Mod chip history

[leafy]

Hi! I'm curious about mod chip history. I've read the old crow posts, etc. I get the basics of what they do, and also that new versions were created for stealth.

I'm curious, is the Stealth2.8a the stealth version from Old Crow? Is MM3 based on it? What about Stealth4?

I've been learning to program in C a little using the newest tools for PIC (MPLABX and XC8 compiler) and I can get some examples (blink, etc.) to compile and burn for the PIC12F508 and PIC12F629.

So, I was wondering, in the original mod chip by crow, source code, the PIC12F508 mod chip is either compiled using an external crystal, or internal (4 vs. 5 wire), and sometimes an external reset (4 vs. 5 vs. 6 wire). I think the reason for the choice is that an external osc input from PSX is supposed to be more reliable, yes? The reset on the PIC would be attached to the PSX reset , correct?

Is there a table of what the pins and signals mean for all the PU boards? In relation to mod chip functions, that is.

Code: Select all

Chip is connected in 4-wire, 5-wire or 6-wire fashion:
;
;                       _______   _______
;                      |            \/           |
;                Vdd --+ 1 <<          >> 8 +-- Vss
;                      |                          |
;           GP5/OSC1 --+ 2 <*          7 +-- GP0
;                      |                          |
;           GP4/OSC2 --+ 3            >> 6 +-- GP1
;                      |                          |
;          GP3/!MCLR --+ 4 <#      >> 5 +-- GP2/T0CKI
;                      |                          |
;                      +----------------+
;
;	4-wire: ">>" and "<<" indicated pins are connected.
;	5-wire: ">>" and "<<" and "<*" pins are connected.
;	6-wire: ">>" and "<<" and "<*" and "<#" pins connected.
;
;       4-Wire Operation: Use the following default config options
;       on the __FUSES line below: MCLRE_OFF, CP_OFF, WDT_OFF, OSC=INTRC
;
;       5-Wire Operation: Be sure to set the following config options
;       on the __FUSES line: MCLRE_OFF, CP_OFF, WDT_OFF, OSC=XT
;
;       6-Wire Operation: MCLRE_ON, CP_OFF, WDT_OFF, OSC=XT
;

Looks like the main work is done at GP1 and GP2, yes?

Fuses are; watchdog timer off, code protect off, 4-wire = internal OSC, 5-wire = external OSC, 6-wire = external reset.

Where is the external crystal signal on the PSX boards?

I'm ever curious about the inner workings of all of these old PSX things.

Thanks!

-Leif

[TriMesh]

I think stealth 2.8a was developed by someone in the UK, but I'm not sure who. It was pretty widely available in the UK at the time in any case.

MM3 appears to be based on Mayumi 4.0 - the "new boards" code is pretty much identical, but there is some extra stuff for mode selection and compatibility with older models (which Mayumi wasn't). Most of this code seems to be modified versions of earlier chips to be honest. A lot of the time, names got changed just for marketing reasons.

The main reason for using an external clock is that a lot of older programmers trashed the oscillator calibration value that was pre-programmed at the factory, so the chips ended up running at the wrong speed when the internal oscillator was used - I never had any problems with this, presumably because I was using the official Microchip programmer.

MCLR is typically connected to the system reset - but in most cases it's disabled in the chip config and just polled by software.

Note that "GPx" is "General purpose I/O bit x" - so the actual pin function is completely defined by software.

If we take the MM3 as an example, the pin functions are as follows:

1: VDD (+ve supply, fixed function)
2: Not used (osc in if configured)
3: Stealth function sense (see below)
4: Reset (disabled in config, but still wires to the reset line)
5: Gate (see below)
6: Data (see below)
7: Door switch
8: GND (ground, fixed function)

There are 3 lines that change function based on the type of board the chip is installed it - gate, data and stealth sense.

On the old boards (up to and including PU-20), GATE is driven low while the chip is emitting data to mask any data protection data coming from the CD so they don't end up colliding and corrupting the unlock strings. DATA is the NRZ modchip data, spelling of the region sequence "SCEI", "SCEA" or "SCEE". On these boards, the stealth line is connected to the X1/X2 motor speed control line - the code tries to work out where in the boot sequence it is from this and cuts off the modchip data after the second disc check.

On the new boards, these signals get swapped around a bit - GATE becomes an input that's connected to a clock output on the CD DSP (called WFCK - write frame clock) - and it's the detection of this signal that switches the chip into the "new board" mode. The "DATA" pin continues to function as the modchip data output, but now it's chopped up by the signal on WFCK rather than being straight NRZ. This is done because the dedicated connection that was previously used for the protection data no longer exists on these new boards and the data has to be fed into the tracking error loop instead - it's chopped because the actual tracking error signal needs to get through at least some of the time to allow the tracking loop to operate.

The stealth signal is also moved from the X1/X2 speed control line to a signal called XLAT - this is pulsed by the CD control MCU (aka mechacon) at the end of each command. This works because while the drive is reading the TOC and the region symbols the servos are left in auto mode, but as soon as the TOC has been read and the disc validated the boot ROM then tries to read the system area of the disc - and the commands sent to the CD DSP to do this act as a trigger to turn off the simulated region data.

[leafy]

I think stealth 2.8a was developed by someone in the UK, but I'm not sure who. It was pretty widely available in the UK at the time in any case.

MM3 appears to be based on Mayumi 4.0 - the "new boards" code is pretty much identical, but there is some extra stuff for mode selection and compatibility with older models (which Mayumi wasn't). Most of this code seems to be modified versions of earlier chips to be honest. A lot of the time, names got changed just for marketing reasons.

The main reason for using an external clock is that a lot of older programmers trashed the oscillator calibration value that was pre-programmed at the factory, so the chips ended up running at the wrong speed when the internal oscillator was used - I never had any problems with this, presumably because I was using the official Microchip programmer.

MCLR is typically connected to the system reset - but in most cases it's disabled in the chip config and just polled by software.

Note that "GPx" is "General purpose I/O bit x" - so the actual pin function is completely defined by software.

If we take the MM3 as an example, the pin functions are as follows:

1: VDD (+ve supply, fixed function)
2: Not used (osc in if configured)
3: Stealth function sense (see below)
4: Reset (disabled in config, but still wires to the reset line)
5: Gate (see below)
6: Data (see below)
7: Door switch
8: GND (ground, fixed function)

There are 3 lines that change function based on the type of board the chip is installed it - gate, data and stealth sense.

On the old boards (up to and including PU-20), GATE is driven low while the chip is emitting data to mask any data protection data coming from the CD so they don't end up colliding and corrupting the unlock strings. DATA is the NRZ modchip data, spelling of the region sequence "SCEI", "SCEA" or "SCEE". On these boards, the stealth line is connected to the X1/X2 motor speed control line - the code tries to work out where in the boot sequence it is from this and cuts off the modchip data after the second disc check.

On the new boards, these signals get swapped around a bit - GATE becomes an input that's connected to a clock output on the CD DSP (called WFCK - write frame clock) - and it's the detection of this signal that switches the chip into the "new board" mode. The "DATA" pin continues to function as the modchip data output, but now it's chopped up by the signal on WFCK rather than being straight NRZ. This is done because the dedicated connection that was previously used for the protection data no longer exists on these new boards and the data has to be fed into the tracking error loop instead - it's chopped because the actual tracking error signal needs to get through at least some of the time to allow the tracking loop to operate.

The stealth signal is also moved from the X1/X2 speed control line to a signal called XLAT - this is pulsed by the CD control MCU (aka mechacon) at the end of each command. This works because while the drive is reading the TOC and the region symbols the servos are left in auto mode, but as soon as the TOC has been read and the disc validated the boot ROM then tries to read the system area of the disc - and the commands sent to the CD DSP to do this act as a trigger to turn off the simulated region data.

Hi! Yes, I totally understand that GPIO pins are controlled by software. I was playing around with 2 old PIC chips and doing some example codes like blink an LED, and stobe 5 LEDs. The old PIC chips I used were PIC12F629 and PIC12F508. The first one is very touchy with my old JDM programmer when it comes to the Oscillator calibration value. I tag the chip with dots on the pins to represent in binary the value, then each time I program I need to make sure I add it to the end of the file. The PIC12F508 seems to do better with the programmer.

Your explanation as to how the chips work is very helpful. I knew it output the SCEA, etc. and of course VCC and GND are no-brainers. I didn't know about the Write Frame Clock details.

I suppose since the stealth chips work differently with different boards, that is why they say use Stealth 2.8a for the SCPH-1001, and MM3 for the rest, except PSOne. Also PSNee is supposed to be great all around. The way it does stealth and all of that.

I have this old source for the PIC12F508 that was adapted from the ZC8 by the Old Crow, but it is missing what the pins do. Except, if I could read the source I might understand, lol. So, I guess I could burn it, and fire it up with a 5 volt source, then probe it. I can probe fairly well using the Serial Plotter on an Arduino and an input pin. It shows a graph of the signal unless too fast to detect.

But the pins are probably the same as classic 4 wire if I can find those old diagrams.

Anyway, thanks!

-Leif