory (4gb) | 0x0000008000000000 | 0x0000008100000000 |
| IOP Flat Memory (4gb) | 0x0000009000000000 | 0x0000009100000000 |
| R59 Binary Cache | 0x0000000914B10000 | 0x0000000916B10000 |
| R30 Binary Cache | 0x0000000916B14000 | 0x0000000917314000 |
| jitVU0 | 0x0000000917318000 | 0x0000000917B18000 |
| jitVU1 | 0x0000000917B1C000 | 0x0000000918B1C000 |
| Host's EE Memory Map | ||
| EE Registers Map | 0x0000001000000000 | 0x0000001000004000 |
| EE RAM - Kernel | 0x0000008000000000 | 0x0000008000080000 |
| EE RAM - Debug | 0x0000008000078000 | 0x0000008000080000 |
| EE RAM - User | 0x0000008000080000 | 0x0000008002000000 |
| EE Hw Devices | 0x0000008010000000 | 0x0000008010010000 |
| EE ROM | 0x000000801FC00000 | 0x000000801FFE0000 |
| EE RAM - Uncached | 0x0000008020080000 | 0x0000008022000000 |
| EE RAM - UncachedAccel | 0x0000008030100000 | 0x0000008032000000 |
| EE Scratchpad | 0x0000008070000000 | 0x0000008070004000 |
| EE Debug | 0x00000080FFFF8000 | 0x0000008100000000 |
| Host's IOP Memory Map | ||
| IOP RAM | 0x0000009000000000 | 0x0000009000200000 |
| IOP RAM (mirror 1) | 0x0000009000200000 | 0x0000009000400000 |
| IOP RAM (mirror 2) | 0x0000009000400000 | 0x0000009000600000 |
| IOP RAM (mirror 3) | 0x0000009000600000 | 0x0000009000800000 |
| IOP Scratchpad | 0x000000901F800000 | 0x000000901F801000 |
| IOP HW | 0x000000901F801000 | 0x000000901F810000 |
| IOP ROM | 0x000000901FC00000 | 0x000000901FFE0000 |
Registers Map
EE // IOP
Incomplete, there could be some incorrect information in this list.
Warning: 0x1000000xxx base is not guaranteed in different emu revisions, but layout should be the same regardless of base. if base is different (Like on kof2000), simply reduce these offsets by 8 hex values.
Tested on Jak v2 Eboot md5:c644f6879af225a6e5a70233fc4625a3
| GPR // EE | Address | FPR // FPU | Address | CP0 // COP0 | Address | GPR // IOP | Address | |||
|---|---|---|---|---|---|---|---|---|---|---|
| zero | 0x1000000000 | f00 | 0x1000000230 | Index | 0x10000002D0 | zero | 0x1020000000 | |||
| at | 0x1000000010 | f01 | 0x1000000234 | Random | 0x10000002D4 | at | 0x1020000004 | |||
| v0 | 0x1000000020 | f02 | 0x1000000238 | EntryLo0 | 0x10000002D8 | v0 | 0x1020000008 | |||
| v1 | 0x1000000030 | f03 | 0x100000023C | EntryLo1 | 0x10000002DC | v1 | 0x102000000C | |||
| a0 | 0x1000000040 | f04 | 0x1000000240 | Context | 0x10000002E0 | a0 | 0x1020000010 | |||
| a1 | 0x1000000050 | f05 | 0x1000000244 | PageMask | 0x10000002E4 | a1 | 0x1020000014 | |||
| a2 | 0x1000000060 | f06 | 0x1000000248 | Wired | 0x10000002E8 | a2 | 0x1020000018 | |||
| a3 | 0x1000000070 | f07 | 0x100000024C | rsvd7 | 0x10000002EC | a3 | 0x102000001C | |||
| t0 | 0x1000000080 | f08 | 0x1000000250 | BadVAddr | 0x10000002F0 | t0 | 0x1020000020 | |||
| t1 | 0x1000000090 | f09 | 0x1000000254 | Count | 0x10000002F4 | t1 | 0x1020000024 | |||
| t2 | 0x10000000A0 | f10 | 0x1000000258 | EntryHi | 0x10000002F8 | t2 | 0x1020000028 | |||
| t3 | 0x10000000B0 | f11 | 0x100000025C | Compare | 0x10000002FC | t3 | 0x102000002C | |||
| t4 | 0x10000000C0 | f12 | 0x1000000260 | Status | 0x1000000300 | t4 | 0x1020000030 | |||
| t5 | 0x10000000D0 | f13 | 0x1000000264 | Cause | 0x1000000304 | t5 | 0x1020000034 | |||
| t6 | 0x10000000E0 | f14 | 0x1000000268 | EPC | 0x1000000308 | t6 | 0x1020000038 | |||
| t7 | 0x10000000F0 | f15 | 0x100000026C | PRid | 0x100000030C | t7 | 0x102000003C | |||
| s0 | 0x1000000100 | f16 | 0x1000000270 | Config | 0x1000000310 | s0 | 0x1020000040 | |||
| s1 | 0x1000000110 | f17 | 0x1000000274 | Iab | 0x1000000314 | s1 | 0x1020000044 | |||
| s2 | 0x1000000120 | f18 | 0x1000000278 | Iabm | 0x1000000318 | s2 | 0x1020000048 | |||
| s3 | 0x1000000130 | f19 | 0x100000027C | Dab | 0x100000031C | s3 | 0x102000004C | |||
| s4 | 0x1000000140 | f20 | 0x1000000280 | Dabm | 0x1000000320 | s4 | 0x1020000050 | |||
| s5 | 0x1000000150 | f21 | 0x1000000284 | Dvm | 0x1000000324 | s5 | 0x1020000054 | |||
| s6 | 0x1000000160 | f22 | 0x1000000288 | Dvbm | 0x1000000328 | s6 | 0x1020000058 | |||
| s7 | 0x1000000170 | f23 | 0x100000028C | BadPAddr | 0x100000032C | s7 | 0x102000005C | |||
| t8 | 0x1000000180 | f24 | 0x1000000290 | Debug | 0x1000000330 | t8 | 0x1020000060 | |||
| t9 | 0x1000000190 | f25 | 0x1000000294 | Perf | 0x1000000334 | t9 | 0x1020000064 | |||
| k0 | 0x10000001A0 | f26 | 0x1000000298 | Pcr0 | 0x1000000338 | k0 | 0x1020000068 | |||
| k1 | 0x10000001B0 | f27 | 0x100000029C | Pcr1 | 0x100000033C | k1 | 0x102000006C | |||
| gp | 0x10000001C0 | f28 | 0x10000002A0 | TagLo | 0x1000000340 | gp | 0x1020000070 | |||
| sp | 0x10000001D0 | f29 | 0x10000002A4 | TagHi | 0x1000000344 | sp | 0x1020000074 | |||
| fp | 0x10000001E0 | f30 | 0x10000002A8 | ErrorEPC | 0x1000000348 | fp | 0x1020000078 | |||
| ra | 0x10000001F0 | f31 | 0x10000002AC | Rsvd31 | 0x100000034C | ra | 0x102000007C | |||
| unk (pc?) | 0x1000000200 | fACC | 0x10000002B0 | COP0 additional registers | pc | 0x102000008C | ||||
| hi/lo (2 x 64?) | 0x1000000210 | FPU CTRL (FCR) | real Pcr0 | 0x1000000350 | hi | 0x1020000090 ?? | ||||
| sa | 0x1000000220 | cp1cond | 0x10000002B4 | real Pcr1 | 0x1000000358 | lo | 0x1020000094 ?? | |||
| fpu ver | 0x10000002B8 | |||||||||
| fpu sticky | 0x10000002BC | |||||||||
| fpu ctrl | 0x10000002C0 | |||||||||
| 2CF unknown | 0x10000002C4 |
| "Fake" register | Address | Notes |
|---|---|---|
| (?) | 0x1000000360 | Locking the value seems to cause a crash. |
| Current PC | 0x1000000368 | Shows the current offset that's being read by the EE |
| (?) | 0x100000036C | it showed 0x80000184 in dbz bd 1 |
| Delta counter | 0x1000000370 | (Passed cycles, likely decrementer). Evt check is performed on branch test when 0. Fastforwardclock set this to 0, advanceclock subtract value from this fake reg) |
| Cycles | 0x1000000378 | (need work) |
| (?) | 0x1000000384 | Possibly used by sony for diagnosis. unlike the pc, this one doesn't change after a crash and has much lower latency Thus meaning it's better at diagnosing problems, still unknown what it is though |
VU0
| Register | W | Z | Y | X | Register | W | Z | Y | X | |
|---|---|---|---|---|---|---|---|---|---|---|
| vf00 | 0x103000000C | 0x1030000008 | 0x1030000004 | 0x1030000000 | vf17 | 0x103000011C | 0x1030000118 | 0x1030000114 | 0x1030000110 | |
| vf01 | 0x103000001C | 0x1030000018 | 0x1030000014 | 0x1030000010 | vf18 | 0x103000012C | 0x1030000128 | 0x1030000124 | 0x1030000120 | |
| vf02 | 0x103000002C | 0x1030000028 | 0x1030000024 | 0x1030000020 | vf19 | 0x103000013C | 0x1030000138 | 0x1030000134 | 0x1030000130 | |
| vf03 | 0x103000003C | 0x1030000038 | 0x1030000034 | 0x1030000030 | vf20 | 0x103000014C | 0x1030000148 | 0x1030000144 | 0x1030000140 | |
| vf04 | 0x103000004C | 0x1030000048 | 0x1030000044 | 0x1030000040 | vf21 | 0x103000015C | 0x1030000158 | 0x1030000154 | 0x1030000150 | |
| vf05 | 0x103000005C | 0x1030000058 | 0x1030000054 | 0x1030000050 | vf22 | 0x103000016C | 0x1030000168 | 0x1030000164 | 0x1030000160 | |
| vf06 | 0x103000006C | 0x1030000068 | 0x1030000064 | 0x1030000060 | vf23 | 0x103000017C | 0x1030000178 | 0x1030000174 | 0x1030000170 | |
| vf07 | 0x103000007C | 0x1030000078 | 0x1030000074 | 0x1030000070 | vf24 | 0x103000018C | 0x1030000188 | 0x1030000184 | 0x1030000180 | |
| vf08 | 0x103000008C | 0x1030000088 | 0x1030000084 | 0x1030000080 | vf25 | 0x103000019C | 0x1030000198 | 0x1030000194 | 0x1030000190 | |
| vf09 | 0x103000009C | 0x1030000098 | 0x1030000094 | 0x1030000090 | vf26 | 0x10300001AC | 0x10300001A8 | 0x10300001A4 | 0x10300001A0 | |
| vf10 | 0x10300000AC | 0x10300000A8 | 0x10300000A4 | 0x10300000A0 | vf27 | 0x10300001BC | 0x10300001B8 | 0x10300001B4 | 0x10300001B0 | |
| vf11 | 0x10300000BC | 0x10300000B8 | 0x10300000B4 | 0x10300000B0 | vf28 | 0x10300001CC | 0x10300001C8 | 0x10300001C4 | 0x10300001C0 | |
| vf12 | 0x10300000CC | 0x10300000C8 | 0x10300000C4 | 0x10300000C0 | vf29 | 0x10300001DC | 0x10300001D8 | 0x10300001D4 | 0x10300001D0 | |
| vf13 | 0x10300000DC | 0x10300000D8 | 0x10300000D4 | 0x10300000D0 | vf30 | 0x10300001EC | 0x10300001E8 | 0x10300001E4 | 0x10300001E0 | |
| vf14 | 0x10300000EC | 0x10300000E8 | 0x10300000E4 | 0x10300000E0 | vf31 | 0x10300001FC | 0x10300001F8 | 0x10300001F4 | 0x10300001F0 | |
| vf15 | 0x10300000FC | 0x10300000F8 | 0x10300000F4 | 0x10300000F0 | ACC | 0x103000020C | 0x1030000208 | 0x1030000204 | 0x1030000200 | |
| vf16 | 0x103000010C | 0x1030000108 | 0x1030000104 | 0x1030000100 |
| Register | Address | Register | Address | |
|---|---|---|---|---|
| vi00 | 0x1030000210 | Status | 0x1030000310?? | |
| vi01 | 0x1030000220 | MACflag | 0x1030000320?? | |
| vi02 | 0x1030000230 | Clipflag | 0x1030000330?? | |
| vi03 | 0x1030000240 | c2c19 | 0x1030000340?? | |
| vi04 | 0x1030000250 | R | 0x1030000350?? | |
| vi05 | 0x1030000260 | I | 0x1030000360 | |
| vi06 | 0x1030000270 | Q | 0x1030000370?? | |
| vi07 | 0x1030000280 | c2c23 | 0x1030000380?? | |
| vi08 | 0x1030000290 | c2c24 | 0x1030000390?? | |
| vi09 | 0x10300002A0 | c2c25 | 0x10300003A0?? | |
| vi10 | 0x10300002B0 | TPC | 0x10300003B0 | |
| vi11 | 0x10300002C0 | CMSAR0 | 0x10300003C0?? | |
| vi12 | 0x10300002D0 | FBRST | 0x10300003D0 | |
| vi13 | 0x10300002E0 | VPU-STAT | 0x10300003E0?? | |
| vi14 | 0x10300002F0 | CMSAR1 | 0x10300003F0?? | |
| vi15 | 0x1030000300 | c2c30 | 0x1030000400?? |
VU1
| Register | W | Z | Y | X | Register | W | Z | Y | X | |
|---|---|---|---|---|---|---|---|---|---|---|
| vf00 | 0x104000000C | 0x1040000008 | 0x1040000004 | 0x1040000000 | vf17 | 0x104000011C | 0x1040000118 | 0x1040000114 | 0x1040000110 | |
| vf01 | 0x104000001C | 0x1040000018 | 0x1040000014 | 0x1040000010 | vf18 | 0x104000012C | 0x1040000128 | 0x1040000124 | 0x1040000120 | |
| vf02 | 0x104000002C | 0x1040000028 | 0x1040000024 | 0x1040000020 | vf19 | 0x104000013C | 0x1040000138 | 0x1040000134 | 0x1040000130 | |
| vf03 | 0x104000003C | 0x1040000038 | 0x1040000034 | 0x1040000030 | vf20 | 0x104000014C | 0x1040000148 | 0x1040000144 | 0x1040000140 | |
| vf04 | 0x104000004C | 0x1040000048 | 0x1040000044 | 0x1040000040 | vf21 | 0x104000015C | 0x1040000158 | 0x1040000154 | 0x1040000150 | |
| vf05 | 0x104000005C | 0x1040000058 | 0x1040000054 | 0x1040000050 | vf22 | 0x104000016C | 0x1040000168 | 0x1040000164 | 0x1040000160 | |
| vf06 | 0x104000006C | 0x1040000068 | 0x1040000064 | 0x1040000060 | vf23 | 0x104000017C | 0x1040000178 | 0x1040000174 | 0x1040000170 | |
| vf07 | 0x104000007C | 0x1040000078 | 0x1040000074 | 0x1040000070 | vf24 | 0x104000018C | 0x1040000188 | 0x1040000184 | 0x1040000180 | |
| vf08 | 0x104000008C | 0x1040000088 | 0x1040000084 | 0x1040000080 | vf25 | 0x104000019C | 0x1040000198 | 0x1040000194 | 0x1040000190 | |
| vf09 | 0x104000009C | 0x1040000098 | 0x1040000094 | 0x1040000090 | vf26 | 0x10400001AC | 0x10400001A8 | 0x10400001A4 | 0x10400001A0 | |
| vf10 | 0x10400000AC | 0x10400000A8 | 0x10400000A4 | 0x10400000A0 | vf27 | 0x10400001BC | 0x10400001B8 | 0x10400001B4 | 0x10400001B0 | |
| vf11 | 0x10400000BC | 0x10400000B8 | 0x10400000B4 | 0x10400000B0 | vf28 | 0x10400001CC | 0x10400001C8 | 0x10400001C4 | 0x10400001C0 | |
| vf12 | 0x10400000CC | 0x10400000C8 | 0x10400000C4 | 0x10400000C0 | vf29 | 0x10400001DC | 0x10400001D8 | 0x10400001D4 | 0x10400001D0 | |
| vf13 | 0x10400000DC | 0x10400000D8 | 0x10400000D4 | 0x10400000D0 | vf30 | 0x10400001EC | 0x10400001E8 | 0x10400001E4 | 0x10400001E0 | |
| vf14 | 0x10400000EC | 0x10400000E8 | 0x10400000E4 | 0x10400000E0 | vf31 | 0x10400001FC | 0x10400001F8 | 0x10400001F4 | 0x10400001F0 | |
| vf15 | 0x10400000FC | 0x10400000F8 | 0x10400000F4 | 0x10400000F0 | ACC | 0x104000020C | 0x1040000208 | 0x1040000204 | 0x1040000200 | |
| vf16 | 0x104000010C | 0x1040000108 | 0x1040000104 | 0x1040000100 |
| Register | Address | Register | Address | |
|---|---|---|---|---|
| vi00 | 0x1040000210 | Status | 0x1040000310?? | |
| vi01 | 0x1040000220 | MACflag | 0x1040000320?? | |
| vi02 | 0x1040000230 | Clipflag | 0x1040000330?? | |
| vi03 | 0x1040000240 | c2c19 | 0x1040000340?? | |
| vi04 | 0x1040000250 | R | 0x1040000350?? | |
| vi05 | 0x1040000260 | I | 0x1040000360 | |
| vi06 | 0x1040000270 | Q | 0x1040000370?? | |
| vi07 | 0x1040000280 | c2c23 | 0x1040000380?? | |
| vi08 | 0x1040000290 | c2c24 | 0x1040000390?? | |
| vi09 | 0x10400002A0 | c2c25 | 0x10400003A0?? | |
| vi10 | 0x10400002B0 | TPC | 0x10400003B0 | |
| vi11 | 0x10400002C0 | CMSAR0 | 0x10400003C0?? | |
| vi12 | 0x10400002D0 | FBRST | 0x10400003D0 | |
| vi13 | 0x10400002E0 | VPU-STAT | 0x10400003E0?? | |
| vi14 | 0x10400002F0 | CMSAR1 | 0x10400003F0?? | |
| vi15 | 0x1040000300 | c2c30 | 0x1040000400?? |
Registers information
| Name | Purpose / info |
|---|---|
| zero | Hardwired to 0, writes are ignored |
| at | Temporary register used for pseudo-instructions |
| v0-v1 | Return register, holds values returned by functions |
| a0-a3 | Argument registers, holds first four parameters passed to a function |
| t0-t7 | Temporary registers. t0-t3 may also be used as additional argument registers |
| s0-s7 | Saved registers. Functions must save and restore these before using them |
| t8-t9 | Temporary registers |
| k0-k1 | Reserved for use by kernels |
| gp | Global pointer |
| sp | Stack pointer, address of currently-executing function |
| fp | Frame pointer |
| ra | Return address. Used by JAL and (usually) JALR to store the address to return to after a function |
| Special registers | |
| pc | Program counter, address of currently-executing instruction (32-bit) |
| hi/lo | Stores multiplication and division results (64-bit) |
| hi1/lo1 | Used by MULT1/DIV1 type instructions, same as above (64-bit) |
| sa | Shift amount used by QFSRV instruction |
Aside from zero, all GPRs may be freely accessed if convention rules are respected.
Open CL and Floats
PS4 native Floating point supports and OpenCL info, for both CPU, and GPU. Understanding of floating points conversion is very important in emulating PS2.
Below info comes from this gist
There you can find more info about PS4 OpenCL.
CPU
| Info | Value |
|---|---|
| Device Name | CXD90026AG - DG1002FGF84HT |
| Device Vendor | AuthenticAMD |
| Device Vendor ID | 0x1022 |
| Device OpenCL C Version | OpenCL C 1.2 pocl |
| Device Type | CPU |
| Max compute units | 8 |
| Max work item dimensions | 3 |
| Max work item sizes | 4096x4096x4096 |
| Max work group size | 4096 |
| Preferred work group size multiple | 8 |
| Half-precision Floating-point support | (n/a) |
| Single-precision Floating-point support | (core) |
| Denormals | Yes |
| Infinity and NANs | Yes |
| Round to nearest | Yes |
| Round to zero | Yes |
| Round to infinity | Yes |
| IEEE754-2008 fused multiply-add | No |
| Support is emulated in software | No |
| Correctly-rounded divide and sqrt operations | Yes |
| Double-precision Floating-point support | (cl_khr_fp64) |
| Denormals | Yes |
| Infinity and NANs | Yes |
| Round to nearest | Yes |
| Round to zero | Yes |
| Round to infinity | Yes |
| IEEE754-2008 fused multiply-add | Yes |
| Support is emulated in software | No |
| Execution capabilities | |
| Run OpenCL kernels | Yes |
| Run native kernels | Yes |
| SPIR versions | 1.2 |
| Device Extensions | cl_khr_byte_addressable_store cl_khr_global_int32_base_atomics cl_khr_global_int32_extended_atomics cl_khr_local_int32_base_atomics cl_khr_local_int32_extended_atomics cl_khr_3d_image_writes cl_khr_spir cl_khr_fp64 cl_khr_int64_base_atomics cl_khr_int64_extended_atomics |
GPU
| Info | Values |
|---|---|
| Device Name | AMD LIVERPOOL |
| Device Vendor | AMD |
| Device Vendor ID | 0x1002 |
| Device Version | OpenCL 1.1 |
| Device OpenCL C Version | OpenCL C 1.1 |
| Device Type | GPU |
| Max compute units | 18 |
| Max work item dimensions | 3 |
| Max work item sizes | 256x256x256 |
| Max work group size | 256 |
| Compiler Available | Yes |
| Preferred work group size multiple | 64 |
| Half-precision Floating-point support | (cl_khr_fp16) |
| Denormals | No |
| Infinity and NANs | Yes |
| Round to nearest | Yes |
| Round to zero | No |
| Round to infinity | No |
| IEEE754-2008 fused multiply-add | No |
| Support is emulated in software | No |
| Single-precision Floating-point support | (core) |
| Denormals | No |
| Infinity and NANs | Yes |
| Round to nearest | Yes |
| Round to zero | No |
| Round to infinity | No |
| IEEE754-2008 fused multiply-add | No |
| Support is emulated in software | No |
| Correctly-rounded divide and sqrt operations | No |
| Double-precision Floating-point support | (cl_khr_fp64) |
| Denormals | Yes |
| Infinity and NANs | Yes |
| Round to nearest | Yes |
| Round to zero | Yes |
| Round to infinity | Yes |
| IEEE754-2008 fused multiply-add | Yes |
| Support is emulated in software | No |
| Execution capabilities | |
| Run OpenCL kernels | Yes |
| Run native kernels | No |
| Device Extensions | cl_khr_byte_addressable_store cl_khr_byte_addressable_store cl_khr_global_int32_base_atomics cl_khr_global_int32_extended_atomics cl_khr_local_int32_base_atomics cl_khr_local_int32_extended_atomics cl_khr_int64_base_atomics cl_khr_int64_extended_atomics cl_khr_fp64 cl_khr_fp16 |
PS3 Config support
Emulator support configs in format known from ps2_netemu/ps2classic from PS3. This feature was
officially used in Arc the Lad Twilight of the Spirits ps2-ps4 classic.
To enable ps3 style config add this to config-emu-ps4.txt:
--lopnor-config=1
--ps2-title-id=TITLE-ID
Config file need to be in folder ...'''/patches/{TITLE-ID}/''' and file need to have name '''{TITLE-ID}_lopnor.cfgbin'''. title id need to be in XXXX-YYYYY format (ex. SLUS-12345).
Example path: /patches/SLUS-12345/SLUS-12345_lopnor.cfgbin
Tester confirmed that configs work like that. We don't even need to edit them, they work as is.
Please keep in mind that not all commands are recognized, only 0x01 (can depend upon emu revision), 0x09, 0x0A, 0x0B, 0x0F, 0x10, 0x26, 0x27, 0x42. For example Rayman 3 config Does not work due to the command being unsupported Command 0x07 is NOT recognized, but can be manually translated to cli config (to: --vu-xgkick-delay=value). Same goes for 0x11 (--vu0-accurate-addsub-range can be used).
- Configs explained in text form: https://github.com/Zarh/Get_CONFIG/blob/master/log.txt
- More about PS3 style configs/commands: https://www.psdevwiki.com/ps3/PS2_Emulation#Game_CONFIG
- Log from loading that kind of config: https://pastebin.com/ZpUyU8DE
Known issues
List of known issues in the PS4's PS2 emulator
| Issue | Games affected | Solution | Description |
|---|---|---|---|
Unknown iop issue |
Zatch Bell! Mamodo Fury, Godfather, Gran turismo 4, SSX | a Stutter that's not caused by performance but by inaccurate iop emulation leading to stuttering fmvs/mainmenu | |
Unknown GIF issues |
Tenchu - Fatal Shadows, Genji dawn of the samurai, Batman begins, Lara Croft Tomb Raider - The Angel of Darkness, Dragon ball z budokai tenkaichi 1, Possibly many more! |
LUA patches | |
No support for EE Cache |
Ice Age 2, DOA2: Extreme, Nascar 2009, Barnyard,Others |
Lua patches to the EE memory and picking the right emulator |
It's not a ps4 issue per say since these issues are also encountered by Pcsx2. but Pcsx2 does have support for EE cache, though it doesn't use it to fix these games because emulating EE cache is extremely slow. so that's why the Pcsx2 team decided to use pnach patches to fix this issue. |
VU0/COP2 is not running in sync with EE core |
24 The Game, ATV Quad Power Racing 2, Twisted Metal Head-On, Primal, Ghosthunter, Rayman Arena, Rayman 3, Largo winch. All games using M-bit.other games affected by COP2 timing |
ee hook AdvanceClock or fastforwardclock commands on affected addresses, Most of the time it will be CTC2 instructions that are affected Or using Kozraovv's method of EE memory patching |
Rayman 3's fix for example
This issue can also be replicated on Pcsx2 if you overclock the EE by +3 |
No roundmode support for VU or FPU |
Koun, Tony hawk games, Devil may cry 3, Gun, TY the Tasmanian Tiger 3, Beyond Good & Evil, MTX Mototrax, Many others |
Lua patches to the EE memory |
|
No M-Bit support |
Every game that uses M-Bit. Totally Spies! Totally Party, Mike Tyson Heavyweight Boxing, My Street, Crash Twinsanity, Marvel Nemesis, Panzer Elite Action - Fields of Glory, Super Monkey Ball Adventure, most Eko Software games, and many more.[3] |
Lua patches to the EE memory |
M-bit: Only applicable for VU0. Ends interlock on a single QMTC2.I/CTC2.I instruction, allowing the EE to continue execution |
Wrong read speed for some games |
Shadowman(Textures), God of war (Music), Ratchet and clank size matters (Music), every game that's listed to require CDVD_READ_DELAY.and many other affected games |
Try your luck with IOP and CDVD CLI commands. | Also known in sony's bios as CDVD_READ_DELAY |
In-accurate VU0/VU1/COP2 emulation |
Sly cooper games, Crash twinsanity, Crazy frog racer, Rayman 3, Koei tecmo games, Klonoa 2, others. |
Choosing a VU accurate emulator such as Roguev1 or Kof2000 with the right clamping commands |
The issue leads to SPS and graphical issues and sometimes freezing. |
In-accurate Multiply/Divide/Add/Subtract instructions |
Max payne, Bully, Jackie chan adventures, Wild arms 3, Pac-man World 3, Gran turismo 4, Others |
Addsub/Muldiv Cli commands |
Causes many geometry issues and black screens. Sony reduced the accuracy of these instructions to improve performance |
Multitap doesn't support all games |
Urban reign, many others |
None | |
DMA writes when busy signal is engaged |
Ratchet and clank games, Metal gear solid 2, others | None yet | AKA eetiminghack |
VU1 running too fast (DMA sync) |
Harry Potter the Chamber of secrets, Mercenaries 2 | None yet | |
VIF1 runs instantly |
Urban reign, Avatar, Parappa 2, Eternal Poison, Soul Calibur 2, Soul Calibur 3, Others |
Using LUA's SchedulerDelayEvent command or Using CLI'S vif1-instant-xfer command |
Sony wanted to improve the performance, which is the reason VIF1 is instant. The lua's command can be customizable to set the delay period, the cli can't, therefore lua's command is much more compatible |
Inaccuracies in the IPU |
Burnout 3, Onimusha dawn of dreams | None yet |
Diagnosing problems
This guide will assist you in tracing the issue's cause,The list is based on what you can possibly solve using CLI
also don't forget to Check out ps3 Emulator Bugs, since many of them also exist in the ps4
| Issue | VU1 | EE | GS | VIF | IOP | COP2 | VU0 | VU | FPU | SIF |
|---|---|---|---|---|---|---|---|---|---|---|
| Performance | ✔ | ✔ | ✔ | ? | ||||||
| Crashes | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | |
| Broken graphics | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ||||
| Glitches | ✔ | ✔ | ✔ | ✔ | ✔ |
Performance bottleneck order:
VU1 ==> EE ==> GS As you can see, the biggest bottleneck for the ps4 is the emulated VU1, therefore it's speedhacks will be the most effective for performance.
Debugging through PS4CHEATER
You can also use for instance the program PS4CHEATER and add the addresses of 1000000368 (Jakv2 uses this offset) 1000000360 (Emus with older revision use this one) And change the type into > View as Hex. Make sure live cheats is on. One of them will show the Current (Program counter) which will lead you to find out which EE offset the game gets stuck on! or offsets that get repeated/cause performance problems
Faqs
A section dedicated to sharing knowledge about PS2 emulation in PS4
Emulator's grammar
This list was made since most of the emulator's Commands and /or Wiki instructions are hard to comprehend for most users.
Insn = Instruction | lopnor = (Ps3 config) [It's unknown what lopnor stands for] Addsub = Add / Subtract (MATH) | CLI = Command line instruction (?) muldiv = Multiply / Divide (MATH) | Mem = Memory opt = Optimize (?) Option(?) | Int = Integer (?) jr = Jump register | cmd = Command ad = Address (?) | XXXX-YYYYY = The ps2 game's region code inst = Instant (?) | PC = Program counter Scalar = A multiplier for the default value | Hook = Attach a function to an offset r59 = EE | ∞ = No limit for possible values (Int32) r30 = IOP | SPS = Spiky polygon syndrome (Another type of graphical glitches) ===============================================================================================================================
CLI
Making a comment inside the CLI
1.You can make a comment inside a cli by using a Hashtag (#) at the start of the comment Example: #Speedup --vu1-mpg-cycles=1000 2.Your comments will be fully ignored if they are in the same line as the hashtag Example: #This is a comment Incorrect example: #This is a comment This is not a part of the comment and will crash the emu 3. hyphens are the start of a command in CLI (--) And as for the equals, (=) everything that comes after it is the value that the command will use On a lua hyphens (--) mean it is a comment, but on the cli it's the start of the command. 4. Commands cannot contain spaces Example: --ee-cycle-scalar=0.1 Incorrect example: --ee cycle scalar = 0.1
Making a CLI.
1. You can use any text editor to make a CLI 2. Each command has to be below the previous one and they cannot share the same line. Correct CLI example: --vu1-mpg-cycles=1000 --ee-cycle-scalar=1.1 Incorrect CLI example: --vu1-mpg-cycles=1000 --ee-cycle-scalar=1.1 3. Your commands cannot contain spaces 4. Values start after the (=) sign 5. Commands can possibly contain multiple value entries and some values can be skipped by adding (,,). Example: --ee-hook=0x0028A578,AdvanceClock,,1000 Unskipped value example: --ee-hook=0x0028A578,AdvanceClock,0x13a893bd,1000
LUA
Making a lua
When making a lua there is 1 part that is always necessary (Apirequest) and 2 parts that are almost always necessary (Object) (Object's commands). By order it goes like this: 1. Apirequest 2. Object calling, gsobj/eeobj/iopobj, etc 3. the object's command You cannot call an object without first requesting an api, as that will cause a crash. and you most certainly cannot use an object's command without calling the object first For instance you cannot use iopObj.ReadMem32(0x400000) Without first having this in your lua local iopObj = getIOPObject()
Making a comment inside the lua
You can make a comment in a lua by using two hyphens (--) Your comments will be ignored by the lua You can also use --[[ (comment) --]] All text between --[[ and --]] will be ignored by lua
Commands
(Cycle scalars)
Cycle scalar commands are basically a scale between overclock and cycle skip (Underclock), we say that to simplify for anyone making configs, but in the truth it controls cycle speed of that Processor whether it be (IOP) or (SIF) or (EE). Slowing the cycles can be done by setting it higher than 1.0 (Underclock) (Cycle skip) Speeding up the cycles can be done by setting it anything lower than 1.0 (Overclock) So, it's basically a multiplier of the Processor's cycle speed in a way that's connected to the Delta counter. Sony uses all of them to improve sync, It's recommended to use them for sync also considering that using them can possibly cause stuttering or input lag with no real benefit. Except for eecyclescalar. as using it can be very helpful for performance gain when you slow down the cycles (Anything higher than 1.0). Some games like (Metal gear solid 3) want a very fast EE cycle speed, and will refuse to work if it's at the Default speed. (0.1) is the highest number for overclocking And (1.0) is the Default clock value. And (5.0) is the highest value for Underclocking (Cycle skipping) For the (IOP) and (EE) As for the (SIF) it has no limit for underclocking.
(vu1/0 mpg cycles)
This command sets the cycle speed of vu1 or vu0. 0.1 is the fastest cycle speed and the most compatible (Slowest in terms of performance). 100 is the default value set by sony 1000 is the recommended value for performance gain but you can increase it to any value you like.
- How to create general patches for PS2 games
- Knowledge about Assembly instructions in PS2
- Thread with 60 fps patches
- A great website for learning about PS2 hardware
PS2 Bios
Description
The PS2 bios is the file PS20220WD20050620.crack included in every PS2 game .pkg. It Is exactly the same BIOS that Sony used in ps2_netemu.self in PS3. Due to lack of many X modules homebrew compatibility is limited, and many of those need to be recompiled to use non X versions of modules, or need to load open source versions of them thru mc/cdvd. Important non X module that is missing is libsd, and homebrew that need it, will most likely fail to boot, or error.
Bios is know to blacklist some titles, and refuse to boot them. This include all titles with 00000000 000000A0 flag from that list (click here)
More about the bios
Bios version seems to be Developement v2.20 from Japan region (22/01/2007), but it's of course not limited to booting only NTSC-J games. Emulator not support USB peripherals, but this seems to be not limitation of BIOS, as it is used also in CECH C/E PS3 consoles. There are signs that different bios version exist, named PS20190AC20030623_nordram_miniOSD.bin. This bios have included handy extensions for debugging, and can debug print with "debug osd verbosity" from CLI set to "verbose". Most noticeable difference for both bios files seems to be special RDRAM module. While PS3 emulators patch bios to preferred region, emulator used in PS4 use so called CallHook which is known better for pcsx2 users as fastboot. No need to describe patch here, just look at PCSX2 fastboot code. It's literally the same code, but PS4 emus don't have patches for different bios revisions.
Bios file information:
File name: PS20220WD20050620.crack MD5: 83AD2B530C9C102A561BA1CDC6D996D5
Files inside ROM image
| File | Offset in exported bin | Description | File type (exportable) |
|---|---|---|---|
| RESET | 0x00 | Bootstrap code for the EE and IOP. | BIN |
| ROMDIR | 0x2780 | The ROMDIR part of the ROM image, which provides information on the location and name of files contained in the image. | BIN |
| EXTINFO | 0x2CC0 | Contains the "EXTINFO" for all files in the ROM image. | BIN |
| SBIN | 0x3330 | Seems to be the pad controller library for the PS1 monitor. | BIN |
| LOGO | 0xA2D0 | PS1 logo? | BIN |
| IOPBTCONF | 00x1EA20 | Boot configuration file for the IOP, during the final phase of the IOP reset. If no UDNL module is specified, the IOP will only have a single IOP reset in the reboot process, with the modules listed in IOPBTCONF. | BIN |
| IOPBTCON2 | 0x1EB10 | Boot configuration file for the IOP, for the first phase of the IOP reset (before UDNL is loaded). | BIN |
| SYSMEM | 0x1EBE0 | System Memory Manager. | ELF |
| LOADCORE | 0x1FE00 | The core of IOP module loading. Provides the lowest level of IOP module loading functions. Also handles the startup of the IOP. | ELF |
| EXCEPMAN | 0x22380 | Exception manager. | ELF |
| INTRMANP | 0x22F60 | Interrupt Manager. According to wisi, it is for PS mode. | ELF |
| INTRMANI | 0x24970 | Interrupt Manager. According to wisi, it is for IOP mode. | ELF |
| SSBUSC | 0x267B0 | SSBUS Controller library. The SSBUS seems to be the bus that all peripherals get connected to. It seems to have the power to control the mapping of the device registers, as well as access timing. | ELF |
| TIMEMANP | 0x26F20 | Timer Manager (PS mode) | ELF |
| TIMEMANI | 0x27B00 | Timer Manager (IOP mode) | ELF |
| DMACMAN | 0x28730 | DMA Controller Manager. | ELF |
| SYSCLIB | 0x2BE30 | System C Library. | ELF |
| HEAPLIB | 0x2E590 | Memory HEAP LIBrary (i.e. thvpool, thfpool) | ELF |
| THREADLIB | 0x2F290 | Multi_Thread_Manager | ELF |
| VBLANK | 0x38020 | V-Blank management | ELF |
| IOMAN | 0x38DB0 | IO Manager | ELF |
| MODLOAD | 0x3AD20 | IOP module loader. | ELF |
| ROMDRV | 0x3D070 | ROM driver. Provides access to the boot ROM (rom0). | ELF |
| ADDDRV | 0x3DF60 | Adds support for the DVD ROM (rom1:), via ROMDRV. | ELF |
| STDIO | 0x3D3C0 | Standard I/O library. | ELF |
| SIFMAN | 0x3EFB0 | SIF manager. | ELF |
| SIFINIT | 0x40550 | Initializes the SIF. | ELF |
| EESYNC | 0x40970 | For synchronizing with the EE, at the end of IOP resets. EESYNC from DNAS images are evil; they also perform a memory wipe of the region from 0x00084000 to .0x00100000. | ELF |
| EENULL | 0x40E10 | The idle thread (id #0) module, in ps2 loaded to 0x00081FC0. | BIN |
| PS1ID | 0x40E50 | Only found in newer boot ROMs | BIN |
| LIBFI | 0x40E60 | Not present in the boot ROM of the SCPH-10000 and SCPH-15000. | BIN |
| PS1VERJ | 0x40F50 | BIN | |
| PS1VERA | 0x40F60 | BIN | |
| PS1VERE | 0x40F70 | BIN | |
| PS1VERC | 0x40F80 | BIN | |
| PS1VERH | 0x40F90 | BIN | |
| OSDSYS | 0x40FA0 | The browser | BIN |
| - | 0x40FB0 | BIN | |
| RDRAM | 0x41000 | Provides a RDRAM test for the EE at power-on. This is run from RESET. | BIN |
| EELOADCNF | 0x43D50 | Contains the IOP boot configuration file for EELOAD. | BIN |
| SIFCMD | 0x43F00 | SIF command module. Contains the SIF command and SIF RPC functions. | ELF |
| REBOOT | 0x46140 | The reboot service. Receives IOP reset packets from the EE, from across the SIF. | ELF |
| LOADFILE | 0x46910 | The RPC server for MODLOAD | ELF |
| EECONF | 0x49070 | Loads part of the system configuration from the MECHACON EEPROM. Also configures and resets some peripherals, depending on the model version. In slimlines, and possibly on PS3 EECONF will also load the MAC address. | ELF |
| - | 0x49FF0 | BIN | |
| IOPBOOT | 0x4A000 | IOP bootup program | BIN |
| - | 0x4B160 | BIN | |
| TBIN | 0x4B800 | The PS1 monitor program. Seems to be the PS1 BIOS. This is started by RESET, when the IOP is in PS1 mode. | BIN |
| XSHA1 | 0x59770 | sha1 - this only present in PS3. It is used as additional antipiracy check. It seems that it calculate disc main elf checksum and compares it with some database. Config related? | ELF |
| XLOADFILE | 0x5A740 | Updated module | ELF |
| SIO2MAN | 0x5D7F0 | SIO2 manager. Provides access to the SIO2 interface. | ELF |
| - | 0x5F420 | BIN | |
| MCSERV | 0x61340 | RPC server for MCMAN. | ELF |
| - | 0x63040 | BIN | |
| KROMG | 0x64000 | BIN | |
| - | 0x65CC0 | BIN | |
| KROM | 0x66000 | Kanji ROM? Not sure where this is used. | BIN |
| - | 0x7FE70 | BIN | |
| ROMVER | 0x7FF00 | ROM version. | BIN |
| - | 0x7FF10 | BIN | |
| VERSTR | 0x7FF30 | Version string. Probably PS1 ROM will use this because that this string is also present in PlayStation consoles. | BIN |
| - | 0x7FF90 | BIN | |
| ROMGSCRT | 0x80000 | BIN | |
| NCDVDMAN | 0x82D30 | It seems to be a heavily stripped-down CDVDMAN module, with no support for some S-command functions like sceCdRI. | ELF |
| SECRMAN | 0x8F770 | Security Manager. Signing is NOT done with the one in ROM, but with a special version that comes with the utility discs. Looks like PS3 units have a different SECRMAN module from retail sets, similar to PS2 TOOL one. | ELF |
| MCMAN | 0x93C30 | Memory Card Manager. | ELF |
| PADMAN | 0xA30C0 | Pad manager. | ELF |
| CDVDMAN | 0xAC810 | The CD/DVD manager. | ELF |
| CDVDFSV | 0xB4BC0 | The RPC server for CDVDMAN. | ELF |
| FILEIO | 0xBCF80 | RPC server for IOMAN. Sony has greatly changed the semantics and design of FILEIO after some point. Connecting an old FILEIO EE RPC client to a newer server will result in a severe IOP crash. | ELF |
| CLEARSPU | 0xBF080 | Seems to clear/reset the SPU, but is known to cause crashes under some conditions. Not sure if it's buggy or not. Only used by the OSDSYS of the SCPH-10000 and SCPH-15000, probably retained for backward-compatibility. | ELF |
| UDNL | 0xC0CC0 | It is responsible for selecting the modules and starting the IOP, during the final phase of the IOP reset where the desired modules are to be loaded into the IOP. | ELF |
| IGREETING | 0xC2BC0 | Displays boot information (i.e. IOP boot type, EBOOTP, IBOOTP, switch positions for DSW602 and the type of DSW602 board installed | ELF |
| EELOAD | 0xC3C20 | The EE ELF loader, which is loaded by LoadExecPS2() to 0x00082000 in PS2 for loading ELFs. | BIN |
| XCDVDMAN | 0xD2DA0 | cdvd_driver - Updated module | ELF |
| XCDVDFSV | 0xE1B30 | cdvd_ee_driver - Updated module | ELF |
| OSDSND | 0xEFF60 | OSD sound library. This is actually the tentative sound driver, which is called "librspu2" in the Sony SDK. | ELF |
| PS2LOGO | 0x11ABB0 | Displays the PlayStation 2 logo from the inserted disc. For newer consoles, if the logo cannot be decrypted properly, it will fall back to the browser. Not actually required to boot games, but the Sony OSDSYS boots PS2 games through this program. | ELF |
| XPARAM2 | 0x137500 | File store per title settings for IOP emulation (XPARAM available also in real PS2 since 750XX where Deckard powerPC was introduced) | ELF |
| OSDSYS | 0x139A00 | The browser | BIN |
| PIOPRP | 0x177880 | Present in the PS3 ps2_(gx/soft/net)emu; contains version 3.1.0 of the IOP software (compared to version 1.3.4 on the root). | BIN |
| KERNEL | 0x1BB7E0 | The EE kernel | BIN |
Description source: https://gist.github.com/uyjulian/25291080f083987d3f3c134f593483c5
Game_ID/DiscID in PS20220WD20050620.crack
There are 193 titleIDs listed inside XPARAM2.ELF file of PS2 Bios included in PS20220WD20050620.crack. XPARAM2.ELF is called by OSDSYS, then ID check is performed. If titleID match to one of included in the table, different IOP emulation settings are applied. This include blacklisting for some specific titles. Original PS2 bios from models with emulated IOP, include similar list file called XPARAM.ELF. Title IDs there are not the same, although some of them exist on both lists.
| Command | Name | Fix on ps4 / Explanation |
|---|---|---|
| 0x00 | TITLE_MASK | Black-listed games if 0xA0000000 value |
| 0x01 | SIO2_MASK | |
| 0x02 | DEV9_MASK | Emulates dummy ethernet connection |
| 0x03 | USB_MASK | |
| 0x04 | SIF_DMA_SYNC | |
| 0x05 | SIF_DMA_LOAD | |
| 0x06 | DMAC_CH10_INT_DELAY | |
| 0x07 | MECHA_RECOGTIME | |
| 0x08 | CPU_DELAY | Most likely requires different IOP clock speed --iop-cycle-scalar=0.1 |
| 0x09 | DEV5_INT_SPEED | |
| 0x0A | CDVD_READ_DELAY | CDVD commands |
| 0x0B | SPU2_BEHAVIOR |
| ID | Title | Command | Value | Remarks |
|---|---|---|---|---|
| PBPX_952.01 | DVD Utility Disc Version 1.00 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PBPX_952.02 | DVD Utility Disc Version 1.01 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PBPX_952.03 | DVD Utility Disc Version 1.01 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PBPX_952.06 | DVD Player (Version 2.01) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PBPX_952.07 | DVD Player (Version 2.10) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PBPX_952.08 | DVD Player (Version 2.10) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PBPX_952.09 | DVD Player (Version 2.10) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PBPX_952.10 | DVD Utility Disc Version 2.10 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PBPX_952.11 | DVD Utility Disc Version 1.00 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PBPX_952.21 | DVD Player (Version 2.12) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PBPX_952.22 | DVD Player (Version 2.14) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PBPX_952.24 | DVD Player (Version 2.16) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PBPX_952.28 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag | |
| PBPX_952.35 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag | |
| PBPX_952.39 | Online Start Up Disc v3.0 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PBPX_955.01 | Linux for PS2 Beta Release 1 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PBPX_955.07 | Playstation 2 Linux Runtime Environment v1.0 (Disc 1) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PBPX_955.09 | Linux for PS2 Release 1.0 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PBPX_955.18 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag | |
| PDPX_991.09 | DVD Player (Version 3.04) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PSXC_002.01 | PSX Update Disc 1.10 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PSXC_002.02 | PSX Update Disc 1.20 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PSXC_002.03 | PSX Update Disc 1.31 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| PTPX_970.38 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag | |
| SCAJ_201.25 | Tekken 5 | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
| SCAJ_201.26 | Tekken 5 | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
| SCES_532.02 | Tekken 5 | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
| SCKA_200.49 | Tekken 5 | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
| SCPM_621.15 | 0x00 | 0x1000000 | TITLE_MASK | |
| SCPM_621.16 | 0x00 | 0x1000000 | TITLE_MASK | |
| SCPN_601.01 | PlayStation BB Navigator (Version 0.10) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| SCPN_601.30 | PlayStation BB Navigator (Version 0.20) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| SCPN_601.40 | PlayStation BB Navigator (Version 0.30) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| SCPN_601.50 | PlayStation BB Navigator (Version 0.31) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| SCPN_601.60 | PlayStation BB Navigator (Version 0.32) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| SCPS_110.01 | I.Q. Remix | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| SCPS_110.10 | Yoake no Mariko (Performance Pack Edition) | 0x01 | 0x1800 | SIO2_MASK |
| SCPS_110.18 | Yoake no Mariko | 0x01 | 0x1800 | SIO2_MASK |
| SCPS_110.21 | Yoake no Mariko 2nd Act (Limited Edition) | 0x01 | 0x1800 | SIO2_MASK |
| SCPS_110.22 | Yoake no Mariko 2nd Act | 0x01 | 0x1800 | SIO2_MASK |
| SCPS_150.38 | Lifeline | 0x0A | 0x80300 | CDVD_READ_DELAY |
| SCPS_150.39 | Lifeline | 0x0A | 0x80300 | CDVD_READ_DELAY |
| SCPS_170.01 | Gran Turismo 4 | 0x0B | 0x10000000 | SPU2_BEHAVIOR |
| SCPS_175.01 | Linux (for PlayStation2) Release 1.0 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| SCPS_200.39 | 0x00 | 0x4000000 | TITLE_MASK | |
| SCUS_971.67 | PaRappa the Rapper 2 | 0x04 | 0x2000 | SIF_DMA_SYNC |
| SCUS_972.69 | Final Fantasy XI [Disc 2] | 0x02 | 0xB | DEV9_MASK |
| SLES_500.48 | Donald Duck: Quack Attack | 0x01 | 0x800 | SIO2_MASK |
| SLES_500.62 | Orphen: Scion of Sorcery | 0x08 | 0xC1C | CPU_DELAY |
| SLES_503.64 | City Crisis | 0x0A | 0x80BB8 | CDVD_READ_DELAY |
| SLES_504.46 | Shadow Man 2: The Second Coming | 0x0A | 0x80600 | CDVD_READ_DELAY |
| SLES_505.40 | Simpsons: Road Rage | 0x01 | 0x800 | SIO2_MASK |
| SLES_506.08 | Shadow Man 2: The Second Coming | 0x0A | 0x80600 | CDVD_READ_DELAY |
| SLES_506.28 | Simpsons: Road Rage | 0x01 | 0x800 | SIO2_MASK |
| SLES_507.28 | Tiger Woods PGA Tour 2002 | 0x0A | 0x803E8 | CDVD_READ_DELAY |
| SLES_507.29 | 0x0A | 0x803E8 | CDVD_READ_DELAY | |
| SLES_512.82 | Tiger Woods PGA Tour 2003 | 0x0A | 0x803E8 | CDVD_READ_DELAY |
| SLES_514.79 | Def Jam Vendetta | 0x01 | 0x802 | SIO2_MASK |
| SLES_518.41 | SpyHunter 2 | 0x01 | 0x800 | SIO2_MASK |
| SLES_518.44 | Time Crisis 3 | 0x01 | 0x800 | SIO2_MASK |
| SLES_519.97 | SWAT: Global Strike Team | 0x01 | 0x800 | SIO2_MASK |
| SLES_520.97 | SWAT: Global Strike Force | 0x01 | 0x800 | SIO2_MASK |
| SLES_530.37 | Super Monkey Ball Deluxe | 0x01 | 0x802 | SIO2_MASK |
| SLES_536.68 | Micro Machines v4 | 0x01 | 0x801 | SIO2_MASK |
| SLES_537.55 | Castlevania: Curse of Darkness | 0x04 | 0x10 | SIF_DMA_SYNC |
| SLES_537.96 | FIFA Street 2 | 0x01 | 0x1800 | SIO2_MASK |
| SLPM_620.42 | Kurogane no Houkou: Warship Commander | 0x01 | 0x3000 | SIO2_MASK |
| SLPM_620.62 | Gitaroo Man One | 0x0A | 0x80540 | CDVD_READ_DELAY |
| SLPM_621.05 | Taikou Risshiden IV | 0x09 | 0x2B47000A | DEV5_INT_SPEED |
| SLPM_621.24 | Ready 2 Rumble Boxing: Round 2 | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_621.25 | Gauntlet: Dark Legacy | 0x08 | 0xC1C | CPU_DELAY |
| SLPM_621.25 | Gauntlet: Dark Legacy | 0x09 | 0x2B470005 | DEV5_INT_SPEED |
| SLPM_621.35 | Final Fantasy: XI (Beta Version) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
| SLPM_621.54 | DDRMAX Dance Dance Revolution 6thMix | 0x08 | 0x1A5E | CPU_DELAY |
| SLPM_622.39 | Supercar Street Challenge | 0x0A | 0x80300 | CDVD_READ_DELAY |
| SLPM_623.69 | Karaoke Revolution: J-Pop Vol.1 | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_623.79 | Karaoke Revolution: J-Pop Vol.2 | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_623.80 | Karaoke Revolution: J-Pop Vol.3 | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_623.81 | Karaoke Revolution: J-Pop Vol.4 | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_623.82 | Karaoke Revolution: Love & Ballad | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_623.83 | Karaoke Revolution: Night Selection 2003 | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_624.14 | Karaoke Revolution: Dreams & Memories | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_624.37 | Suisui Sweet: Amai Ai no Mitsukekata | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
| SLPM_624.50 | Karaoke Revolution: Anime Song Selection | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_624.51 | Karaoke Revolution: J-Pop Vol.5 | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_624.54 | Karaoke Revolution: J-Pop Vol.6 | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_624.55 | Karaoke Revolution: J-Pop Vol.7 | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_624.56 | Karaoke Revolution: J-Pop Vol.8 | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_624.57 | Karaoke Revolution: Snow & Party | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_624.64 | Pop'n Taisen Pazurudame Online | 0x08 | 0x1F40 | CPU_DELAY |
| SLPM_624.79 | Karaoke Revolution: J-Pop Vol.9 | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_624.91 | Mega Man: The Power Battle | 0x04 | 0x2000 | SIF_DMA_SYNC |
| SLPM_624.92 | Karaoke Revolution: Kids Song Selection | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_625.28 | Karaoke Revolution: Kazoku Idol Sengen (Bundle Edition) | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_625.29 | Karaoke Revolution: Kazoku Idol Sengen | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_650.86 | A Visual Mix: Ayumi Hamasaki Dome Tour 2001 (Disc 1) | 0x08 | 0x1450 | CPU_DELAY |
| SLPM_650.87 | A Visual Mix: Ayumi Hamasaki Dome Tour 2001 (Disc 2) | 0x08 | 0x1450 | CPU_DELAY |
| SLPM_650.90 | Spy Hunter | 0x01 | 0x1800 | SIO2_MASK |
| SLPM_651.97 | Nobunaga's Ambition Online | 0x02 | 0xB | DEV9_MASK |
| SLPM_652.09 | Star Ocean: Till the End of Time | 0x0B | 0x20014 | SPU2_BEHAVIOR |
| SLPM_654.38 | Star Ocean: Till the End of Time (Director's Cut) (Disc 1) | 0x0B | 0x20014 | SPU2_BEHAVIOR |
| SLPM_654.39 | Star Ocean: Till the End of Time (Director's Cut) (Disc 2) | 0x0B | 0x20014 | SPU2_BEHAVIOR |
| SLPM_654.88 | Grand Theft Auto: Vice City | 0x0A | 0x300 | CDVD_READ_DELAY |
| SLPM_654.88 | Grand Theft Auto: Vice City | 0x09 | 0x36000200 | DEV5_INT_SPEED |
| SLPM_656.33 | I Love Baseball: Pro Yakyu wo Koyonaku | 0x08 | 0xFA0 | CPU_DELAY |
| SLPM_656.98 | Love Songs: ADV Futaba Riho 14-sai Natsu | 0x0A | 0x80380 | CDVD_READ_DELAY |
| SLPM_657.05 | Final Fantasy XI: Chains of Promathia (Expansion Disc) | 0x02 | 0xB | DEV9_MASK |
| SLPM_657.06 | Final Fantasy XI: Chains of Promathia (All-In-One Edition) | 0x02 | 0xB | DEV9_MASK |
| SLPM_657.19 | Burnout 3: Takedown | 0x01 | 0x1C00 | SIO2_MASK |
| SLPM_657.83 | Nobunaga no Yabou Online: Tappi no Shou | 0x02 | 0xB | DEV9_MASK |
| SLPM_658.94 | Winning Post 6: 2005 Version | 0x01 | 0x2400 | SIO2_MASK |
| SLPM_659.34 | Maple Colors | 0x0A | 0x80300 | CDVD_READ_DELAY |
| SLPM_659.53 | Final Fantasy: XI (Entry Disc 2005) | 0x02 | 0xB | DEV9_MASK |
| SLPM_659.84 | Grand Theft Auto: San Andreas | 0x0A | 0x803E8 | CDVD_READ_DELAY |
| SLPM_660.33 | The Sword of Etheria | 0x08 | 0xC1C | CPU_DELAY |
| SLPM_660.33 | The Sword of Etheria | 0x00 | 0x2000000 | TITLE_MASK |
| SLPM_660.48 | The Sword of Etheria | 0x08 | 0xC1C | CPU_DELAY |
| SLPM_660.48 | The Sword of Etheria | 0x00 | 0x2000000 | TITLE_MASK |
| SLPM_660.57 | Taito Memories Vol.1 | 0x08 | 0xCE4 | CPU_DELAY |
| SLPM_661.56 | Marheaven: Arm Fight Dream | 0x01 | 0x1800 | SIO2_MASK |
| SLPM_661.75 | Akumajo Dracula: Yami no Juin | 0x08 | 0x60 | CPU_DELAY |
| SLPM_661.75 | Akumajo Dracula: Yami no Juin | 0x0B | 0x2001C | SPU2_BEHAVIOR |
| SLPM_663.93 | Final Fantasy XI: Treasures of Aht Urhgan (All-In-One Edition) | 0x0A | 0x803E8 | CDVD_READ_DELAY |
| SLPM_663.93 | Final Fantasy XI: Treasures of Aht Urhgan (All-In-One Edition) | 0x09 | 0x2B47000A | DEV5_INT_SPEED |
| SLPM_663.93 | Final Fantasy XI: Treasures of Aht Urhgan (All-In-One Edition) | 0x02 | 0xB | DEV9_MASK |
| SLPM_663.94 | Final Fantasy XI: Treasures of Aht Urhgan | 0x02 | 0xB | DEV9_MASK |
| SLPM_664.36 | Aria the Natural | 0x01 | 0x1800 | SIO2_MASK |
| SLPM_664.36 | Aria the Natural | 0x00 | 0xA000000 | TITLE_MASK |
| SLPM_665.39 | Nobunaga no Yabou Online: Haten no Shou | 0x02 | 0xB | DEV9_MASK |
| SLPM_665.58 | Tomb Raider: Legend | 0x08 | 0x3E8 | CPU_DELAY |
| SLPM_665.74 | Detective Evangelion | 0x00 | 0x2000000 | TITLE_MASK |
| SLPM_680.07 | Karaoke Revolution (Trial) | 0x08 | 0x1388 | CPU_DELAY |
| SLPM_680.10 | 0x08 | 0x1388 | CPU_DELAY | |
| SLPS_200.08 | Morita Shogi | 0x08 | 0x1388 | CPU_DELAY |
| SLPS_200.20 | FIFA 2000 World Championship | 0x04 | 0x2001 | SIF_DMA_SYNC |
| SLPS_200.37 | Go Go Golf | 0x09 | 0x2B47000A | DEV5_INT_SPEED |
| SLPS_200.38 | Grappler Baki: Baki Saidai no Tournament | 0x08 | 0x1194 | CPU_DELAY |
| SLPS_200.53 | Tenshi no Present: Marle Oukoku Monogatari (Limited Edition) | 0x0B | 0x20000000 | SPU2_BEHAVIOR |
| SLPS_200.66 | Tenshi no Present: Marle Oukoku Monogatari | 0x0B | 0x20000000 | SPU2_BEHAVIOR |
| SLPS_201.01 | City Crisis | 0x0A | 0x80BB8 | CDVD_READ_DELAY |
| SLPS_201.11 | Magical Sports Pro Baseball 2001 | 0x09 | 0x2B47000A | DEV5_INT_SPEED |
| SLPS_201.72 | Koushien: Konpeki no Sora | 0x09 | 0x2B47000A | DEV5_INT_SPEED |
| SLPS_201.73 | Hard Hitter 2 | 0x0A | 0x80300 | CDVD_READ_DELAY |
| SLPS_201.97 | Surfing Air Show with RatBoy | 0x09 | 0x2B47000A | DEV5_INT_SPEED |
| SLPS_201.99 | F1 2002 | 0x0B | 0x20005 | SPU2_BEHAVIOR |
| SLPS_202.00 | Final Fantasy XI | 0x02 | 0xB | DEV9_MASK |
| SLPS_204.04 | Rakushou! Pachi-Slot Sengen 2 | 0x0A | 0x80300 | CDVD_READ_DELAY |
| SLPS_204.29 | Hissatsu Pachi-Slot Evolution: Ninja Hattori-Kun V | 0x08 | 0x1B58 | CPU_DELAY |
| SLPS_204.55 | Simple 2000 Series Vol.94: The Aka-Champion - Come on Baby | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
| SLPS_250.08 | Sorcerous Stabber Orphen | 0x08 | 0xC1C | CPU_DELAY |
| SLPS_250.71 | A Visual Mix: Ayumi Hamasaki Dome Tour 2001 | 0x08 | 0x1450 | CPU_DELAY |
| SLPS_250.72 | A Visual Mix: Ayumi Hamasaki Dome Tour 2001 | 0x08 | 0x1450 | CPU_DELAY |
| SLPS_250.81 | Saishuu Densha | 0x0A | 0x803E8 | CDVD_READ_DELAY |
| SLPS_251.36 | Kuon no Kizuna Sairin Mikotonori | 0x0A | 0x805DC | CDVD_READ_DELAY |
| SLPS_251.42 | Tiger Woods PGA Tour 2002 | 0x0A | 0x803E8 | CDVD_READ_DELAY |
| SLPS_251.50 | Only You | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
| SLPS_252.37 | Only You | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
| SLPS_252.75 | Def Jam: Vendetta | 0x01 | 0x802 | SIO2_MASK |
| SLPS_252.78 | Memories Off: Mix | 0x0A | 0x80300 | CDVD_READ_DELAY |
| SLPS_252.90 | Time Crisis 3 | 0x01 | 0x800 | SIO2_MASK |
| SLPS_253.15 | One Piece: Grand Battle 3 | 0x01 | 0x1800 | SIO2_MASK |
| SLPS_253.57 | 3-Nen B-Gumi Kinpachi Sensei: Densetsu no Kyoudan ni Tate! | 0x01 | 0x1800 | SIO2_MASK |
| SLPS_253.79 | Tokyo Majin Gakuen: Kaihoujyou Kefurokou | 0x0A | 0x803E8 | CDVD_READ_DELAY |
| SLPS_254.06 | Hitman: Contracts | 0x08 | 0xDAC | CPU_DELAY |
| SLPS_254.18 | Ace Combat 5: The Unsung War | 0x0A | 0x500000 | CDVD_READ_DELAY |
| SLPS_255.10 | Tekken 5 | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
| SLPS_255.85 | Monster Farm 5: Circus Caravan | 0x07 | 5 | MECHA_RECOGTIME |
| SLPS_255.86 | Tales of the Abyss | 0x0A | 0x803E8 | CDVD_READ_DELAY |
| SLPS_256.04 | Ar tonelico Qoga: Knell of Ar Ciel | 0x00 | 0xA000000 | TITLE_MASK |
| SLPS_256.67 | Daito Giken Premium Pachi-Slot Collection: Yoshimune | 0x01 | 0x1800 | SIO2_MASK |
| SLPS_256.98 | Fatal Fury Battle Archives Volume 2 | 0x00 | 0xA000000 | TITLE_MASK |
| SLPS_257.08 | The Familiar of Zero (Limited Edition) | 0x0A | 0x803E8 | CDVD_READ_DELAY |
| SLPS_257.09 | The Familiar of Zero | 0x0A | 0x803E8 | CDVD_READ_DELAY |
| SLPS_257.21 | HimeHibi - Princess Days | 0x0B | 0x8000000 | SPU2_BEHAVIOR |
| SLPS_257.22 | Routes PE (Limited Edition) | 0x08 | 0x3E8 | CPU_DELAY |
| SLPS_257.27 | Routes PE | 0x08 | 0x3E8 | CPU_DELAY |
| SLPS_732.49 | Ar tonelico Qoga: Knell of Ar Ciel (Platinum) | 0x00 | 0xA000000 | TITLE_MASK |
| SLUS_200.11 | Orphen: Ocion of Sorcery | 0x08 | 0x1388 | CPU_DELAY |
| SLUS_200.11 | Orphen: Ocion of Sorcery | 0x09 | 0x8000010 | DEV5_INT_SPEED |
| SLUS_200.77 | Donald Duck: Go'in Quackers | 0x01 | 0x800 | SIO2_MASK |
| SLUS_202.74 | City Crisis | 0x0A | 0x80BB8 | CDVD_READ_DELAY |
| SLUS_203.05 | Simpsons: Road Rage | 0x01 | 0x800 | SIO2_MASK |
| SLUS_203.64 | Tiger Woods PGA Tour 2002 | 0x0A | 0x803E8 | CDVD_READ_DELAY |
| SLUS_204.13 | Shadowman 2 | 0x0A | 0x80600 | CDVD_READ_DELAY |
| SLUS_204.33 | SWAT: Global Strike Team | 0x01 | 0x800 | SIO2_MASK |
| SLUS_204.88 | Star Ocean: Til the end of Time [Disc 1] | 0x08 | 0x1388 | CPU_DELAY |
| SLUS_205.72 | Tiger Woods PGA Tour 2003 | 0x0A | 0x803E8 | CDVD_READ_DELAY |
| SLUS_205.90 | Spyhunter 2 | 0x01 | 0x800 | SIO2_MASK |
| SLUS_206.35 | Muppets Party Cruise | 0x01 | 0x801 | SIO2_MASK |
| SLUS_206.39 | Def Jam Vendetta | 0x01 | 0x800 | SIO2_MASK |
| SLUS_206.86 | Splashdown: Rides Gone Wild | 0x0A | 0x80400 | CDVD_READ_DELAY |
| SLUS_208.38 | All-Star Baseball 2005 | 0x01 | 0x802 | SIO2_MASK |
| SLUS_208.51 | Ace Combat 5: The Unsung War | 0x0A | 0x500000 | CDVD_READ_DELAY |
| SLUS_208.91 | Star Ocean: Til the end of Time [Disc 2] | 0x08 | 0x1388 | CPU_DELAY |
| SLUS_209.18 | Super Monkey Ball: Deluxe | 0x01 | 0x800 | SIO2_MASK |
| SLUS_210.59 | Tekken 5 | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
| SLUS_210.70 | Final Fantasy XI: Chains of Promathia | 0x02 | 0xB | DEV9_MASK |
| SLUS_210.89 | Karaoke Revolution Vol.3 | 0x08 | 0x1388 | CPU_DELAY |
| SLUS_213.31 | Sonic Riders | 0x01 | 0x800 | SIO2_MASK |
| SLUS_213.39 | Puzzle Challenge | 0x01 | 0x800 | SIO2_MASK |
| SLUS_214.04 | Final Fantasy XI: Treasures of Aht Urhgan | 0x02 | 0xB | DEV9_MASK |
| SLUS_214.52 | Valkyrie Profile 2: Silmeria | 0x08 | 0x1388 | CPU_DELAY |
Folder/File layout
Example: Max Payne Classic
├── config-emu-ps4.txt
├── docs
│ └── revision.h
├── eboot.bin
├── feature_data
│ └── SLES-50326_features.lua
├── formatted.card
├── image
│ └── disc01.iso
├── lua_include
│ ├── ee-cpr0-alias.lua
│ ├── ee-gpr-alias.lua
│ ├── ee-hwaddr.lua
│ ├── language.lua
│ ├── pad-and-key.lua
│ ├── ps2.lua
│ └── utils.lua
├── patches
│ └── SLES-50326_cli.conf
├── PS20220WD20050620.crack
├── ps2-emu-compiler.self
├── sce_companion_httpd
│ └── html
│ ├── BackCover.jpg
│ ├── base
│ │ ├── arrow_up.png
│ │ └── sprites.png
│ ├── css
│ │ ├── default-skin.png
│ │ └── styles.min.css
│ ├── index.html
│ ├── js
│ │ └── app.min.js
│ ├── large
│ │ ├── Box01.jpg
│ │ ├── Box04.jpg
│ │ ├── landscape
│ │ │ ├── Box01.jpg
│ │ │ ├── Box04.jpg
│ │ │ ├── Page01.jpg From 01 to 59
│ │ │ └── Page59.jpg
│ │ ├── Page01.jpg From 01 to 116
│ │ └── Page116.jpg
│ ├── medium
│ │ ├── Box01.jpg
│ │ ├── Box04.jpg
│ │ ├── landscape
│ │ │ ├── Box01.jpg
│ │ │ ├── Box04.jpg
│ │ │ ├── Page01.jpg From 01 to 59
│ │ │ └── Page59.jpg
│ │ ├── Page01.jpg from 01 to 116
│ │ └── Page116.jpg
│ ├── small
│ │ ├── Box01.jpg from 01 to 04
│ │ ├── Box04.jpg
│ │ ├── landscape
│ │ │ ├── Box01.jpg from 01 to 04
│ │ │ ├── Box04.jpg
│ │ │ ├── Page01.jpg From 01 to 59
│ │ │ └── Page59.jpg
│ │ ├── Page01.jpg From 01 to 116
│ │ └── Page116.jpg
│ └── thumbnails
│ ├── BoxThumb01.jpg
│ ├── BoxThumb04.jpg
│ ├── landscape
│ │ ├── BoxThumb01.jpg
│ │ ├── BoxThumb04.jpg
│ │ ├── Thumb01.jpg from 01 to 59
│ │ └── Thumb59.jpg
│ ├── Thumb01.jpg From 01 to 116
│ └── Thumb116.jpg
├── sce_module
│ ├── libc.prx
│ └── libSceFios2.prx
├── sce_sys
│ ├── about
│ │ └── right.sprx
│ └── keystone
└── trophy_data
└── SLES-50326_trophies.lua
LUA include files
Files that the lua sometimes need to be inside of the lua_include folder
ee-cpr0-alias.lua
cpr = {}
cpr.index = 0
cpr.random = 1
cpr.entrylo0 = 2
cpr.entrylo1 = 3
cpr.context = 4
cpr.pagemask = 5
cpr.wired = 6
cpr.badvaddr = 8
cpr.count = 9
cpr.entryhi = 10
cpr.compare = 11
cpr.status = 12
cpr.cause = 13
cpr.epc = 14
cpr.prid = 15
cpr.config = 16
cpr.badpaddr = 23
cpr.hwbk = 24
cpr.pccr = 25
cpr.taglo = 28
cpr.taghi = 29
cpr.errorepc = 30
return cpr
ee-gpr-alias.lua
-- Recommended method to import this module:
-- local gpr = require("ee-gpr-alias")
--
-- Using the global 'lang' variable is depreciated. This will change to a local-scope variable after
-- the depreciation period has expired in April 2016.
gpr = {}
gpr.zero = 0
gpr.at = 1
gpr.v0 = 2
gpr.v1 = 3
gpr.a0 = 4
gpr.a1 = 5
gpr.a2 = 6
gpr.a3 = 7
gpr.t0 = 8
gpr.t1 = 9
gpr.t2 = 10
gpr.t3 = 11
gpr.t4 = 12
gpr.t5 = 13
gpr.t6 = 14
gpr.t7 = 15
gpr.s0 = 16
gpr.s1 = 17
gpr.s2 = 18
gpr.s3 = 19
gpr.s4 = 20
gpr.s5 = 21
gpr.s6 = 22
gpr.s7 = 23
gpr.t8 = 24
gpr.t9 = 25
gpr.k0 = 26
gpr.k1 = 27
gpr.gp = 28
gpr.sp = 29
gpr.fp = 30
gpr.ra = 31
return gpr
ee-hwaddr.lua
gif_hw = {}
vif0_hw = {}
vif1_hw = {}
gif_hw.CHCR = 0x1000A000
gif_hw.MADR = 0x1000A010
gif_hw.QWC = 0x1000A020
gif_hw.TADR = 0x1000A030
gif_hw.ASR0 = 0x1000A040
gif_hw.ASR1 = 0x1000A050
gif_hw.SADR = 0x1000A080
vif0_hw.CHCR = 0x10008000
vif0_hw.MADR = 0x10008010
vif0_hw.QWC = 0x10008020
vif0_hw.TADR = 0x10008030
vif0_hw.ASR0 = 0x10008040
vif0_hw.ASR1 = 0x10008050
vif0_hw.SADR = 0x10008080
vif1_hw.CHCR = 0x10009000
vif1_hw.MADR = 0x10009010
vif1_hw.QWC = 0x10009020
vif1_hw.TADR = 0x10009030
vif1_hw.ASR0 = 0x10009040
vif1_hw.ASR1 = 0x10009050
vif1_hw.SADR = 0x10009080
return gif_hw, vif0_hw, vif1_hw, nil
language.lua
-- Recommended method to import this module:
-- local lang = require("language")
--
-- Using the global 'lang' variable is depreciated. This will change to a local-scope variable after
-- the depreciation period has expired in April 2016.
lang = {}
lang.japanese = 0
lang.english = 1
lang.french = 2
lang.spanish = 3
lang.german = 4
lang.italian = 5
lang.dutch = 6
lang.portuguese = 7
lang.russian = 8
lang.korean = 9
lang.chinese_traditional = 10
lang.chinese_simplified = 11
lang.finnish = 12
lang.swedish = 13
lang.danish = 14
lang.norwegian = 15
lang.polish = 16
lang.portuguese_brazil = 17
lang.english_gb = 18
lang.turkish = 19
lang.spanish_la = 20
lang.arabic = 21
lang.french_canada = 22
return lang
pad-and-key.lua
pad = {}
-- Left Side
pad.LU = 0x0010 -- Up
pad.LD = 0x0040 -- Down
pad.LL = 0x0080 -- Left
pad.LR = 0x0020 -- Right
-- Right Side
pad.RU = 0x1000 -- Up (Triangle)
pad.RD = 0x4000 -- Down (Cross)
pad.RL = 0x8000 -- Left (Square)
pad.RR = 0x2000 -- Right (Circle)
-- aliases
pad.UP = 0x0010 -- LU
pad.DOWN = 0x0040 -- LD
pad.LEFT = 0x0080 -- LL
pad.RIGHT = 0x0020 -- LR
pad.TRIANGLE= 0x1000
pad.CROSS = 0x4000
pad.SQUARE = 0x8000
pad.CIRCLE = 0x2000
pad.L1 = 0x0400
pad.L2 = 0x0100
pad.L3 = 0x0002
pad.R1 = 0x0800
pad.R2 = 0x0200
pad.R3 = 0x0004
pad.SELECT = 0x0001
pad.START = 0x0008
keyboard = {}
keyboard.ESCAPE = 0x1000
keyboard.SLASH = 0x1001
keyboard.SEPARATOR = 0x1002 -- backslash or pipe (\|)
keyboard.BACKQUOTE = 0x1003
keyboard.PAGEDOWN = 0x1004
keyboard.PAGEUP = 0x1005
keyboard.F1 = 0x1006
keyboard.F2 = 0x1007
keyboard.F3 = 0x1008
keyboard.F4 = 0x1009
keyboard.F5 = 0x100a
keyboard.F6 = 0x100b
keyboard.F7 = 0x100c
keyboard.F8 = 0x100d
keyboard.F9 = 0x100e
keyboard.F10 = 0x100f
keyboard.F11 = 0x1010
keyboard.F12 = 0x1011
ps2.lua
require("ee-gpr-alias")
require("utils")
MipsInsn = {}
MipsInsn.IsAddi = function(insn) return (insn & 0xfc000000) == 0x20000000 end -- addi rt,rs,simm
MipsInsn.IsAddiu = function(insn) return (insn & 0xfc000000) == 0x24000000 end -- addiu rt,rs,simm
MipsInsn.IsBeq = function(insn) return (insn & 0xfc000000) == 0x10000000 end -- beq rs,rt,off
MipsInsn.IsJ = function(insn) return (insn & 0xfc000000) == 0x08000000 end -- j target
MipsInsn.IsJal = function(insn) return (insn & 0xfc000000) == 0x0c000000 end -- jal target
MipsInsn.IsJr = function(insn) return (insn & 0xfc1fffff) == 0x00000008 end -- jr rs
MipsInsn.IsLq = function(insn) return (insn & 0xfc000000) == 0x78000000 end -- lq rt,simm(rs)
MipsInsn.IsLd = function(insn) return (insn & 0xfc000000) == 0xdc000000 end -- ld rt,simm(rs)
MipsInsn.IsLw = function(insn) return (insn & 0xfc000000) == 0x8c000000 end -- lw rt,simm(rs)
MipsInsn.IsSq = function(insn) return (insn & 0xfc000000) == 0x7c000000 end -- sq rt,simm(rs)
MipsInsn.IsSd = function(insn) return (insn & 0xfc000000) == 0xfc000000 end -- sd rt,simm(rs)
MipsInsn.IsSw = function(insn) return (insn & 0xfc000000) == 0xac000000 end -- sw rt,simm(rs)
MipsInsn.IsEnd = function(insn) return (insn & 0xfc00003f) == 0x0000000d end
MipsInsn.GetRt = function(insn) return (insn >> 16) & 0x1f end
MipsInsn.GetRs = function(insn) return (insn >> 21) & 0x1f end
MipsInsn.GetSimm = function(insn) return ((insn << 48) >> 48) end
MipsInsn.GetOff = function(insn) return MipsInsn.GetSimm(insn) end
MipsInsn.GetTarget = function(insn) return insn & 0x3ffffff end
-- return FIFO queue of stack trace
-- the queue item is { caller-addr, return-from }
--
-- example:
-- print("=== stack trace ===")
-- local stack_trace = MipsStackTrace(eeObj, eeObj.GetPc()+4, eeObj.GetGpr(gpr.ra), eeObj.GetGpr(gpr.sp))
-- while not stack_trace:isEmpty() do
-- local caller = stack_trace:dequeue()
-- print( string.format(" 0x%08x [will return from : %x]", caller[1], caller[2]) )
-- end
--
-- NOTE: you must +4 against GetPc() if you in a EE/IOP hook.
-- Because EE/IOP jit executed the instruction at the address already and it might affect $sp or $ra.
--
-- obj : eeObj or iopObj
-- pc : current pc (from GetPC or readout from thread context)
-- ra : current ra (from GetGpr or readout from thread context)
-- sp : current sp (from GetGpr or readout from thread context)
MipsStackTrace = function (obj, pc, ra, sp, depth)
local max_depth = depth or 10 -- max trace depth
local n_j = 1
local jmax = {}
local depth = 0
local bdl_count = 0
local new_pc = 0
local icount = 0
local result = Queue.new()
local pushed_ra = Queue.new()
while depth < max_depth and icount < 2048 do
-- TODO: error checks
if (pc & 3) ~= 0 then
return result
end
pc = pc & 0x01ffffff
sp = sp & 0x01ffffff
local insn = obj.ReadMem32(pc)
-- print(string.format("trace .. pc=%x insn=%x", pc, insn))
-- result:enqueue( { pc, insn } )
if MipsInsn.IsJr(insn) and MipsInsn.GetRs(insn) == gpr.ra then
bdl_count = 1
depth = depth + 1
new_pc = ra
-- print(string.format("jr ra : ra=%x", ra))
icount = 0
-- print(string.format("enqueue caller pc=%x ret addr=%x", new_pc-8, pc))
result:enqueue( {new_pc-8, pc} ) -- {return-addr, where-from}
elseif MipsInsn.IsAddiu(insn) and MipsInsn.GetRt(insn) == gpr.sp and MipsInsn.GetRs(insn) == gpr.sp then
sp = sp + MipsInsn.GetSimm(insn) -- ((insn<<48) >>48)
-- print(string.format("addiu sp,sp,** : new sp = %x", sp))
elseif MipsInsn.IsLq(insn) or MipsInsn.IsLd(insn) or MipsInsn.IsLw(insn) then
if MipsInsn.GetRt(insn) == gpr.ra and MipsInsn.GetRs(insn) == gpr.sp then
-- the code might push $ra on the stack after start pc.
-- in such case, we must not retrieve $ra value from the memory.
if pushed_ra:isEmpty() then
local imm = MipsInsn.GetSimm(insn) -- ((insn<<48) >>48)
-- print(string.format("retrieve ra from stack(%x) : sp=%x imm=%x", sp+imm, sp, imm))
ra = obj.ReadMem32(sp + imm)
-- print(string.format("load ra,%x(sp) : sp = %x+%x, ra = %x", imm, sp, imm, ra))
else
-- print(string.format("retrieve ra from pushed one"))
pushed_ra:dequeue()
end
end
elseif MipsInsn.IsSq(insn) or MipsInsn.IsSd(insn) or MipsInsn.IsSw(insn) then
if MipsInsn.GetRt(insn) == gpr.ra and MipsInsn.GetRs(insn) == gpr.sp then
pushed_ra:enqueue(pc);
end
elseif MipsInsn.IsJ(insn) then -- j **
local imm = MipsInsn.GetTarget(insn)
imm = imm << 2
if pc == imm then
-- jump to self? maybe we can ignore it.
else
new_pc = imm
-- print(string.format("j ** : new_pc = %x", new_pc))
bdl_count = 1
for t=1, n_j do
if jmax[t] == new_pc then
return result -- closed loop
end
end
if n_j > 1024 then
return result -- jump buffer overflow
end
jmax[n_j] = new_pc
n_j = n_j + 1
end
elseif MipsInsn.IsBeq(insn) and MipsInsn.GetRs(insn) == gpr.zero then -- beq zero,**
local offset = MipsInsn.GetOff(insn) -- ((insn<<48) >> 48)
offset = offset << 2
new_pc = pc + 4 + offset
if pc == new_pc then
-- jump to self? maybe we can ignore it
else
-- print(string.format("beq zero,** : new_pc=%x", new_pc))
bdl_count = 1
for t = 1, n_j do
if jmax[t] == new_pc then
return result
end
end
if n_j > 1024 then
return result
end
jmax[n_j] = new_pc
n_j = n_j + 1
end
elseif MipsInsn.IsEnd(insn) then -- end
-- print(string.format("end"))
return result
elseif MipsInsn.IsJal(insn) then -- jal **
local imm = insn & 0x03ffffff
imm = imm << 2
-- print(string.format("jal ** : addr = %x", imm))
-- call
end
icount = icount + 1
pc = pc + 4
-- -- print(string.format("bdl_count=%d", bdl_count))
if bdl_count > 0 then
if bdl_count == 2 then
pc = new_pc
bdl_count = 0
else
bdl_count = bdl_count + 1
end
end
end
return result
end
PS2 = {}
PS2.GetCurrentThread = function(eeObj) return eeObj.ReadMem32(0x12fac) end
PS2.GetThreads = function(eeObj)
local EE_THREAD_BASE = 0x18000
local EE_NUM_THREADS = 0x100
local th = EE_THREAD_BASE
local result = Queue.new()
for t = 0, EE_NUM_THREADS-1 do
-- 0 : node_prev
-- 4 : node_next
-- 8 : status
-- 12: pc
-- 16: sp
-- 20: gp
-- 24: init_pri
-- 26: curr_pri
-- 28: wstat
-- 32: waitId
-- 36: wakeupCount
-- 40: attr
-- 44: option
-- 48: func
-- 52: argc
-- 56: args
-- 60: stack
-- 64: size
-- 68: root
-- 72: endOfHeap
local status = eeObj.ReadMem32(th + 8)
if status ~= 0 then
local id = t
local pri = eeObj.ReadMem16(th + 26)
local gp = eeObj.ReadMem32(th + 20)
local pc = eeObj.ReadMem32(th + 12)
local sp = eeObj.ReadMem32(th + 16)
result:enqueue( {id=id, status=status, pri=pri, gp=gp, pc=pc, sp=sp} )
end
th = th + 76
end
return result
end
utils.lua
-- utility classes/functions
-- Stack
-- ex:
-- my_stack = Stack.new()
-- my_stack:push( val )
-- print( my_stack:pop( val ) )
Stack = {}
function Stack.new()
local obj = { buff = {} }
return setmetatable(obj, {__index = Stack})
end
function Stack:push(x)
table.insert(self.buff, x)
end
function Stack:pop()
return table.remove(self.buff)
end
function Stack:top()
return self.buff[#self.buff]
end
function Stack:isEmpty()
return #self.buff == 0
end
-- Queue
-- ex:
-- my_queue = Queue.new()
-- my_queue:enqueue( val )
-- print( my_queue:dequeue(val) )
Queue = {}
function Queue.new()
local obj = { buff = {} }
return setmetatable(obj, {__index = Queue})
end
function Queue:enqueue(x)
table.insert(self.buff, x)
end
function Queue:dequeue()
return table.remove(self.buff, 1)
end
function Queue:top()
if #self.buff > 0 then
return self.buff[1]
end
end
function Queue:isEmpty()
return #self.buff == 0
end
Links
- Ps2 Hardware Documentation
- GS title fix guide
- PS3 custom configs
- A place for research and sharing successful configurations for the emulator
- Configuration examples
- PS2DIS, very helpful for debugging games
- A thread filled with patches for ps2 games
| |||||||||||||||||||||||||||||||||||||
