PSNee further development

General information to do with the PlayStation 1 Hardware. Including modchips, pinouts, rare or obscure development equipment, etc.
Post Reply
rama3
/// PSXDEV | ELITE ///
/// PSXDEV | ELITE ///
Posts: 336
Joined: April 16th, 2017, 10:54 pm

PSNee further development

Post by rama3 » April 27th, 2017, 10:47 pm

Update: Latest version is here.

PSNee is an open source PSX modchip code for Atmel AVR microprocessors like the ATTiny and ATmega (Arduino boards).
It was coded by "THE FRIENDLY FRIETMAN" and released on the assemblergames.com forums a while back.

Right now, assemblergames is down and PSNee is not yet finished.
From what I can tell, it is missing stealth functionality and it does not gate the original SCEX string for original discs on consoles newer than the 550x series.

Stealth is somewhat implemented by a timeout. But modchip protected games work by asking for the SCEX string at an arbitrary time after the game has booted. A proper stealth mechanism will provide the string only when the drive controller put the laser on sector 4 of the disc. It must not send it when reading sectors where an original would not have the string.

Gating on older consoles should work (but I have not tested it yet). On newer consoles, I don't know which point to solder a gate signal to, and how the gating should be implemented. I do know that the old "link wire" method will work though.
This method connects points 5 and 6 in this picture with a wire: http://www.fatcat.co.nz/psx/install/750 ... m3pu22.jpg

A minor detail: The lid detection is missing its digitalRead() ;p

Let's use this thread to try and finish this project. I will add my findings as well :)

Code: Select all

//                    PPPPPPPPPPPPPPPP                  P            P       
//                   P              P                  PP           P        
//                  P              P                  P P          P         
//                 P              P                  P  P         P          
//                P              P                  P   P        P           
//               P              P                  P    P       P            
//              P              P                  P     P      P             
//             PPPPPPPPPPPPPPPP  PPPPPPPPPPP     P      P     P  PPPPPPPPPPP  PPPPPPPPPPP
//            P                 P               P       P    P  P            P 
//           P                 P               P        P   P  P            P  
//          P                 P               P         P  P  P            P   
//         P                 P               P          P P  P            P    
//        P                 PPPPPPPPPPPPPP  P           PP  PPPPPPP      PPPPPPP    
//       P                              P  P            P  P            P      
//      P                              P  P            P  P            P       
//     P                              P  P            P  P            P        
//    P                              P  P            P  P            P        
//   P                              P  P            P  P            P       
//  P                              P  P            P  P            P         
//                     PPPPPPPPPPPP  P            P  PPPPPPPPPPP  PPPPPPPPPPP   VERSION 6!

//UPDATED AT MAY 14 2016, CODED BY THE FRIENDLY FRIETMAN :-)

//PsNee, an open source stealth modchip for the Sony Playstation 1, usable on
//all platforms supported by Arduino, preferably ATTiny. Finally something modern!


//--------------------------------------------------
//                    TL;DR
//--------------------------------------------------
//Look for the "Arduino selection!" section and verify the target platform. Hook up your target device and hit Upload!
//BEWARE: when using ATTiny45, make sure the proper device is selected (Extra=>Board=>ATTiny45 (internal 8MHz clock))
//and the proper fuses are burnt (use Extra=>Burn bootloader for this), otherwise PsNee will malfunction. A tutorial on
//uploading Arduino code via an Arduino Uno to an ATTiny device: http://highlowtech.org/?p=1695
//Look at the pinout for your device and hook PsNee up to the points on your Playstation.


//--------------------------------------------------
//                 General info!
//--------------------------------------------------
//PLAYSTATION 1 SECURITY - HOW IT DOES IT'S THING:
//Sony didn't really go through great lenghts to protect it's precious Playstation
//from running unauthorised software; the main security is based on a simple ASCII
//string of text that is read from a part of an original Playstation disc that cannot
//be reproduced by an ordinary PC CD burner. 
//As most of you will know, a CD is basically a very long rolled up (carrier) string in which very 
//little pits and ehm... little not-pits are embedded that represent the data stored on the disc. 
//The nifty Sony engineers did not use the pits and stuff to store the security checks for
//Playstation discs but went crazy with the rolled up carrier string. In an ordinary CD, the
//string is rolled up so that the spacing between the tracks is as equal as possible. If that
//is not the case, the laser itself needs to move a bit to keep track of the track and 
//reliably read the data off the disc.
//If you wonder how the laser knows when it follows the track optimally: four photodiodes, light 
//intensity measurement, difference measurements, servo. There.
//To the point: the Sony engineers decidedly "fumbled up" the track of sector 4 on a Playstation
//disc (the track was modulated in nerd-speak) so that the error correction circuit outputs a 
//recognisable signal, as the laser needs to be corrected to follow the track optimally.
//This output signal actually is a 250bps serial bitstream (with 1 start bit and 2 stop bits) which 
//in plain ASCII says SCEA (Sony Computer Entertainment of America), SCEE (Sony Computer Entertainment 
//of Europe) or SCEI (Sony Computer Entertainment of Japan), depending on the region of the disc inserted.
//The security thus functions not only as copy protection, but also as region protection.
//The text string from the disc is compared with the text string that is embedded in the Playstation
//hardware. When these text strings are the same, the disc is interpreted to be authentic and from
//the correct region. Bingo!

//HOW THE MODCHIP TRICKS THE PLAYSTATION:
//The modchip isn't all that of a complicated device: clever reverse engineers found the point on the
//Playstation motherboard that carried the text string from the disc and found a way to temporarily block 
//this signal (by grounding an input of an op-amp buffer) to be able to inject the signal from the modchip
//The modchip injects after about 1500ms the text strings SCEE SCEA SCEI on the motherboard point and stops 
//with this after about 25 seconds. Because all the possible valid region options are outputted on the
//motherboard the Playstation gets a bit confused and simply accepts the inserted disc as authentic; after all,
//one of the codes was the same as that of the Playstation hardware...
//Early modchips applied the text strings as long as power was applied to them, whereby later Playstation
//software could detect whether a modchip was installed. This is circumvented in this application by idling the
//modchip after about 25 seconds. The text strings are only tranmitted again when the CD lid is opened and closed
//again, to enable playing multi-disc games. This is also called a stealth modchip in marketing-speak.


//--------------------------------------------------
//               New in this version!
//--------------------------------------------------
//A lot!
// - The PAL SCPH-102 NTSC BIOS-patch works flawlessly! For speed reasons this is implemented in bare
//   AVR C. It is functionally identical to the OneChip modchip, this modchip firmware was disassembled,
//   documented (available on request, but written in Dutch...) and analyzed with a logic analyzer to
//   make sure PsNee works just as well.
// - The code now is segmented in functions which make the program a lot more maintable and readable
// - Timing is perfected, all discs (both backups and originals of PAL and NTSC games) now work in the 
//   PAL SCPH-102 test machine
// - It was found out that the gate signal doesn't havbe to be hooked up to a PAL SCPH-102 Playstation 
//   to circumvent the copy protection. This is not tested on other Playstation models so the signal still
//   is available
// - The /xlat signal is no longer required to time the PAL SCPH-102 NTSC BIOS-patch
// - Only AVR PORTB is used for compatibility reasons (almost all the AVR chips available have PORTB)


//--------------------------------------------------
//                  Pinouts!
//--------------------------------------------------
//FOR ARDUINO UNO (WITH ATMEGA328):
// - Arduino pin 8  = data    = ATMega pin 14
// - Arduino pin 9  = gate    = ATMega pin 15
// - Arduino pin 10 = lid     = ATMega pin 16
// - Arduino pin 11 = biosA18 = ATMega pin 17
// - Arduino pin 12 = biosD2  = ATMega pin 18

//FOR ATTINY25/45/85:
// - Arduino pin 0 = data    = ATTiny pin 5
// - Arduino pin 1 = gate    = ATTiny pin 6
// - Arduino pin 2 = lid     = ATTiny pin 7
// - Arduino pin 3 = biosA18 = ATTiny pin 2
// - Arduino pin 4 = biosD2  = ATTiny pin 3

//--------------------------------------------------
//                    Includes!
//--------------------------------------------------
#include <Flash.h>

//--------------------------------------------------
//               Arduino selection!
//--------------------------------------------------
#define ARDUINO_UNO        //Make that "#define ARDUINO_UNO" if you want to compile for Arduino Uno instead of ATTiny25/45/85

#ifdef ARDUINO_UNO
//Pins
int data = 8;         //The pin that outputs the SCEE SCEA SCEI string
int gate = 9;         //The pin that outputs the SCEE SCEA SCEI string
int lid = 10;         //The pin that gets connected to the internal CD lid signal; active high
int biosA18 = 11;     //Only used in SCPH-102 PAL mode
int biosD2 = 12;      //Only used in SCPH-102 PAL mode
int delay_ntsc = 2350;
int delay_between_bits = 4;
int delay_between_injections = 74;
#endif

#ifdef ATTINY
//Pins
int data = 0;        //The pin that outputs the SCEE SCEA SCEI string
int gate = 1;
int lid = 2;         //The pin that gets connected to the internal CD lid signal; active high
int biosA18 = 3;     //Only used in SCPH-102 PAL mode
int biosD2 = 4;      //Only used in SCPH-102 PAL mode
int delay_ntsc = 2400;
int delay_between_bits = 4;
int delay_between_injections = 68;
#endif

//--------------------------------------------------
//              Global variables!
//--------------------------------------------------
//None, just like it should be!

//--------------------------------------------------
//              Seperate functions!
//--------------------------------------------------
void NTSC_fix()
{
  //Make sure all pins are inputs
  DDRB = 0x00;
  
  //Wait until just before the pulse on BIOS A18 arrives
  delay(delay_ntsc);
  
  //...And wait here until it actually happened
  while(!(PINB & B00001000))
  {
    ;  //Wait
  }
  delayMicroseconds(12);
  PORTB = B00000000;
  DDRB = B00010000;
  delayMicroseconds(5);
  DDRB = 0x00;
}

void inject_SCEE()
{
  //SCEE-array                                                                                                                   //      Start            Data     Stop
  FLASH_ARRAY (boolean, SCEEData, 1,0,0,1,1,0,1,0,1,0,0,1,0,0,1,1,1,1,0,1,0,0,1,0,1,0,1,1,1,0,1,0,0,1,0,1,0,1,1,1,0,1,0,0);      //SCEE: 1 00110101 00, 1 00111101 00, 1 01011101 00, 1 01011101 00   44 bits total
  
  int bit_counter;
  
  for (bit_counter = 0; bit_counter < 44; bit_counter = bit_counter + 1)
  {
    if (SCEEData[bit_counter] == 0)
    {        
      pinMode(data, OUTPUT);
      digitalWrite(data, 0);
      delay(delay_between_bits);
    }
    else
    { 
      pinMode(data, INPUT);                //We make the data pin high-impedance to let the pull-up of the Playstation motherboard make a 1
      delay(delay_between_bits);
    }
  }
  
  pinMode(data, OUTPUT);
  digitalWrite(data, 0);
  delay(delay_between_injections);
}

void inject_SCEA()
{
  //SCEE-array                                                                                                                   //      Start            Data     Stop
  FLASH_ARRAY (boolean, SCEAData, 1,0,0,1,1,0,1,0,1,0,0,1,0,0,1,1,1,1,0,1,0,0,1,0,1,0,1,1,1,0,1,0,0,1,0,1,1,1,1,1,0,1,0,0);      //SCEA: 1 00110101 00, 1 00111101 00, 1 01011101 00, 1 01111101 00
  
  int bit_counter;
  
  for (bit_counter = 0; bit_counter < 44; bit_counter = bit_counter + 1)
  {
    if (SCEAData[bit_counter] == 0)
    {        
      pinMode(data, OUTPUT);
      digitalWrite(data, 0);
      delay(delay_between_bits);
    }
    else
    { 
      pinMode(data, INPUT);                //We make the data pin high-impedance to let the pull-up of the Playstation motherboard make a 1
      delay(delay_between_bits);
    }
  }
  
  pinMode(data, OUTPUT);
  digitalWrite(data, 0);
  delay(delay_between_injections);
}

void inject_SCEI()
{
  //SCEE-array                                                                                                                   //      Start            Data     Stop
  FLASH_ARRAY (boolean, SCEIData, 1,0,0,1,1,0,1,0,1,0,0,1,0,0,1,1,1,1,0,1,0,0,1,0,1,0,1,1,1,0,1,0,0,1,0,1,1,0,1,1,0,1,0,0);      //SCEI: 1 00110101 00, 1 00111101 00, 1 01011101 00, 1 01101101 00
  
  int bit_counter;
  
  for (bit_counter = 0; bit_counter < 44; bit_counter = bit_counter + 1)
  {
    if (SCEIData[bit_counter] == 0)
    {        
      pinMode(data, OUTPUT);
      digitalWrite(data, 0);
      delay(delay_between_bits);
    }
    else
    {
      pinMode(data, INPUT);                //We make the data pin high-impedance to let the pull-up of the Playstation motherboard make a 1
      delay(delay_between_bits);
    }
  }
  
  pinMode(data, OUTPUT);
  digitalWrite(data, 0);
  delay(delay_between_injections);
}

void inject_multiple_times(int number_of_injection_cycles)
{
  int cycle_counter;
  
  for(cycle_counter = 0; cycle_counter < number_of_injection_cycles; cycle_counter = cycle_counter + 1)
  {
    inject_SCEE();
    inject_SCEA();
    inject_SCEI();
  }
}

void inject_playstation()
{
  //Variables
  int loop_counter;
  
  //Code
  NTSC_fix();
  
  delay(6900);
  digitalWrite(data, 0);
  pinMode(data, OUTPUT);
  delay(100);
 
  pinMode(gate, OUTPUT);
  digitalWrite(gate, 0);
  
  for (loop_counter = 0; loop_counter < 25; loop_counter = loop_counter + 1)
  {
    inject_SCEE();
  }
  
  pinMode(gate, INPUT);
  pinMode(data, INPUT);
  delay(11000);
  
  pinMode(gate, OUTPUT);
  digitalWrite(gate, 0);
  
  for (loop_counter = 0; loop_counter < 60; loop_counter = loop_counter + 1)
  {
    inject_SCEE();
  }
  
  pinMode(gate, INPUT);
  pinMode(data, INPUT);
}

//!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
//--------------------------------------------------
//     Setup function - execution starts here!
//--------------------------------------------------
void setup()
{
  inject_playstation();
}

//----------------------------------------------------------------
//   Loop function - executes after the initial injection cycle
//----------------------------------------------------------------
void loop()
{
  if(lid == 0)
  {
    while(lid != 1);      //Wait until the lid is closed again (after being opened) to initiate a new injection cycle
    inject_playstation();
  }
}
Last edited by rama3 on July 2nd, 2017, 7:44 pm, edited 1 time in total.

rama3
/// PSXDEV | ELITE ///
/// PSXDEV | ELITE ///
Posts: 336
Joined: April 16th, 2017, 10:54 pm

Re: PSNee further development

Post by rama3 » April 28th, 2017, 4:05 am

So about the stealth:
We know that the SCEX string can only be found on the earliest sectors on the CD. The read head has to be at almost the innermost position for reading it. There's a small pin on the read head that signals when it reached the innermost position.

One simple method to implement stealth is then to put a little bit of tape on the tray, so that the detector triggers even when the read head is at about the position to read sector 4 on the disc. Then we just watch that signal on the Arduino, kill all timing related injections and replace them with injections only when the signal says so.
I have tried this method and it does not interfere with normal operation. It allows Dino Crisis (which is modchip protected) to boot. It is very simple and effective: It doesn't even require timing anymore. We simply send the SCEX string whenever the read head is on the innermost position, just like it would happen on real disks.

The only problem with this that I can think of: Some games might deliberately put the read head to that position, but then not actually read the data there. My method would send the SCEX string and the game would know about the modchip.
Unfortunately, I don't know if any games used such a method.

likeabaus
Extreme PSXDEV User
Extreme PSXDEV User
Posts: 125
Joined: July 27th, 2016, 2:26 am

Re: PSNee further development

Post by likeabaus » April 28th, 2017, 5:02 am

You're overthinking it. As far as ik, the only reason the earlier 4 wire chips were detectable by certain "anti-mod" games is because they literally spam the authentication code endlessly . Normal, the hardware would ignore the extra code injections after initial boot, but sony eventually figured out how to pick up on the endless spamming using software. If you can get the PSNee to go into sleep mode after initial boot, you're halfway there. Then you just need to make sure, the chip reactivates when a new disc is inserted (lid closed) so multi-disc games work as well
Buy and sell Bitcoins:
https://localbitcoins.com/?ch=rkv4

rama3
/// PSXDEV | ELITE ///
/// PSXDEV | ELITE ///
Posts: 336
Joined: April 16th, 2017, 10:54 pm

Re: PSNee further development

Post by rama3 » April 28th, 2017, 5:15 am

That's true until you start Dino Crisis :)
As an old readme from the 90s said, the game is a deliberate attack on (then) stealth modchips (that used a signal to detect the pad init function, normally triggered when the game exe loaded).
It boots as normal, but then does an additional check that consists of the following phases:
- Clear the SCEX status
- Move read head to the SCEX area and try to read SCEX string
- Move read head to a different (data) area
- Clear the SCEX status
- "Read" SCEX string
To pass the check, it has to get the first string, but not the second.
It will fail if it gets 2 strings, or if it gets no string.

User avatar
nocash
PSX Aficionado
PSX Aficionado
Posts: 306
Joined: November 12th, 2012, 2:36 pm
Contact:

Re: PSNee further development

Post by nocash » April 28th, 2017, 10:48 am

Which sector 4, counted from where? From 00:02:00 or 00:00:00 or from begin of TOC?

The SCEx signal is transferred at 250bits/second, so four characters with 11bit each would take around 1/5 seconds for transferring the SCEx string - so storing the whole string on a single sector isn't be possible.

From what I know the SCEx string is believed to be stored in the "wobble" signal somewhere at the "begin" of the disc (=presumably in the TOC area).

I don't remember Dino Crisis doind anything special about (re-)reading the SCEx string, except maybe verifying that it cannot read the SCEx string from higher track numbers.

But if it's reading the string - from the TOC area: The PSX doesn't allow to seek into the TOC area (via SetLoc), so that it could be done only via something like Reset/Init/SetSession commands, which should be using the POS0 sensor to find the TOC (and the SCEx area), so the modchip could simply use the POS0 pin as is. Without needing to put tape on the POS0 sensor (doing that wouldn't work to well anyways, if you tweak it to trigger on 00:02:04, then the drive couldn't read the TOC any longer (which is located at "negative" MM:SS:FF addresses, prior to 00:00:00)).

likeabaus
Extreme PSXDEV User
Extreme PSXDEV User
Posts: 125
Joined: July 27th, 2016, 2:26 am

Re: PSNee further development

Post by likeabaus » April 28th, 2017, 12:05 pm

Ah okay, now I see, i think this is what you're referring to: http://consolecopyworld.com/psx/psx_lib ... rial.shtml

Never realized sony got that fancy back in the day lol
Buy and sell Bitcoins:
https://localbitcoins.com/?ch=rkv4

rama3
/// PSXDEV | ELITE ///
/// PSXDEV | ELITE ///
Posts: 336
Joined: April 16th, 2017, 10:54 pm

Re: PSNee further development

Post by rama3 » April 28th, 2017, 5:20 pm

Nocash, it could be some other *very early* sector as well. But I remember reading somewhere that the wobble starts at sector 4.
It is indeed close enough to the POS0 sensor that it sometimes triggers it without any tape added. But it's not reliably doing it.
I've verified that adding the tape makes it reliable and doesn't cause issues seeking to early sectors on bootup (I guess Sony left some slack in this, to account for manufacturing differences).

So another thing that'd be cool if it could be done: Capture the drive commands and just look for the one that reads the SCEX string. Timing injections to that would take all "heuristics" out of the way.

User avatar
nocash
PSX Aficionado
PSX Aficionado
Posts: 306
Joined: November 12th, 2012, 2:36 pm
Contact:

Re: PSNee further development

Post by nocash » April 29th, 2017, 1:10 am

likeabaus wrote:Ah okay, now I see, i think this is what you're referring to: http://consolecopyworld.com/psx/psx_lib ... rial.shtml
No, that's about the "libcrypt" protection at 03:08:05 and up, not related to the SCEX protection. More info: http://problemkaputt.de/psx-spx.htm#cdr ... onlibcrypt
rama3 wrote:I remember reading somewhere that the wobble starts at sector 4.
I am not absolutely sure where SCEX/wobble starts. I was always thinking that it starts at the begin of the TOC (or even shortly before the TOC), as far as I remember, the TOC is about 3-4 minutes long, ie. it would start at sector -15000 or so.
And "sector 4" sounds more like the "Licence String" at 00:02:04. More info: http://problemkaputt.de/psx-spx.htm#cdr ... escriptors
I guess that somebody just confused the 4-byte "SCEX string" with the "Licence string" on sector 4.
rama3 wrote:It is indeed close enough to the POS0 sensor that it sometimes triggers it without any tape added. But it's not reliably doing it. I've verified that adding the tape makes it reliable and doesn't cause issues
Hmmmm, I wonder what is happening there. POS0 should trigger somewhere at sector -15000, which would be miles away from the normal ISO sectors (ie. sectors that are seekable without using the POS0 switch). How thick is your tape? Several miles?

Another theory would be that the game is seeking to POS0, but your hardware setup might miss the POS0 signal (maybe because it's too short, or because the switch contacts are a bit dirty and don't reach a clean 0 volt level). And the tape might change the mechanical behaviour to produce a better/longer POS0 signal.
Though concerning timing, the PSX must first poll the POS0 signal, then stop the sled motor, and then start TOC reading with sled getting moved in opposite direction - so the POS0 signal should be long enough for getting sensed by modchips.
rama3 wrote:So another thing that'd be cool if it could be done: Capture the drive commands and just look for the one that reads the SCEX string. Timing injections to that would take all "heuristics" out of the way.
The TTY Debug Mesage Window in no$psx includes options for logging CDROM commands (and IRQs), maybe that could be useful.

Apropos, Dino Crisis, are there already any modchips that can play that game? And if yes, do they connect to POS0 or DOOR or the like?
Oh, and is the game working in no$psx? I've just noticed that no$psx still leaves the 19h,04h and 19h,05h test commands unemulated, as far as I remember Dino Crisis does use that test commands - if it's working even without emulating that commands then the proctection doesn't seem to be very strict.

User avatar
Shadow
Admin / PSXDEV
Admin / PSXDEV
Posts: 2103
Joined: December 31st, 2012, 5:37 pm
PlayStation Model: H2000/5502

Re: PSNee further development

Post by Shadow » April 29th, 2017, 1:48 am

I thought the wobble is where the ATIP would usually be. Since the discs are pressed, that data segment is useless on pressed discs (it's only relevant to have on CD-R's) so Sony pressed the wobble in this area for PlayStation games.

Anyway,
To read the SCEx counter, you have to seek to somewhere in the data area of the disc, start CD play mode, reset the protection counter (send commands 0x19, 0x04 to the HC05), wait, and read the results (send commands 0x19, 0x05). You have to make sure the drive isn't in the Lead-In/TOC area though or you will pick up protection symbols even if there is no modchip.
Development Console: SCPH-5502 with 8MB RAM, MM3 Modchip, PAL 60 Colour Modification (for NTSC), DB-9 breakout headers for both RGB and Serial output and an Xplorer with CAETLA 0.34.

Development Computer: Windows 98, Pentium 3 [400MHz], 128MB SDRAM, DTL-H2000, DTL-H201A, 21" Sony Trinitron CRT, CD-ROM burner, 3.25" and 5.25" Floppy Diskette Drives and a ZIP 100 Diskette Drive.

rama3
/// PSXDEV | ELITE ///
/// PSXDEV | ELITE ///
Posts: 336
Joined: April 16th, 2017, 10:54 pm

Re: PSNee further development

Post by rama3 » April 29th, 2017, 2:51 am

Nocash, I hooked up my scope to the POS0 readout (and everything else as well. It really is nice to see what exactly is going on ;) ).
When the protection routine in Dino kicks in, it first moves the read head to the SCEX area. The scope sometimes shows a blip (POS0 activated), and sometimes it doesn't. It probably depends on the momentum the sled had this particular run.

The game reads data for a second, then moves the read head forward a bit and reads data again. If it got what it wanted, it continues. Otherwise it will spit out an error screen and stop.
An emulator will pass this test if:
- it clears the SCEX string on request
- it puts it back in when the SCEX read function is called, but *only* if it's on the correct sectors
- (alternatively, it could do all kinds of high level workarounds :p )

I agree that the protection isn't very strong, but this is only the first NTSC-U release with it. Other games might be better.
As far as I know, there is no comprehensive list of protection schemes used in games.
The TTY Debug Mesage Window in no$psx includes options for logging CDROM commands (and IRQs), maybe that could be useful.
It almost certainly would be useful. The tricky question is where one could reliably grab these commands from on real hardware :)

Edit: This is the game booting fine on No$psx (with IRQ capture)

Code: Select all

CD_init:addr=800ac130
IRQ6 TMR2
CDROM Command: 01
IRQ2 CDROM INT03(02) from CMD=01
CDROM Command: 0A
IRQ2 CDROM INT03(02) from CMD=0A
IRQ6 TMR2
IRQ2 CDROM INT02(02) from CMD=0A
CDROM Command: 0C
IRQ2 CDROM INT03(02) from CMD=0C
IRQ3 DMA DMA4.SPU
IRQ6 TMR2
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ6 TMR2
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ6 TMR2
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ6 TMR2
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ3 DMA DMA4.SPU
IRQ6 TMR2
CDROM Command: 01
IRQ2 CDROM INT03(02) from CMD=01
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ6 TMR2
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ6 TMR2
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
CDROM Command: 01
IRQ2 CDROM INT03(02) from CMD=01
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ6 TMR2
CDROM Command: 13
IRQ2 CDROM INT03(02,01,02) from CMD=13
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
CDROM Command: 01
IRQ2 CDROM INT03(02) from CMD=01
IRQ6 TMR2
CDROM Command: 09
IRQ2 CDROM INT03(02) from CMD=09
IRQ2 CDROM INT02(02) from CMD=09
CDROM Command: 0E A0
IRQ2 CDROM INT03(02) from CMD=0E
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
CDROM Command: 02 00 08 28
IRQ2 CDROM INT03(02) from CMD=02
IRQ6 TMR2
CDROM Command: 06
IRQ2 CDROM INT03(02) from CMD=06
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
CDROM Command: 01
IRQ2 CDROM INT03(42) from CMD=01
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:28 LBA=00000274
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:29 LBA=00000275
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:30 LBA=00000276
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:31 LBA=00000277
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:32 LBA=00000278
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:33 LBA=00000279
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:34 LBA=0000027A
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:35 LBA=0000027B
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:36 LBA=0000027C
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:37 LBA=0000027D
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:38 LBA=0000027E
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:39 LBA=0000027F
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:40 LBA=00000280
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:41 LBA=00000281
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:42 LBA=00000282
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:43 LBA=00000283
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:44 LBA=00000284
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:45 LBA=00000285
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:46 LBA=00000286
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:47 LBA=00000287
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:48 LBA=00000288
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:49 LBA=00000289
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:50 LBA=0000028A
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:51 LBA=0000028B
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:52 LBA=0000028C
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:53 LBA=0000028D
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:54 LBA=0000028E
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:55 LBA=0000028F
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:56 LBA=00000290
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:57 LBA=00000291
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:58 LBA=00000292
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:59 LBA=00000293
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:60 LBA=00000294
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:61 LBA=00000295
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:62 LBA=00000296
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:63 LBA=00000297
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:64 LBA=00000298
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:65 LBA=00000299
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:66 LBA=0000029A
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:67 LBA=0000029B
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:08:68 LBA=0000029C
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
CDROM Command: 09
IRQ2 CDROM INT03(22) from CMD=09
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT02(02) from CMD=09
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
CDROM Command: 01
IRQ2 CDROM INT03(02) from CMD=01
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
CDROM Command: 01
IRQ2 CDROM INT03(02) from CMD=01
IRQ6 TMR2
CDROM Command: 0E A0
IRQ2 CDROM INT03(02) from CMD=0E
CDROM Command: 02 10 23 40
IRQ2 CDROM INT03(02) from CMD=02
CDROM Command: 06
IRQ2 CDROM INT03(02) from CMD=06
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:40 LBA=0000B6AD
CDROM Command: 01
IRQ2 CDROM INT03(22) from CMD=01
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:41 LBA=0000B6AE
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:42 LBA=0000B6AF
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:43 LBA=0000B6B0
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:44 LBA=0000B6B1
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:45 LBA=0000B6B2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:46 LBA=0000B6B3
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:47 LBA=0000B6B4
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:48 LBA=0000B6B5
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:49 LBA=0000B6B6
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:50 LBA=0000B6B7
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:51 LBA=0000B6B8
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:52 LBA=0000B6B9
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:53 LBA=0000B6BA
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:54 LBA=0000B6BB
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ6 TMR2
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:55 LBA=0000B6BC
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:56 LBA=0000B6BD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:57 LBA=0000B6BE
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:58 LBA=0000B6BF
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:59 LBA=0000B6C0
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:60 LBA=0000B6C1
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:61 LBA=0000B6C2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:62 LBA=0000B6C3
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 10:23:63 LBA=0000B6C4
CDROM Command: 09
IRQ2 CDROM INT03(22) from CMD=09
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT02(02) from CMD=09
CDROM Command: 01
IRQ2 CDROM INT03(02) from CMD=01
CDROM Command: 01
IRQ2 CDROM INT03(02) from CMD=01
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ6 TMR2
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ6 TMR2
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ6 TMR2
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
CD_init:a
IRQ6 TMR2
ddr=800ac130
CDROM Command: 01
IRQ2 CDROM INT03(02) from CMD=01
IRQ6 TMR2
CDROM Command: 0A
IRQ2 CDROM INT03(02) from CMD=0A
IRQ2 CDROM INT02(02) from CMD=0A
IRQ6 TMR2
CDROM Command: 0C
IRQ2 CDROM INT03(02) from CMD=0C
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ6 TMR2
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ6 TMR2
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ6 TMR2
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA4.SPU
CDROM Command: 01
IRQ2 CDROM INT03(02) from CMD=01
IRQ3 DMA DMA4.SPU
IRQ6 TMR2
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ6 TMR2
IRQ3 DMA DMA4.SPU
IRQ3 DMA DMA4.SPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
CDROM Command: 01
IRQ2 CDROM INT03(02) from CMD=01
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
CDROM Command: 13
IRQ2 CDROM INT03(02,01,02) from CMD=13
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
CDROM Command: 01
IRQ2 CDROM INT03(02) from CMD=01
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ6 TMR2
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ6 TMR2
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
CDROM Command: 0E 80
IRQ2 CDROM INT03(02) from CMD=0E
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
CDROM Command: 0C
IRQ2 CDROM INT03(02) from CMD=0C
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
CDROM Command: 09
IRQ2 CDROM INT03(02) from CMD=09
IRQ2 CDROM INT02(02) from CMD=09
CDROM Command: 0E A0
IRQ2 CDROM INT03(02) from CMD=0E
IRQ6 TMR2
CDROM Command: 02 00 09 48
IRQ2 CDROM INT03(02) from CMD=02
CDROM Command: 06
IRQ2 CDROM INT03(02) from CMD=06
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ6 TMR2
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
CDROM Command: 01
IRQ2 CDROM INT03(22) from CMD=01
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:09:48 LBA=000002D3
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:09:49 LBA=000002D4
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:09:50 LBA=000002D5
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:09:51 LBA=000002D6
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:09:52 LBA=000002D7
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:09:53 LBA=000002D8
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:09:54 LBA=000002D9
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:09:55 LBA=000002DA
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:09:56 LBA=000002DB
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:09:57 LBA=000002DC
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ2 CDROM INT01(22) from CMD=06 with index 0000 in sector 00:09:58 LBA=000002DD
CDROM Command: 09
IRQ2 CDROM INT03(22) from CMD=09
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ2 CDROM INT02(02) from CMD=09
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ6 TMR2
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ0 VBLANK
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ7 PAD/MCD
IRQ3 DMA DMA2.GPU
IRQ3 DMA DMA2.GPU
IRQ6 TMR2
IRQ3 DMA DMA2.GPU
CDROM Command: 01
IRQ2 CDROM INT03(02) from CMD=01
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2
IRQ6 TMR2

rama3
/// PSXDEV | ELITE ///
/// PSXDEV | ELITE ///
Posts: 336
Joined: April 16th, 2017, 10:54 pm

Re: PSNee further development

Post by rama3 » April 29th, 2017, 6:19 am

Okay, I forgot to enable the low level HC05 emulation in No$psx. With it enabled, I now can't get my iso file to boot xD

User avatar
Shadow
Admin / PSXDEV
Admin / PSXDEV
Posts: 2103
Joined: December 31st, 2012, 5:37 pm
PlayStation Model: H2000/5502

Re: PSNee further development

Post by Shadow » May 4th, 2017, 1:03 pm

Oh, just as a note, I tested "Dino Crisis" the (German) PAL version on PSIO and it too crashes if the HC05 does not have "SCEE". Even if it's blank (like a debug station) it fails. It's a 1:1 check. We've had to update the logic in our firmware now to compensate for this annoyance :P

EDIT: Okay, unless there's a bug in our code, Dino Crisis actually works with SCEE, SCEA or SCEI. It fails if it does not match any of these things. I haven't tried SCEW yet though, but I doubt they added that. I think only the Yaroze's had that in their HC05 and the wobble contained SCEW itself on pressed Yaroze CD-ROM's (such as the "Net Yaroze Boot Disc" (DTL-H3000)).
Development Console: SCPH-5502 with 8MB RAM, MM3 Modchip, PAL 60 Colour Modification (for NTSC), DB-9 breakout headers for both RGB and Serial output and an Xplorer with CAETLA 0.34.

Development Computer: Windows 98, Pentium 3 [400MHz], 128MB SDRAM, DTL-H2000, DTL-H201A, 21" Sony Trinitron CRT, CD-ROM burner, 3.25" and 5.25" Floppy Diskette Drives and a ZIP 100 Diskette Drive.

rama3
/// PSXDEV | ELITE ///
/// PSXDEV | ELITE ///
Posts: 336
Joined: April 16th, 2017, 10:54 pm

Re: PSNee further development

Post by rama3 » May 4th, 2017, 8:49 pm

We could really use a small list of games with known anti-modchip checks and how they do it.

User avatar
Shadow
Admin / PSXDEV
Admin / PSXDEV
Posts: 2103
Joined: December 31st, 2012, 5:37 pm
PlayStation Model: H2000/5502

Re: PSNee further development

Post by Shadow » May 5th, 2017, 4:04 am

rama3 wrote:We could really use a small list of games with known anti-modchip checks and how they do it.
Yeah that would be very useful but I don't know any of them except for now Dino Crisis.
Development Console: SCPH-5502 with 8MB RAM, MM3 Modchip, PAL 60 Colour Modification (for NTSC), DB-9 breakout headers for both RGB and Serial output and an Xplorer with CAETLA 0.34.

Development Computer: Windows 98, Pentium 3 [400MHz], 128MB SDRAM, DTL-H2000, DTL-H201A, 21" Sony Trinitron CRT, CD-ROM burner, 3.25" and 5.25" Floppy Diskette Drives and a ZIP 100 Diskette Drive.

rama3
/// PSXDEV | ELITE ///
/// PSXDEV | ELITE ///
Posts: 336
Joined: April 16th, 2017, 10:54 pm

Re: PSNee further development

Post by rama3 » May 5th, 2017, 5:55 am

I'll add titles to this thread as I find them, then some day compile a nicer list :)

Vandal Hearts 2 NTSC-U: unknown if antimod, but stops on white Konami screen if (guessing) the BIOS region doesn't match the game's. It only works on my NTSC-U BIOS machines.
Update: This game requires the antimod code to run, else it will freeze. However, since the antimod routine doesn't run on PAL machines, it effectively cannot run on those. (The game can be patched, of course.)
Last edited by rama3 on May 8th, 2017, 8:23 am, edited 1 time in total.

User avatar
Shadow
Admin / PSXDEV
Admin / PSXDEV
Posts: 2103
Joined: December 31st, 2012, 5:37 pm
PlayStation Model: H2000/5502

Re: PSNee further development

Post by Shadow » May 5th, 2017, 6:05 am

rama3 wrote:I'll add titles to this thread as I find them, then some day compile a nicer list :)

Vandal Hearts 2 NTSC-U: unknown if antimod, but stops on white Konami screen if (guessing) the BIOS region doesn't match the game's. It only works on my NTSC-U BIOS machines.
I'll try it out and let you know... :)
Development Console: SCPH-5502 with 8MB RAM, MM3 Modchip, PAL 60 Colour Modification (for NTSC), DB-9 breakout headers for both RGB and Serial output and an Xplorer with CAETLA 0.34.

Development Computer: Windows 98, Pentium 3 [400MHz], 128MB SDRAM, DTL-H2000, DTL-H201A, 21" Sony Trinitron CRT, CD-ROM burner, 3.25" and 5.25" Floppy Diskette Drives and a ZIP 100 Diskette Drive.

rama3
/// PSXDEV | ELITE ///
/// PSXDEV | ELITE ///
Posts: 336
Joined: April 16th, 2017, 10:54 pm

Re: PSNee further development

Post by rama3 » May 8th, 2017, 2:42 am

So someone wrote a tool to check disc images for antimod code and this nice list was produced :)
Taken from http://forum.redump.org/post/52530/#p52530

Code: Select all

Aconcagua (Japan) (Disc 1)
Aconcagua (Japan) (Disc 2)
Addie no Okurimono - To Moze from Addie (Japan)
Alundra 2 - A New Legend Begins (Europe)
Alundra 2 - A New Legend Begins (USA)
Alundra 2 - Der Beginn einer neuen Legende (Germany)
Alundra 2 - Mashinka no Nazo (Japan) (Demo)
Alundra 2 - Une Legende Est Nee (France)
Animetic Story Game 1 - Card Captor Sakura (Japan) (Disc 1)
Animetic Story Game 1 - Card Captor Sakura (Japan) (Disc 2)
Ape Escape - La Invasion de los Monos (Spain)
Ape Escape (Europe) (Demo)
Ape Escape (Europe)
Ape Escape (France)
Ape Escape (Germany)
Ape Escape (Italy)
Ape Escape (USA) (Demo)
Ape Escape (USA)
Arc the Lad Collection - Arc the Lad III (USA) (Disc 1)
Arc the Lad Collection - Arc the Lad III (USA) (Disc 2)
Arc the Lad III (Japan) (Disc 1) (v1.0)
Arc the Lad III (Japan) (Disc 1) (v1.1)
Arc the Lad III (Japan) (Disc 2) (v1.0)
Arc the Lad III (Japan) (Disc 2) (v1.1)
Ballistic (Europe) (En,Fr,De)
Baseball Simulation - ID Pro Yakyuu (Japan)
Beat Mania - The Sound of Tokyo (Japan)
Beatmania 6thMix + Core Remix (Japan)
Beatmania Best Hits (Japan)
Beatmania featuring Dreams Come True (Japan)
Best Horror Games Ever Demo (Europe)
Biohazard - Gun Survivor (Japan)
Biohazard 3 - Last Escape (Japan) (Promo Disc)
Biohazard 3 - Last Escape (Japan) (v1.0)
Biohazard 3 - Last Escape (Japan) (v1.1)
Bishi Bashi Special (Europe)
Bishi Bashi Special 3 - Step Champ (Japan)
Bishibashi Special 2 (Japan)
Boku no Natsuyasumi (Japan)
Bounty Hunter Sara - Holy Mountain no Teiou (Japan)
Breath of Fire IV - Utsurowazaru Mono (Japan)
Bust A Move 2 - Dance Tengoku Mix (Japan) (Demo)
Bust A Move 2 - Dance Tengoku Mix (Japan)
Capcom vs. SNK - Millennium Fight 2000 Pro (Europe)
Capcom vs. SNK Pro (USA)
Captain Tsubasa - Aratanaru Densetsu Joshou (Japan)
Card Captor Sakura - Clowcard Magic (Japan)
Chase the Express (Japan) (Demo) (v1.0)
Chase the Express (Japan) (Demo) (v1.1)
Chase the Express (Japan) (Disc 1)
Chase the Express (Japan) (Disc 2)
Chocobo Racing - Genkai e no Road (Japan)
Cool Boarders 2001 (USA)
Crash Bandicoot Carnival (Japan)
Crash Bandicoot Racing (Japan)
Crash Bash (Europe) (En,Fr,De,Es,It)
Crash Bash (USA)
Dance Dance Revolution - Best Hits (Japan)
Dance Dance Revolution - Disney Mix (USA)
Dance Dance Revolution - Disney's Rave (Japan)
Dance Dance Revolution (Japan)
Dance Dance Revolution (USA)
Dance Dance Revolution 2nd Remix - Append Club Version Vol. 1 (Japan)
Dance Dance Revolution 2nd Remix - Append Club Version Vol. 2 (Japan)
Dance Dance Revolution 2nd Remix (Japan)
Dance Dance Revolution 3rd Mix (Japan)
Dance Dance Revolution 4th Mix (Japan)
Dance Dance Revolution Konamix (USA)
Dancing Blade Katte ni Momotenshi II - Tears of Eden (Japan) (Disc 1)
Dancing Blade Katte ni Momotenshi II - Tears of Eden (Japan) (Disc 2)
Dancing Blade Katte ni Momotenshi II - Tears of Eden (Japan) (Disc 3)
Dancing Stage - Disney Mix (Europe)
Dancing Stage - Euromix (Europe)
Dancing Stage - Party Edition (Europe)
Dancing Stage featuring Dreams Come True (Japan)
Dancing Stage featuring True Kiss Destination (Japan)
Dancing Stage Fever (Europe)
Dancing Stage Fusion (Europe) (En,Fr,De,Es,It)
Dengeki PlayStation D - Konami Fanbook (Japan)
Dengeki PlayStation D2 (Japan)
Dino Crisis (Europe)
Dino Crisis (France)
Dino Crisis (Germany)
Dino Crisis (Italy)
Dino Crisis (Japan)
Dino Crisis (Spain)
Dino Crisis (USA) (Demo)
Dino Crisis (USA) (v1.0)
Dino Crisis (USA) (v1.1)
Dino Crisis 2 (Europe)
Dino Crisis 2 (France)
Dino Crisis 2 (Germany)
Dino Crisis 2 (Japan) (Demo)
Dino Crisis 2 (Japan)
Dino Crisis 2 (Spain)
Dino Crisis 2 (USA)
Disney El Emperador y sus Locuras (Spain)
Disney Kuzco - L'Empereur Megalo (France)
Disney Le Follie Dell'Imperatore (Italy)
Disney Tarzan (France)
Disney Tarzan (Spain)
Disneys Ein Koenigreich fuer ein Lama (Germany)
Disneys Et Kongerike for en Lama (Norway)
Disney's Keizer Kuzco (Netherlands)
Disneys Tarzan (Germany)
Disneys Tarzan (Italy)
Disney's Tarzan (Japan)
Disney's Tarzan (Netherlands)
Disney's Tarzan (Sweden)
Disney's The Emperor's New Groove (Europe)
Disney's The Emperor's New Groove (USA)
Dokapon! Ikari no Tekken (Japan) (v1.2)
Doko Demo Issho (Japan) (Demo)
Doko Demo Issho (Japan) (v1.0)
Doko Demo Issho (Japan) (v1.1)
Dragon Quest IV - Michibikareshi Mono Tachi (Japan)
Dragon Quest VII - Eden no Senshitachi (Japan) (Disc 1) (v1.0)
Dragon Quest VII - Eden no Senshitachi (Japan) (Disc 1) (v1.1)
Dragon Quest VII - Eden no Senshitachi (Japan) (Disc 2) (v1.0)
Dragon Quest VII - Eden no Senshitachi (Japan) (Disc 2) (v1.1)
Dragon Warrior VII (USA) (Disc 1)
Dragon Warrior VII (USA) (Disc 2)
Elder Gate (Japan)
ESPN MLS Gamenight (USA)
Euro Demo (Future) 106 (Europe)
Euro Demo 01-01 (Germany)
Euro Demo 01-02 (Germany)
Euro Demo 01-03 (Germany)
Euro Demo 06-01 (Germany)
Euro Demo 07-01 (Germany)
Euro Demo 07-99 (Germany)
Euro Demo 09-99 (Germany)
Euro Demo 17 (Germany)
Euro Demo 18 (Germany)
Euro Demo 20 (France)
Euro Demo 21 (France)
Euro Demo 27 (Germany)
Euro Demo 31 (Europe)
Euro Demo 32 (Europe)
Euro Demo 33 (Europe)
Euro Demo 33 (France)
Euro Demo 36 (France)
Euro Demo 41 (Europe)
Euro Demo 42 (Europe)
Euro Demo 47 (Europe)
Euro Demo 47 (France)
Euro Demo 48 (Europe)
Euro Demo 51 (Europe)
Euro Demo 68 (Europe)
Euro Demo 73 (Europe)
Euro Demo 74 (Europe)
Euro Demo 88 (Europe)
Euro Demo 89 (Europe)
Euro Demo 92 (Europe)
Exclusive Demo CD 01 (Europe)
Final Fantasy VIII (Japan) (Disc 1)
Final Fantasy VIII (Japan) (Disc 2)
Final Fantasy VIII (Japan) (Disc 3)
Final Fantasy VIII (Japan) (Disc 4)
G1 Jockey 2000 (Japan)
GaiaMaster - Kamigami no Board Game (Japan)
Ganbare! Nippon! Olympic 2000 (Japan)
GeGeGe no Kitarou - Gyakushuu! Youma Daikessen (Japan)
Gekitotsu Toma-L'Arc - Tomarunner vs L'Arc-an-Ciel (Japan)
Glint Glitters (Japan)
Global Force - Shin Sentou Kokka (Japan) (Taikenban)
Global Force - Shin Sentou Kokka (Japan) (v1.0)
Global Force - Shin Sentou Kokka (Japan) (v1.1)
Goo! Goo! Soundy (Japan)
Grind Session (USA)
Groove Adventure Rave - Mikan no Hiseki (Japan)
Groove Adventure Rave - Yuukyuu no Kizuna (Japan)
Guitar Freaks (Japan)
Hikaru no Go - Heian Gensou Ibunroku (Japan)
Himiko-den - Renge (Japan) (Disc 1)
Himiko-den - Renge (Japan) (Disc 2)
Himiko-den - Renge (Japan) (Disc 3)
Hyper Value 2800 - Hanafuda (Japan)
Hyper Value 2800 - Hyper Pachinko (Japan)
Hyper Value 2800 - Mahjong (Japan)
I'Max Shougi II (Japan)
i-mode mo Issho - Doko Demo Issho Tsuika Disc (Japan)
International Track & Field 2 (Europe)
International Track & Field 2000 (USA)
ISS Pro Evolution (Europe) (En,Fr,De) (EDC)
ISS Pro Evolution (Europe) (En,Fr,De) (No EDC)
ISS Pro Evolution (Europe) (Es,It)
ISS Pro Evolution (USA)
ISS Pro Evolution 2 (Europe) (En,Fr,De)
J. League Jikkyou Winning Eleven 2000 (Japan)
J. League Jikkyou Winning Eleven 2000 2nd (Japan)
J. League Jikkyou Winning Eleven 2001 (Japan)
Jikkyou Golf Master 2000 (Japan) (v1.0)
Jikkyou J. League 1999 - Perfect Striker (Japan)
Jikkyou Kyousouba Ikusei Simulation Game - Breeding Stud '99 (Japan)
Jikkyou Powerful Pro Yakyuu - Premium Ban (Japan)
Jikkyou Powerful Pro Yakyuu 2000 - Kaimakuban (Japan)
Jikkyou Powerful Pro Yakyuu 2000 - Ketteiban (Japan)
Jikkyou Powerful Pro Yakyuu 2001 - Ketteiban (Japan)
Jikkyou Powerful Pro Yakyuu 2001 (Japan)
Jikkyou Powerful Pro Yakyuu 2002 - Haru (Japan)
Jikkyou Powerful Pro Yakyuu '99 - Kaimakuban (Japan)
Jikkyou Powerful Pro Yakyuu '99 - Ketteiban (Japan)
Jojo no Kimyou na Bouken (Japan)
Kenki Ippatsu! Shovel Master ni Narou! (Japan) (v1.0)
Kenki Ippatsu! Shovel Master ni Narou! (Japan) (v1.1)
Kindaichi Shounen no Jikenbo 3 - Seiryuu Densetsu Satsujin Jiken (Japan) (Disc 1)
Kindaichi Shounen no Jikenbo 3 - Seiryuu Densetsu Satsujin Jiken (Japan) (Disc 2)
Kinniku Banzuke - Road to Sasuke (Japan)
Kinniku Banzuke Vol. 1 - Ore ga Saikyou no Otoko Da! (Japan)
Kinniku Banzuke Vol. 2 - Arata naru Genkai e no Chousen! (Japan)
Kinniku Banzuke Vol. 3 - Saikyou no Challenger Tanjou! (Japan)
Koko Hore! Pukka (Japan)
Konami 80's Arcade Gallery (Japan)
Koneko mo Issho (Japan)
Koukidou Gensou Gunparade March (Japan)
Kouryuu Sangoku Engi (Japan)
Legend of Dragoon, The (Europe) (Disc 1)
Legend of Dragoon, The (Europe) (Disc 2)
Legend of Dragoon, The (Europe) (Disc 3)
Legend of Dragoon, The (Europe) (Disc 4)
Legend of Dragoon, The (France) (Disc 1)
Legend of Dragoon, The (France) (Disc 2)
Legend of Dragoon, The (France) (Disc 3)
Legend of Dragoon, The (France) (Disc 4)
Legend of Dragoon, The (Germany) (Disc 1)
Legend of Dragoon, The (Germany) (Disc 2)
Legend of Dragoon, The (Germany) (Disc 3)
Legend of Dragoon, The (Germany) (Disc 4)
Legend of Dragoon, The (Italy) (Disc 1)
Legend of Dragoon, The (Italy) (Disc 2)
Legend of Dragoon, The (Italy) (Disc 3)
Legend of Dragoon, The (Italy) (Disc 4)
Legend of Dragoon, The (Japan) (Disc 1)
Legend of Dragoon, The (Japan) (Disc 2)
Legend of Dragoon, The (Japan) (Disc 3)
Legend of Dragoon, The (Japan) (Disc 4)
Legend of Dragoon, The (Spain) (Disc 2)
Legend of Dragoon, The (Spain) (Disc 3)
Legend of Dragoon, The (Spain) (Disc 4)
Legend of Dragoon, The (USA) (Disc 1)
Legend of Dragoon, The (USA) (Disc 2)
Legend of Dragoon, The (USA) (Disc 3)
Legend of Dragoon, The (USA) (Disc 4)
Love Hina - Ai wa Kotoba no Naka ni (Japan)
Love Hina 2 - Kotoba wa Konayuki no Youni (Japan)
Magical Tetris Challenge featuring Mickey (Japan)
Marvel vs. Capcom - Clash of Super Heroes - EX Edition (Japan)
Marvel vs. Capcom - Clash of Super Heroes (Europe)
Marvel vs. Capcom - Clash of Super Heroes (USA)
McDonald's Demo 2 (Europe)
MediEvil 2 (Russia)
MediEvil II (USA)
Metal Gear Solid - Integral (Japan) (Disc 3) (VR-Disc)
Metal Gear Solid - Integral (Japan) (En,Ja) (Disc 1)
Metal Gear Solid - Integral (Japan) (En,Ja) (Disc 2)
Mini-Moni. Dice de Pyon! (Japan)
Misadventures of Tron Bonne, The (Europe)
Misadventures of Tron Bonne, The (USA)
MLB 2002 (USA)
MLB 2003 (USA)
MLB 2004 (USA)
MLB 2005 (USA)
My Garden (Japan)
NBA ShootOut 2001 (USA)
NBA ShootOut 2002 (USA)
NBA ShootOut 2003 (USA)
NBA ShootOut 2004 (USA)
NCAA Final Four 2001 (USA)
NCAA GameBreaker 2001 (USA)
NFL GameDay 2001 (USA)
NFL GameDay 2002 (USA)
NFL GameDay 2003 (USA)
NFL GameDay 2004 (USA)
NFL GameDay 2005 (USA)
NHL Blades of Steel 2000 (Europe)
NHL Blades of Steel 2000 (USA)
NHL FaceOff 2001 (USA)
Official U.S. PlayStation Magazine Demo Disc 22 (USA)
Official U.S. PlayStation Magazine Demo Disc 25 (USA)
Official U.S. PlayStation Magazine Demo Disc 28 (USA)
Official U.S. PlayStation Magazine Demo Disc 34 (USA)
Official U.S. PlayStation Magazine Demo Disc 44 (USA)
Official U.S. PlayStation Magazine Demo Disc 45 (USA)
Official U.S. PlayStation Magazine Demo Disc 54 (USA)
Oha-Studio Dance Dance Revolution (Japan)
Omega Boost (Europe) (En,Fr,De,Es,It)
Omega Boost (Japan)
Omega Boost (USA)
Ore no Shikabane wo Koete Yuke (Japan)
Oujisama Lv1.5 - Oujisama no Tamago (Japan)
Oyaji no Jikan - Neechan Hanafuda de Shoubu Ya! (Japan)! (Japan)
Oyako Entertainment Series - TV Kamishibai Vol. 1 (Japan)
Panekit - Infinitive Crafting Toy Case (Japan)
Pet in TV - With My Dear Dog (Japan)
Pizza Hut Disc 1 (USA)
PlayStation Demo Disc - Shock Your System! (USA) (SCUS-94482)
PlayStation Demo Disc - Shock Your System! (USA) (SCUS-94496)
PlayStation Underground 3.2 (USA) (Disc 2)
PlayStation Underground 3.3 (USA) (Disc 2)
PlayStation Underground 3.4 (USA) (Disc 2)
PlayStation Underground 4.1 (USA) (Disc 1)
PlayStation Underground 4.2 (USA) (Disc 2)
PlayStation Underground Jampack - Fall 2001 (USA)
PlayStation Underground Jampack - Summer 2K (USA)
PlayStation Underground Jampack - Summer '99 (USA)
PlayStation Underground Number 4 (USA) (Disc 1)
Pocket Jiman (Japan)
Pocket MuuMuu (Japan)
Pocket Zanmai - 3 Title Iri Taikenban (PAQA, PokeTan, Pocket Jiman) (Japan)
Pop'n Music - Animation Melody (Japan)
Pop'n Music - Disney Tunes (Japan)
Pop'n Music 2 (Japan)
Pop'n Music 3 - Append Disc (Japan)
Pop'n Music 4 - Append Disc (Japan)
Pop'n Music 5 (Japan)
Pop'n Music 6 (Japan)
PoPoLoCrois Monogatari II (Japan) (Disc 1)
PoPoLoCrois Monogatari II (Japan) (Disc 2)
PoPoLoCrois Monogatari II (Japan) (Disc 3)
PoPoRoGue (Japan) (v1.1)
PrePre Vol. 1 (Japan)
PrePre Vol. 12 (Japan)
PrePre Vol. 19 (Japan) (Disc 1)
PrePre Vol. 6 (Japan) (Disc 2) (CM Collection II)
Pro Evolution Soccer (Europe) (En,Fr,De)
Pro Evolution Soccer 2 (Europe) (En,Fr,De)
Pro Evolution Soccer 2 (Europe) (Es,It)
Pro Wrestling Sengokuden 2 - Kakutou Emaki (Japan)
PS One Demo Disc 02 (Europe) (En,Fr,De,Es,It)
PSone - Wherever, Whenever, Forever. (USA)
PurePure Plus 002 - 1999 December (Japan) (Disc 1)
PurePure Plus 003 - 2000 February (Japan)
PurePure Plus 007 - 2000 December (Japan)
PurePure Vol. 7 (Japan)
Puzz Loop (Japan)
Registered Users Demo 05 (Europe) (En,Fr,De,Es,It)
Resident Evil - Survivor (Europe)
Resident Evil - Survivor (France)
Resident Evil - Survivor (USA)
Resident Evil 3 - Nemesis (Europe) (Demo)
Resident Evil 3 - Nemesis (Europe)
Resident Evil 3 - Nemesis (France)
Resident Evil 3 - Nemesis (Germany)
Resident Evil 3 - Nemesis (Ireland)
Resident Evil 3 - Nemesis (Italy)
Resident Evil 3 - Nemesis (Spain)
Resident Evil 3 - Nemesis (USA) (Demo)
Resident Evil 3 - Nemesis (USA)
Robbit mon Dieu (Japan)
Rockman X5 (Japan)
Rockman X6 (Japan)
Ronin Blade (Europe) (En,Fr,De)
SaGa Frontier II (Japan)
Saru! Get You! (Japan) (Demo)
Saru! Get You! (Japan) (v1.0)
Saru! Get You! (Japan) (v1.1)
Seiken Densetsu - Legend of Mana (Japan)
Shachou Eiyuu Den (Japan) (Ja,Zh)
Shiritsu Justice Gakuen - Nekketsu Seishun Nikki 2 (Japan)
Spyro - Year of the Dragon (USA) (v1.0)
Spyro - Year of the Dragon (USA) (v1.1)
Spyro the Dragon (Japan) (Shokai Genteiban)
Spyro x Sparx - Tondemo Tours (Japan)
Startling Adventures - Kuusou 3x Daibouken (Japan)
Street Fighter EX2 Plus (Europe)
Street Fighter EX2 Plus (Japan)
Street Fighter EX2 Plus (USA)
Strider 2 (USA)
Strider Hiryuu 1 & 2 (Japan) (Disc 1) (Strider Hiryuu)
Strider Hiryuu 1 & 2 (Japan) (Disc 2) (Strider Hiryuu 2)
Suikoden II (Europe) (Demo)
Suikoden II (Europe)
Suikoden II (Germany)
Suikoden II (Spain)
Suikoden II (USA)
Super Gals! Kotobuki Ran Special - Ikemen Get You Gals Party (Japan)
Suzu Monogatari (Japan)
Tennis no Oujisama - Sweat & Tears (Japan) (v1.0)
Tennis no Oujisama - Sweat & Tears (Japan) (v1.1)
Tennis no Oujisama - The Prince of Tennis (Japan)
Tetris with Card Captor Sakura - Eternal Heart (Japan)
Tiny Bullets (Japan)
Tokimeki Memorial 2 (Japan) (Disc 2) (v1.0)
Tokimeki Memorial 2 (Japan) (Disc 2) (v1.1)
Tokimeki Memorial 2 (Japan) (Disc 3) (v1.0)
Tokimeki Memorial 2 (Japan) (Disc 3) (v1.1)
Tokimeki Memorial 2 (Japan) (Disc 4) (v1.0)
Tokimeki Memorial 2 (Japan) (Disc 4) (v1.1)
Tokimeki Memorial 2 (Japan) (Disc 5) (v1.0)
Tokimeki Memorial 2 (Japan) (Disc 5) (v1.1)
Tokimeki Memorial Drama Series Vol. 3 - Tabidachi no Uta (Japan) (Disc 1)
Tokimeki Memorial Drama Series Vol. 3 - Tabidachi no Uta (Japan) (Disc 2)
Tokyo Game Show '99 Aki Special Taikenban (Japan)
Tomba! 2 - The Evil Swine Return (USA)
Tron ni Kobun (Japan)
Twisted Metal - Small Brawl (USA)
UFC - Ultimate Fighting Championship (Japan)
Um Jammer Lammy (Europe) (En,Fr,De,Es,It)
Um Jammer Lammy (Japan)
Um Jammer Lammy (USA) (Demo)
Um Jammer Lammy (USA)
Umapoly (Japan)
Vandal Hearts II - Tenjou no Mon (Japan)
Vandal Hearts II (Europe) (En,Fr,De)
Vandal Hearts II (Spain)
Vandal Hearts II (USA)
Velldeselba Senki - Tsubasa no Kunshou (Japan)
Virtual Kyoutei 2000 (Japan)
Virtual Kyoutei 21 (Japan)
Volfoss (Japan)

rama3
/// PSXDEV | ELITE ///
/// PSXDEV | ELITE ///
Posts: 336
Joined: April 16th, 2017, 10:54 pm

Re: PSNee further development

Post by rama3 » May 8th, 2017, 4:36 am

Could it be that NTSC-U games on a PAL / EU BIOS skip over the antimod protection routines?
I'm having trouble getting the protection screen on nearly all NTSC-U games.
Unfortunately, I only have 1 good NTSC-U console. I don't want to mess it up :p

Edit:
Yes, they do. Antimod kicks in on an NTSC-J BIOS as well, so I changed consoles and now I get them :)

Edit2:
Updated my findings on Vandal Hearts 2.

rama3
/// PSXDEV | ELITE ///
/// PSXDEV | ELITE ///
Posts: 336
Joined: April 16th, 2017, 10:54 pm

Re: PSNee further development

Post by rama3 » May 8th, 2017, 9:00 am

Here's my work in progress. It uses the position 0 switch on the laser assembly. To make this work, a bit of sticky tape is required, so that the switch closes even when the read head is a little further out. I use 2 layers of electrical isolation tape.

Tested on an NTSC-J PU-18, using an Arduino Uno.

Code: Select all

//                    PPPPPPPPPPPPPPPP                  P            P       
//                   P              P                  PP           P       
//                  P              P                  P P          P         
//                 P              P                  P  P         P         
//                P              P                  P   P        P           
//               P              P                  P    P       P           
//              P              P                  P     P      P             
//             PPPPPPPPPPPPPPPP  PPPPPPPPPPP     P      P     P  PPPPPPPPPPP  PPPPPPPPPPP
//            P                 P               P       P    P  P            P
//           P                 P               P        P   P  P            P 
//          P                 P               P         P  P  P            P   
//         P                 P               P          P P  P            P   
//        P                 PPPPPPPPPPPPPP  P           PP  PPPPPPP      PPPPPPP   
//       P                              P  P            P  P            P     
//      P                              P  P            P  P            P       
//     P                              P  P            P  P            P       
//    P                              P  P            P  P            P       
//   P                              P  P            P  P            P       
//  P                              P  P            P  P            P         
//                     PPPPPPPPPPPP  P            P  PPPPPPPPPPP  PPPPPPPPPPP   VERSION 6!

//Update 7th of May 2017
//Branched and tweaked for use with the Position 0 switch on a PSX laser.
//(Requires a bit of sticky tape at the point where the switch touches the laser assembly.)
//This allows deterministic SCEX injections, without relying on timing. Also gets rid of connection wires for LID and RESET.
//WIP!

//UPDATED AT MAY 14 2016, CODED BY THE FRIENDLY FRIETMAN :-)

//PsNee, an open source stealth modchip for the Sony Playstation 1, usable on
//all platforms supported by Arduino, preferably ATTiny. Finally something modern!


//--------------------------------------------------
//                    TL;DR
//--------------------------------------------------
//Look for the "Arduino selection!" section and verify the target platform. Hook up your target device and hit Upload!
//BEWARE: when using ATTiny45, make sure the proper device is selected (Extra=>Board=>ATTiny45 (internal 8MHz clock))
//and the proper fuses are burnt (use Extra=>Burn bootloader for this), otherwise PsNee will malfunction. A tutorial on
//uploading Arduino code via an Arduino Uno to an ATTiny device: http://highlowtech.org/?p=1695
//Look at the pinout for your device and hook PsNee up to the points on your Playstation.


//--------------------------------------------------
//                 General info!
//--------------------------------------------------
//PLAYSTATION 1 SECURITY - HOW IT DOES IT'S THING:
//Sony didn't really go through great lenghts to protect it's precious Playstation
//from running unauthorised software; the main security is based on a simple ASCII
//string of text that is read from a part of an original Playstation disc that cannot
//be reproduced by an ordinary PC CD burner.
//As most of you will know, a CD is basically a very long rolled up (carrier) string in which very
//little pits and ehm... little not-pits are embedded that represent the data stored on the disc.
//The nifty Sony engineers did not use the pits and stuff to store the security checks for
//Playstation discs but went crazy with the rolled up carrier string. In an ordinary CD, the
//string is rolled up so that the spacing between the tracks is as equal as possible. If that
//is not the case, the laser itself needs to move a bit to keep track of the track and
//reliably read the data off the disc.
//If you wonder how the laser knows when it follows the track optimally: four photodiodes, light
//intensity measurement, difference measurements, servo. There.
//To the point: the Sony engineers decidedly "fumbled up" the track of sector 4 on a Playstation
//disc (the track was modulated in nerd-speak) so that the error correction circuit outputs a
//recognisable signal, as the laser needs to be corrected to follow the track optimally.
//This output signal actually is a 250bps serial bitstream (with 1 start bit and 2 stop bits) which
//in plain ASCII says SCEA (Sony Computer Entertainment of America), SCEE (Sony Computer Entertainment
//of Europe) or SCEI (Sony Computer Entertainment of Japan), depending on the region of the disc inserted.
//The security thus functions not only as copy protection, but also as region protection.
//The text string from the disc is compared with the text string that is embedded in the Playstation
//hardware. When these text strings are the same, the disc is interpreted to be authentic and from
//the correct region. Bingo!

//HOW THE MODCHIP TRICKS THE PLAYSTATION:
//The modchip isn't all that of a complicated device: clever reverse engineers found the point on the
//Playstation motherboard that carried the text string from the disc and found a way to temporarily block
//this signal (by grounding an input of an op-amp buffer) to be able to inject the signal from the modchip
//The modchip injects after about 1500ms the text strings SCEE SCEA SCEI on the motherboard point and stops
//with this after about 25 seconds. Because all the possible valid region options are outputted on the
//motherboard the Playstation gets a bit confused and simply accepts the inserted disc as authentic; after all,
//one of the codes was the same as that of the Playstation hardware...
//Early modchips applied the text strings as long as power was applied to them, whereby later Playstation
//software could detect whether a modchip was installed. This is circumvented in this application by idling the
//modchip after about 25 seconds. The text strings are only tranmitted again when the CD lid is opened and closed
//again, to enable playing multi-disc games. This is also called a stealth modchip in marketing-speak.


//--------------------------------------------------
//               New in this version!
//--------------------------------------------------
//A lot!
// - The PAL SCPH-102 NTSC BIOS-patch works flawlessly! For speed reasons this is implemented in bare
//   AVR C. It is functionally identical to the OneChip modchip, this modchip firmware was disassembled,
//   documented (available on request, but written in Dutch...) and analyzed with a logic analyzer to
//   make sure PsNee works just as well.
// - The code now is segmented in functions which make the program a lot more maintable and readable
// - Timing is perfected, all discs (both backups and originals of PAL and NTSC games) now work in the
//   PAL SCPH-102 test machine
// - It was found out that the gate signal doesn't havbe to be hooked up to a PAL SCPH-102 Playstation
//   to circumvent the copy protection. This is not tested on other Playstation models so the signal still
//   is available
// - The /xlat signal is no longer required to time the PAL SCPH-102 NTSC BIOS-patch
// - Only AVR PORTB is used for compatibility reasons (almost all the AVR chips available have PORTB)


//--------------------------------------------------
//                  Pinouts!
//--------------------------------------------------
//FOR ARDUINO UNO (WITH ATMEGA328):
// - Arduino pin 8  = data    = ATMega pin 14
// - Arduino pin 9  = gate    = ATMega pin 15
// - Arduino pin 10 = lid     = ATMega pin 16
// - Arduino pin 11 = biosA18 = ATMega pin 17
// - Arduino pin 12 = biosD2  = ATMega pin 18

//FOR ATTINY25/45/85:
// - Arduino pin 0 = data    = ATTiny pin 5
// - Arduino pin 1 = gate    = ATTiny pin 6
// - Arduino pin 2 = lid     = ATTiny pin 7
// - Arduino pin 3 = biosA18 = ATTiny pin 2
// - Arduino pin 4 = biosD2  = ATTiny pin 3

//--------------------------------------------------
//                    Includes!
//--------------------------------------------------
#include <Flash.h>

//--------------------------------------------------
//               Arduino selection!
//--------------------------------------------------
//#define ATTINY        //Make that "#define ARDUINO_UNO" if you want to compile for Arduino Uno instead of ATTiny25/45/85
#define ARDUINO_UNO        //Make that "#define ARDUINO_UNO" if you want to compile for Arduino Uno instead of ATTiny25/45/85

#ifdef ARDUINO_UNO
//Pins
int data = 8;         //The pin that outputs the SCEE SCEA SCEI string
int gate = 9;         //The pin that outputs the SCEE SCEA SCEI string
int lid = 10;         //The pin that gets connected to the internal CD lid signal; active high
int biosA18 = 11;     //Only used in SCPH-102 PAL mode
int biosD2 = 12;      //Only used in SCPH-102 PAL mode
int delay_ntsc = 2350;
int delay_between_bits = 4;
int delay_between_injections = 74;
#endif

#ifdef ATTINY
//Pins
int data = 0;        //The pin that outputs the SCEE SCEA SCEI string
int gate = 1;
int lid = 2;         //The pin that gets connected to the internal CD lid signal; active high
int biosA18 = 3;     //Only used in SCPH-102 PAL mode
int biosD2 = 4;      //Only used in SCPH-102 PAL mode
int delay_ntsc = 2400;
int delay_between_bits = 4;
int delay_between_injections = 68;
#endif

//--------------------------------------------------
//              Global variables!
//--------------------------------------------------
//None, just like it should be!
//--------------------------------------------------
//              Seperate functions!
//--------------------------------------------------
void NTSC_fix()
{
  //Make sure all pins are inputs
  DDRB = 0x00;
 
  //Wait until just before the pulse on BIOS A18 arrives
  delay(delay_ntsc);
 
  //...And wait here until it actually happened
  while(!(PINB & B00001000))
  {
    ;  //Wait
  }
  delayMicroseconds(12);
  PORTB = B00000000;
  DDRB = B00010000;
  delayMicroseconds(5);
  DDRB = 0x00;
}

void inject_SCEE()
{
  //SCEE-array                                                                                                                   //      Start            Data     Stop
  FLASH_ARRAY (boolean, SCEEData, 1,0,0,1,1,0,1,0,1,0,0,1,0,0,1,1,1,1,0,1,0,0,1,0,1,0,1,1,1,0,1,0,0,1,0,1,0,1,1,1,0,1,0,0);      //SCEE: 1 00110101 00, 1 00111101 00, 1 01011101 00, 1 01011101 00   44 bits total
 
  int bit_counter;

  for (bit_counter = 0; bit_counter < 44; bit_counter = bit_counter + 1)
  {
    if (SCEEData[bit_counter] == 0)
    {       
      pinMode(data, OUTPUT);
      digitalWrite(data, 0);
      delay(delay_between_bits);
    }
    else
    {
      pinMode(data, INPUT);                //We make the data pin high-impedance to let the pull-up of the Playstation motherboard make a 1
      delay(delay_between_bits);
    }
  }

  pinMode(data, OUTPUT);
  digitalWrite(data, 0);
  delay(delay_between_injections);
}

void inject_SCEA()
{
  //SCEE-array                                                                                                                   //      Start            Data     Stop
  FLASH_ARRAY (boolean, SCEAData, 1,0,0,1,1,0,1,0,1,0,0,1,0,0,1,1,1,1,0,1,0,0,1,0,1,0,1,1,1,0,1,0,0,1,0,1,1,1,1,1,0,1,0,0);      //SCEA: 1 00110101 00, 1 00111101 00, 1 01011101 00, 1 01111101 00
 
  int bit_counter;

  for (bit_counter = 0; bit_counter < 44; bit_counter = bit_counter + 1)
  {
    if (SCEAData[bit_counter] == 0)
    {       
      pinMode(data, OUTPUT);
      digitalWrite(data, 0);
      delay(delay_between_bits);
    }
    else
    {
      pinMode(data, INPUT);                //We make the data pin high-impedance to let the pull-up of the Playstation motherboard make a 1
      delay(delay_between_bits);
    }
  }

  pinMode(data, OUTPUT);
  digitalWrite(data, 0);
  delay(delay_between_injections);
}

void inject_SCEI()
{
  //SCEI-array                                                                                                                   //      Start            Data     Stop
  FLASH_ARRAY (boolean, SCEIData, 1,0,0,1,1,0,1,0,1,0,0,1,0,0,1,1,1,1,0,1,0,0,1,0,1,0,1,1,1,0,1,0,0,1,0,1,1,0,1,1,0,1,0,0);      //SCEI: 1 00110101 00, 1 00111101 00, 1 01011101 00, 1 01101101 00
 
  int bit_counter;
  
  for (bit_counter = 0; bit_counter < 44; bit_counter = bit_counter + 1)
  {
    if (SCEIData[bit_counter] == 0)
    {       
      pinMode(data, OUTPUT);
      digitalWrite(data, 0);
      delay(delay_between_bits);
    }
    else
    {
      pinMode(data, INPUT);                //We make the data pin high-impedance to let the pull-up of the Playstation motherboard make a 1
      delay(delay_between_bits);
    }
  }

  pinMode(data, OUTPUT);
  digitalWrite(data, 0);
  
  delay(delay_between_injections);
}

void inject_multiple_times(int number_of_injection_cycles)
{
  int cycle_counter;
 
  for(cycle_counter = 0; cycle_counter < number_of_injection_cycles; cycle_counter = cycle_counter + 1)
  {
    inject_SCEE();
    inject_SCEA();
    inject_SCEI();
  }
}

void inject_playstation()
{
  NTSC_fix();
 
  delay(6900);
  pinMode(data, OUTPUT);
  pinMode(gate, OUTPUT);
  digitalWrite(data, 0);
  digitalWrite(gate, 0);

  for (int loop_counter = 0; loop_counter < 20; loop_counter = loop_counter + 1)
  {
    inject_SCEI();
    //inject_SCEA();
    //inject_SCEE();
  }
 
  pinMode(gate, INPUT);
  pinMode(data, INPUT);
}

//!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
//--------------------------------------------------
//     Setup function - execution starts here!
//--------------------------------------------------
void setup()
{
  // Arduino docs say all INPUT pins are high impedence by default. Let's be explicit!
  pinMode(data, INPUT);
  pinMode(gate, INPUT);
  
  //inject_playstation(); // not required when watching the POS0 switch (except when NTSC_fix() is required!)

  // TODO :) 
  //attachInterrupt(digitalPinToInterrupt(2), function_name, CHANGE);
}

//----------------------------------------------------------------
//   Loop function - executes after the initial injection cycle
//----------------------------------------------------------------

void loop()
{
  bool POS0Sense = digitalRead(A0); // Active low
  
  if (!POS0Sense) {
    // Read head is in wobble area. Inject SCEX.
    pinMode(gate, OUTPUT);
    digitalWrite(gate, 0);
    
    digitalWrite(LED_BUILTIN, 1);
    
    // loop_counter is a tweak point. It depends on how good the contact to the POS0 switch is.
    for (int loop_counter = 0; loop_counter < 3; loop_counter = loop_counter + 1)
    {
       inject_SCEI();
       //inject_SCEA();
       //inject_SCEE();
    }
    digitalWrite(LED_BUILTIN, 0);
    pinMode(gate, INPUT);
    pinMode(data, INPUT);
  }
}

User avatar
Shadow
Admin / PSXDEV
Admin / PSXDEV
Posts: 2103
Joined: December 31st, 2012, 5:37 pm
PlayStation Model: H2000/5502

Re: PSNee further development

Post by Shadow » May 8th, 2017, 9:49 am

rama3 wrote:So someone wrote a tool to check disc images for antimod code and this nice list was produced :)
Know if anyone has that code? It'd be good to use in PSIO to detect anti-mod titles when images are converted so single-bin images.
Development Console: SCPH-5502 with 8MB RAM, MM3 Modchip, PAL 60 Colour Modification (for NTSC), DB-9 breakout headers for both RGB and Serial output and an Xplorer with CAETLA 0.34.

Development Computer: Windows 98, Pentium 3 [400MHz], 128MB SDRAM, DTL-H2000, DTL-H201A, 21" Sony Trinitron CRT, CD-ROM burner, 3.25" and 5.25" Floppy Diskette Drives and a ZIP 100 Diskette Drive.

Post Reply

Who is online

Users browsing this forum: No registered users and 1 guest