[DOWNLOAD] TMD Collection #01

Graphic based area of development (Graphics Processing Unit), including the Geometry Transform Engine (GTE), TIM, STR (MDEC), etc.
Post Reply
User avatar
Shadow
Verified
Admin / PSXDEV
Admin / PSXDEV
Posts: 2670
Joined: Dec 31, 2012
PlayStation Model: H2000/5502
Discord: Shadow^PSXDEV

[DOWNLOAD] TMD Collection #01

Post by Shadow » October 4th, 2012, 11:04 pm

A collection of .TMD's that can be used with 'BootEdit by Loser 2000' (via here).
If you want to make your own, read here: http://psxdev.net/forum/viewtopic.php?f=51&t=159

IMAGES:
(Here are a few examples)
Image
Image

DOWNLOAD:
http://psxdev.net/forum/download/file.php?id=95

You do not have the required permissions to view the files attached to this post.
Development Console: SCPH-5502 with 8MB RAM, MM3 Modchip, PAL 60 Colour Modification (for NTSC), PSIO Switch Board, DB-9 breakout headers for both RGB and Serial output and an Xplorer with CAETLA 0.34.

PlayStation Development PC: Windows 98 SE, Pentium 3 at 400MHz, 128MB SDRAM, DTL-H2000, DTL-H2010, DTL-H201A, DTL-S2020 (with 4GB SCSI-2 HDD), 21" Sony G420, CD-R burner, 3.25" and 5.25" Floppy Diskette Drives, ZIP 100 Diskette Drive and an IBM Model M keyboard.

User avatar
nocash
Verified
PSX Aficionado
PSX Aficionado
Posts: 541
Joined: Nov 12, 2012
Contact:

Post by nocash » June 11th, 2017, 10:45 am

Does that mean that it's possible to change the "PS" logo on the cdrom disc? And it's working on real hardware, and with all kernel revisions? I always thought that it'd be impossible to change the "PS" logo since the kernel (at least in PSone) does compare the whole disc logo against a copy in ROM, byte-by-byte... using this code:

Code: Select all

                 ;------------------
                 verify_ps_logo:
                  .....
8004D068 00009021 mov     r18,0    ;index
8004D06C AFB1001C mov     [sp+1Ch],r17
8004D070 3C108009 mov     r16,80090000h
8004D074 3C118007 mov     r17,80070000h
8004D078 8E100A90 mov     r16,[r16+0A90h] ;=A0010000h (cdrom data)
8004D07C 26319360 sub     r17,6CA0h       ;=80069360h (expected data)
                 @@lop:
8004D080 82220000 movbs   r2,[r17]
8004D084 82030000 movbs   r3,[r16]
8004D088 26310001 add     r17,1h
8004D08C 10620006 je      r3,r2,@@match
8004D090 26100001 add     r16,1h
8004D094 0C00C297 call    80030A5Ch  ;\post_r4
8004D098 24040007 mov     r4,7h      ;/
8004D09C 24040042 mov     r4,42h     ;8004D0A0 0C01A3F4 call    80068FD0h  ; syserror A(A1h)
8004D0A4 2405038D mov     r5,38Dh    ;/
                 @@match:
8004D0A8 26520001 add     r18,1h   ;index
8004D0AC 24013278 mov     r1,3278h ;len
8004D0B0 1641FFF3 jne     r18,r1,@@lop
8004D0B4 00000000 nop
                  .....
                 ;------------------

User avatar
Shadow
Verified
Admin / PSXDEV
Admin / PSXDEV
Posts: 2670
Joined: Dec 31, 2012
PlayStation Model: H2000/5502
Discord: Shadow^PSXDEV

Post by Shadow » June 11th, 2017, 1:26 pm

Yes, it can be changed and it boots on real hardware. It's in the boot sectors on the CD-ROM. I've actually extracted the original "PlayStation" TMD from (this image here).

The kernel might just be checking the TMD header info is correct to make sure the libraries that render the TMD itself don't cause any lockups or crashes, because like what 'Trimesh' said in another post, there is no EDC.
Development Console: SCPH-5502 with 8MB RAM, MM3 Modchip, PAL 60 Colour Modification (for NTSC), PSIO Switch Board, DB-9 breakout headers for both RGB and Serial output and an Xplorer with CAETLA 0.34.

PlayStation Development PC: Windows 98 SE, Pentium 3 at 400MHz, 128MB SDRAM, DTL-H2000, DTL-H2010, DTL-H201A, DTL-S2020 (with 4GB SCSI-2 HDD), 21" Sony G420, CD-R burner, 3.25" and 5.25" Floppy Diskette Drives, ZIP 100 Diskette Drive and an IBM Model M keyboard.

rama3
Verified
/// PSXDEV | ELITE ///
/// PSXDEV | ELITE ///
Posts: 510
Joined: Apr 16, 2017

Post by rama3 » June 11th, 2017, 9:56 pm

There's a quite useful compilation disc to download (Google) called "Psx Hacker Kit Beta 8 (18 in 1)".
It is patched with a custom PS logo and works on hardware, in case you want to try :)

User avatar
nocash
Verified
PSX Aficionado
PSX Aficionado
Posts: 541
Joined: Nov 12, 2012
Contact:

Post by nocash » June 12th, 2017, 5:55 am

rama3 wrote:There's a quite useful compilation disc to download (Google) called "Psx Hacker Kit Beta 8 (18 in 1)".
It is patched with a custom PS logo and works on hardware, in case you want to try :)
Thanks, nice to have some disc image ready for use.

From what I can see, it's working on many consoles, but not on all consoles in all regions.
With kernel version up to v3.0 it's working in all regions (EDIT: except japan).
With kernel version v4.0 and up it's booting in US only (not japan, not europe).

Looking at kernel v4.5e, the byte-by-byte logo verification is skipped depending on the variable at [8009099Ch], that variable contains some region flag (set depending on the last byte of the kernel's version/region string). The US kernel skips the verification, but the PAL version does execute it (and hangs with system error before even displaying the custom logo). The special case would be modchips with region-patch feature, with that modchips it should boot even on PAL PSones.
Matt wrote:The kernel might just be checking the TMD header info is correct to make sure the libraries that render the TMD itself don't cause any lockups or crashes, because like what 'Trimesh' said in another post, there is no EDC.
Yes, the three posts at http://www.psxdev.net/forum/viewtopic.p ... =80#p12537 about the logo & missing ECC/EDC brought me on that. I don't understand if/how the (missing) ECC/EDC are related to the logo.

Looking at the licence sectors in a PAL disc image... the ECC/EDC fields are containing nonzero values, that doesn't look as if they are missing, at least not on that disc (unless my disc-image recording tool should have automatically inserted the missing values). TriMesh, are you sure that the values are missing? And are they missing on all discs? Maybe they've been missing only on older discs - and it got fixed before releasing the first PAL titles? Then, that could explain why the PAL kernel insists on the correct logo, whilst US kernels are passing even with changed logos.
Last edited by nocash on June 13th, 2017, 5:32 am, edited 1 time in total.

User avatar
TriMesh
Verified
PSX Aptitude
PSX Aptitude
Posts: 225
Joined: Dec 20, 2013
PlayStation Model: DTL-H1202
Location: Hong Kong

Post by TriMesh » June 12th, 2017, 11:55 am

It seems to be down to which version of the SDK was used, and the burner that was used to create the master discs. Most of the early Japanese PSX games have zeros in that area, and these discs will boot on any console that can be coerced into booting Japanese discs. I haven't actually checked, but I suspect that even if the disc does contain valid EDC/ECC data it's not being used when reading the license data.

I would go back and check the Japanese boot ROMs again - none of them except the original V1.0 will boot discs with modified license data sectors. The V1.0 (installed in most SCPH-1000) will, but if the license data doesn't match then it suppresses the display of that black boot screen.

My guess is that this check was never put into the US and Asia models because they use the same boot ROM, but boot different territory discs (NTSC:U/C and NTSC:J), and Sony didn't want to make a special boot ROM with English text but NTSC:J disc verification.

User avatar
LameGuy64
Verified
Psy-Q Enthusiast
Psy-Q Enthusiast
Posts: 388
Joined: Apr 10, 2013
I am a: Hobbyist Game Developer
Motto: Commercial or not, play it!
PlayStation Model: H2000/7000
Location: Philippines
Contact:

Post by LameGuy64 » June 12th, 2017, 10:11 pm

I think the bad EDC/ECC in the license sectors could be the result of a crude license patcher tool used to inject the license data but did not inject the correct EDC/ECC information. Reason why I think that could be the case is because BUILDCD (the tool they used to compile disc images) won't inject the license data properly so I thought they could have used a quickly put together tool to inject the license data prior burning the image onto a gold disc. That, or it could be Sony's attempt to prevent people from reading the license sectors thinking that making the EDC/ECC information invalid would prevent CD drives from reading said sectors.
Please don't forget to include my name if you share my work around. Credit where it is due.

Dev. Console: SCPH-7000 with SCPH-7501 ROM, MM3, PAL color fix, Direct AV ports, DB-9 port for Serial I/O, and a Xplorer FX with Caetla 0.35.

DTL-H2000 PC: Dell Optiplex GX110, Windows 98SE & Windows XP, Pentium III 933MHz, 384MB SDRAM, ATI Radeon 7000 VE 64MB, Soundblaster Audigy, 40GB Seagate HDD, Hitachi Lite-on CD-RW Drive, ZIP 250 and 3.5" Floppy.

User avatar
nocash
Verified
PSX Aficionado
PSX Aficionado
Posts: 541
Joined: Nov 12, 2012
Contact:

Post by nocash » June 13th, 2017, 6:25 am

Oops, yes, the "Psx Hacker Kit Beta 8 (18 in 1)" doesn't boot with any japanese kernels (even v1.0J won't boot (maybe it dislikes the changed logo, or the changed licence strings, or the homebrew exe or whatever)).

The Hacker Kit has the licence string (on sector 4) replaced something saying "PSX HK B7... Presented by Pavlik 2006" and has the PS logo (on sector 5..11) replaced by some nuclear sign. Normally that sectors should look like so:

Code: Select all

the Licence String in sector 4 is,
  000h 32    Line 1      ("          Licensed  by          ")
  020h 32+6  Line 2 (EU) ("Sony Computer Entertainment Euro"," pe   ") ;\either
  020h 32+1  Line 2 (JP) ("Sony Computer Entertainment Inc.",0Ah)      ; one of
  020h 32+6  Line 2 (US) ("Sony Computer Entertainment Amer","  ica ") ;/these
  041h 1983  Empty (JP)    (filled by repeating pattern 62x30h,1x0Ah, 1x30h)
  046h 1978  Empty (EU/US) (filled by 00h-bytes)
The Playstation Logo in sectors 5..11 contains data like so,
  0000h ..   41h,00h,00h,00h,00h,00h,00h,00h,01h,00h,00h,00h,1Ch,23h,00h,00h
  0010h ..   51h,01h,00h,00h,A4h,2Dh,00h,00h,99h,00h,00h,00h,1Ch,00h,00h,00h
  0020h ..   ...
  3278h 588h FF-filled (remaining bytes on sector 11)
Does somebody know how that would look like on asian discs? I guess the license string in sector 4 might be different there(?)

And the PS logo in sector 5..11, I would assume that those 3278h bytes are 1:1 same in all regions, or do some discs use different logos/colors?

For some reason, the US/ASIA kernel is intentionally skipping the code that verifies those 3278h-bytes (ie. kernel v4.5e and v4.5a differ only by the region byte ("E" or "A"), and the logo-check exists in both versions, but it is skipped when the region byte is "A"). Though that skipping doesn't make too much sense to me (the logo contains only the "PS" symbol, not the region-specific "Licensed by..." text).

User avatar
TriMesh
Verified
PSX Aptitude
PSX Aptitude
Posts: 225
Joined: Dec 20, 2013
PlayStation Model: DTL-H1202
Location: Hong Kong

Post by TriMesh » June 13th, 2017, 12:30 pm

The Asia model consoles work with standard NTSC:J discs, identical to the ones sold in the Japanese market. Even the discs that are marked "For Japan Only" work with no problems on the Asian console models. I have some localized discs with the text translated to Chinese, but they are just NTSC:J and say "Sony Computer Entertainment Inc" on the boot screen.

Looking at the parts list for the Asian console shows that there are no unique parts in it except for the power supply. It uses the same CD sub MCU as the Japanese model and the same boot ROM as the US one. Interestingly, it also generates video with the same 7.5IRE setup level as the US model rather than the 0IRE setup that Japanese NTSC uses. I assume this is because it was sold in Taiwan which used standard US spec NTSC TVs which might crush the black levels when fed with a 0IRE signal.

The only reason I can think of for skipping the license sector verification completely is if there were some discs released in the US market that had non-standard license data on them, and this was never noticed because the early US consoles didn't check it.

The 1.0J boot ROM can boot non-Japanese discs. This is clearly a bug, since what happens is that the code checks for the Japanese license data and if it doesn't match then it won't display the black license screen - but it boots the disc anyway.

Post Reply

Who is online

Users browsing this forum: No registered users and 7 guests