https://www.nierle.com/en/article/1001/ ... ieces.html
Reverse Engineering the PSX Copy Protection (Wobble Groove)
-
Administrator Verified
- Admin / PSXDEV
- Posts: 2678
- Joined: Dec 31, 2012
- I am a: Shadow
- PlayStation Model: H2000/5502
Try a PU-7 or PU-8 board with the analog servos and adjust the laser power slightly since CD-R's require more gain ![Wink ;)](./images/smilies/icon_e_wink.gif)
![Wink ;)](./images/smilies/icon_e_wink.gif)
Development Console: SCPH-5502 with 8MB RAM, MM3 Modchip, PAL 60 Colour Modification (for NTSC), PSIO Switch Board, DB-9 breakout headers for both RGB and Serial output and an Xplorer with CAETLA 0.34.
PlayStation Development PC: Windows 98 SE, Pentium 3 at 400MHz, 128MB SDRAM, DTL-H2000, DTL-H2010, DTL-H201A, DTL-S2020 (with 4GB SCSI-2 HDD), 21" Sony G420, CD-R burner, 3.25" and 5.25" Floppy Diskette Drives, ZIP 100 Diskette Drive and an IBM Model M keyboard.
PlayStation Development PC: Windows 98 SE, Pentium 3 at 400MHz, 128MB SDRAM, DTL-H2000, DTL-H2010, DTL-H201A, DTL-S2020 (with 4GB SCSI-2 HDD), 21" Sony G420, CD-R burner, 3.25" and 5.25" Floppy Diskette Drives, ZIP 100 Diskette Drive and an IBM Model M keyboard.
Hello gentlemen. Following the discussion about disk security here. I want to help in some way, but I don't have all the methods, but I have an important one. I can manufacture it in my industry, on pressing machines. However, I only have the machines. I receive the stampers (master disc for pressing machine) from someone in the USA. I send the DDP (game or music image) ready for them to manufacture the stamper and send it to me to reproduce the discs in polycarbonate and bla bla bla. Should all ATIP or TE information be inserted into the stamper? Can they be inserted into an iso previously? How would this be done? any software? Does it have to be done when creating the Stamper? Do you know what the process of creating a Stamper is like? What software are you using? If you discover this, we can be partners in these experiences.
You can contact me whenever you want.
You can contact me whenever you want.
- david4599
- Curious PSXDEV User
- Posts: 16
- Joined: Mar 20, 2022
- I am a: Programmer, RE enthusiast
- PlayStation Model: 5502, 102
- Location: France
Hey, that's quite nice that you are in this industry!
The idea for replicating the copy protection was explained quickly in a youtube comment of a former Datel engineer that I mentioned earlier in this thread.
It's not something that we can insert into an iso file, it's basically made the same way as the ATIP but with a different modulation and data.
At the glass mastering step, we would "simply" need to replace the ATIP generating machine by a modchip that will send or not the 22kHz signal to the disc depending on the SCEx data.
This way, the pregroove will just be a 22kHz amplitude-modulated signal of the 250bit/s SCEx serial data instead of the ATIP.
I'm not totally sure but I think there are actually 2 ways to do it. Either by a modulated pregroove like the ATIP or directly the pits/lands that are shifted radially without any pregroove.
But how easy would it be to create a CD-ROM stamper with oscillating pregroove (usually for CD-R/RW process) or oscillating pits/lands?
However, from what I understand, you just receive the already-made stampers, so is it something that you would be able to do? Do you even have access to the ATIP and pits/lands generating machines?
The idea for replicating the copy protection was explained quickly in a youtube comment of a former Datel engineer that I mentioned earlier in this thread.
It's not something that we can insert into an iso file, it's basically made the same way as the ATIP but with a different modulation and data.
At the glass mastering step, we would "simply" need to replace the ATIP generating machine by a modchip that will send or not the 22kHz signal to the disc depending on the SCEx data.
This way, the pregroove will just be a 22kHz amplitude-modulated signal of the 250bit/s SCEx serial data instead of the ATIP.
I'm not totally sure but I think there are actually 2 ways to do it. Either by a modulated pregroove like the ATIP or directly the pits/lands that are shifted radially without any pregroove.
But how easy would it be to create a CD-ROM stamper with oscillating pregroove (usually for CD-R/RW process) or oscillating pits/lands?
However, from what I understand, you just receive the already-made stampers, so is it something that you would be able to do? Do you even have access to the ATIP and pits/lands generating machines?
-
- What is PSXDEV?
- Posts: 2
- Joined: Apr 04, 2024
- PlayStation Model: SCPH-7502
- Location: Australia
Hi David,
Fantastic work.
I think you might be referring to me when you said "was done 20 years ago on a private forum"
I am guessing it was Mr Lau that told you those two decade old stories.
The method was to increase the disc rotational speed so that the 20Khz wobble became a 60Khz wobble.
If you are actually able to boot to a game and play then you have done better than me. I was able to inject the wobble to make the SCEE string and get the CD Controller into data mode. Other things happened in my life that made me not pursue it further. I'd done what I thought was the hardest part of the challenge so I was happy with myself even if I didn't end up with a 100% useful result.
I may still have the hardware sitting in some cardboard boxes somewhere. The burner was a HP4020i (rebrand of philips CDD2000 I think). I did not modify the firmware at all. I am not smart enough to do that kind of thing. It just had blue wires and lifted pins so I could change the rate at which the EFM data was being spat out.
If those forums got archived anywhere you should search for the string "Violently Colliding Peramelidae 2"
Fantastic work.
I think you might be referring to me when you said "was done 20 years ago on a private forum"
![Smile :)](./images/smilies/icon_e_smile.gif)
The method was to increase the disc rotational speed so that the 20Khz wobble became a 60Khz wobble.
If you are actually able to boot to a game and play then you have done better than me. I was able to inject the wobble to make the SCEE string and get the CD Controller into data mode. Other things happened in my life that made me not pursue it further. I'd done what I thought was the hardest part of the challenge so I was happy with myself even if I didn't end up with a 100% useful result.
I may still have the hardware sitting in some cardboard boxes somewhere. The burner was a HP4020i (rebrand of philips CDD2000 I think). I did not modify the firmware at all. I am not smart enough to do that kind of thing. It just had blue wires and lifted pins so I could change the rate at which the EFM data was being spat out.
If those forums got archived anywhere you should search for the string "Violently Colliding Peramelidae 2"
- david4599
- Curious PSXDEV User
- Posts: 16
- Joined: Mar 20, 2022
- I am a: Programmer, RE enthusiast
- PlayStation Model: 5502, 102
- Location: France
Hi, thanks!
That's great to get more information on the origins of the project!
I don't know Mr Lau but I will check with the guy that told me the story.
I guessed that increasing the disc speed was your solution too.
60kHz seems a bit extreme to me but at least the original wobble is not an issue anymore.
I'm a bit worried to go far beyond the supported speeds knowing that the disc may leave its support. Also the spindle hubs are old and some of them come to pieces with time. Reading game data in 2x mode would be scary at this speed.
That's great to get more information on the origins of the project!
I don't know Mr Lau but I will check with the guy that told me the story.
I guessed that increasing the disc speed was your solution too.
60kHz seems a bit extreme to me but at least the original wobble is not an issue anymore.
I'm a bit worried to go far beyond the supported speeds knowing that the disc may leave its support. Also the spindle hubs are old and some of them come to pieces with time. Reading game data in 2x mode would be scary at this speed.
-
gwald Verified
- Net Yaroze Enthusiast
- Posts: 309
- Joined: Sep 18, 2013
- I am a: programmer/DBA
- PlayStation Model: Net Yaroze
- Contact:
This is probably the only way going forward to get a PSX booting CD.
I noticed the screenshot of the Detal guy mentions also modifying a CDR ATIP track.
Can a glass master be made direct from the CDR?
If I understand this correctly:
1) You would modify a CD burner to burn with the laser turning on and off at the frequency of 22kHz or speeding up (or slowing down) the disc motor speed.
2) Using #1 you would only would burn a single ATPI track, is this like opening a multisession CD? And the data is the TOC or just 1's?
3) In a normal burner, (burn TOC again?) finished the burn with the reset of CD data/audio tracks (and close multisession?)
I've never tried PSX multisession: viewtopic.php?t=1014
I would like to give this a go, I know I don't have the skills.
I can get a R. Pico, USB Logic Analyzer and a few old IDE CD burners.
And try to find where the laser is controlled and try it out.
If someone could confirm or correct me, I would appreciate it.
I'm following you on twitter, it's a good thread.
I noticed the screenshot of the Detal guy mentions also modifying a CDR ATIP track.
Can a glass master be made direct from the CDR?
If I understand this correctly:
1) You would modify a CD burner to burn with the laser turning on and off at the frequency of 22kHz or speeding up (or slowing down) the disc motor speed.
2) Using #1 you would only would burn a single ATPI track, is this like opening a multisession CD? And the data is the TOC or just 1's?
3) In a normal burner, (burn TOC again?) finished the burn with the reset of CD data/audio tracks (and close multisession?)
I've never tried PSX multisession: viewtopic.php?t=1014
I would like to give this a go, I know I don't have the skills.
I can get a R. Pico, USB Logic Analyzer and a few old IDE CD burners.
And try to find where the laser is controlled and try it out.
If someone could confirm or correct me, I would appreciate it.
I'm following you on twitter, it's a good thread.
david4599 wrote: βSeptember 1st, 2023, 8:03 amOn the ECMA-394, it is said the wobble has an amplitude of only 30nm and a spatial period of 54 to 64um.nocash wrote: βAugust 31st, 2023, 12:18 pm I can't find any good pictures that are showing how the normal CDR wobble should look like... now I am wondering if that's the same kind of wobbling at all (especially as the PSX wobble appears to generate that audible sound in the drive mechanics, I guess regular CDRs won't do such things).
So, even with excellent pictures, I guess it would be impossible to see it to the eye.
Yes, the PS1 discs have the same wobble, just the modulation is changing.
FYI, Datel did modify factory machines not to use the ATIP generating machine but a microcontroller to switch on and off the 22kHz. As simple as that.
https://www.youtube.com/watch?v=XUwSOfQ ... omF4AaABAg
Comment on how Datel produced PS1 discs.png
Don't waste discs and time on that.alexfree wrote: βAugust 30th, 2023, 2:04 pm I've dug into the cdrdao source code quite a bit, and I do wonder something. The lead in data is written as zero data (per spec), but it doesn't actually have to be zero data. It could be hacked on to write anything during the burn. Since 80 minute CD-Rs have tighter spiral windings, and there is the possibility of servo drift, I really wonder.
Changing the sectors data in the lead-in by choosing the EFM symbols will not disturb the tracking signal of the PS1 pickup enough if at all. EFM is used to avoid synchronization errors and it is impossible to write tens or hundreds of 1 at once using this encoding. Also, the EFM conversion is done in the burner, possibly hard-coded in the DSP itself, not in the firmware. The burning softwares, even set in raw mode, have no control on that.
I remember the cdimage project that is able to draw images on CDs using only 4 EFM symbols that have a different numbers of 1 (from what I understood) allowing to create 4 shades (I guess, not tested) visibles to the eye. The created file just needs to be burned in audio mode i.e. without scrambling. That's the best we can do using the conventional way.
https://github.com/arduinocelentano/cdimage
Instead I found another solution. Usually I don't post until something is mostly finished but I already teased a bit on Twitter so here we go:
To change the tracking signal, like nocash said, we indeed have to either take control on the laser and burn longer non-EFM pits/lands or input a foreign signal into the tracking coils of a burner.
In both cases, we also need to "remove" the original 22kHz wobble of a CD-R otherwise the signal will still be 1. This can be done by increasing the pits and lands length meaning that the disc will spin faster natively and the 22kHz will not be detected anymore by the PS1 when the custom pattern will be read.
I worked quite hard on that crazy project trying to experiment these ideas and I have finally great news!
2 months ago, I succeed in simulating the SCEx wobble and thus creating a self-bootable CD-R by using the first way I mentioned!![]()
(The reading struggle when loading the game I'm talking about is mostly due to the disc spinning faster than usual, combined with this Verbatim CD-R and also the pickup itself I think)
For now, it works only on one of my 5502 and it is really not stable (maybe 1 of 20-30 tries).
I'm still trying to improve that but it's really dfficult to modify the burner's firmware, know what the code is doing, figure out the unknown DSP commands (many of them will never be known because the datasheet is not public) in order to properly adjust some code without killing another laser diode. Ideally, a software mod would be nice but maybe a hardware mod can be easier to achieve a better result. I think I will try to solder some wires soon.
And I still have to write these blog posts... But I'm lazy...
Oh btw I was informed that this was done 20 years ago on a private forum! I was not the only one to achieve it and I was convinced about that, though it was also unreliable apparently. I don't know the method they used but probably one of the two said before.
- david4599
- Curious PSXDEV User
- Posts: 16
- Joined: Mar 20, 2022
- I am a: Programmer, RE enthusiast
- PlayStation Model: 5502, 102
- Location: France
From my understanding and from what I've seen somewhere probably on a CD replication website and wikipedia, the factories will just get the raw sectors from the disc like anyone would do with common softwares or the customer can send the files via internet. Then they will basically send the sectors into the Laser Beam Recorder (LBR) which will output the EFM signal on the glass master.
So this would not work with the CD-R in my video as the LBR will not output the weird non-EFM signal my burner did. They would probably consider it defective actually.
There is nothing to do with multisession in my method. To burn the pattern on an already burned disc, I'm abusing a feature of the burner.
But it should be also possible to swap a blank disc with the burned one when it enters in sleep mode and stops the motor (or by using the "Start/Stop Unit" MMC command) which will trick it and accept to burn.
Basically, the way I actually burned this CD-R is in 2 times using the Yamaha CRW-F1:
1. I burned the entire disc as usual but with a EFM rate of 1.6x slower so the disc speed in the PS1 will increase due to the EFM clock recovery of the CLV mode and this will cause to shift the 22kHz wobble to 35kHz. That way, it will be out of range of the wobble detector inside the PS1 while our own will be read.
I did it in software by adjusting the EFM encoder clock register in the reversed firmware. Now in hardware, my theory is that you need to see where the encoder clock input signal is, remove it and use a frequency generator to change it to 1.6x slower.
I guess that's how cunningfellow did, but I think this may cause bad side-effects on some drives.
2. Then I burned the SCEx pattern using the unique DiscT@2 feature of this drive that I could modify to allow overwriting existing data but also seeking quite precisely in the lead-in before burning and other stuff.
Replicating that feature in hardware would involve switching on and off the writing power of the laser, but not the reading one. You don't want to completely shutdown the laser diode even for a fraction of a second otherwise the burning process will stop as it will not be able to track the disc anymore.
Also, messing with the laser diode can destroy it easily. One of the first hardware tests I did 2 years ago was to wire a button on the laser diode driver ENABLE pin so I could drive the laser diode by hand when I wanted. I pushed the button and the burner stopped.
Then I made a small circuit to control it with an arduino at a few kHz which fried it the moment the arduino sent the pulses.
IIRC, these tests were done in reading power where the drive was in idle mode so I was surprised of the damage.
Now with a bit more hardware knowledge and reversing, there are 3 digital signals driving the laser diode usually called ENR, EN2, EN3.
ENR is for reading, EN2 and EN3 are for writing and are sometimes combined for different writing strategies (CD-R, CD-RW burning or erasing).
If you disable both EN2 and EN3, the burner "should" continue the burning process in reading power safely.
I actually made a little circuit with a relay to be able to disable them so I can test a few things. BUT by checking at the laser driver analog amplifiers inputs INR, IN2 and IN3, IN3 increases significantly in less than 2s while EN3 is manually disabled. If EN3 was enabled again, I bet the laser would be damaged.
Here is an example of what it looks like, the blue trace is IN2, and the pink one is IN3 (the large parts are due to the EFM switching noises, in reality they are just lines, the power does not oscillate): This behaviour seems due to the Automatic Laser Power Control circuit (ALPC) which is really annoying.
Oh and obviously, the switching frequency depends on the EFM rate and the burning speed. If you burn at 1x and change the EFM rate at 1.6x slower, then 22kHz / 1.6 = 13.75kHz.
If you (or anybody else) want to give it a try, then an oscilloscope would be required to see the data sent to the laser diode, carefully watch IN2 and IN3 to avoid damaging the laser diode and see how the PS1 reacts by checking the RF and tracking signals.
As a side note, I'm still working on this project and I think I found something to be more reliable at least on PS1 versions where the wobble detector is not inside the DSP (before PU-22 based on https://www.psdevwiki.com/ps1/CD_drive).
For PU-22 and later, I saw with my SCPH-102 that the tolerances are much tighter and it may not work for these versions with this method.
So this would not work with the CD-R in my video as the LBR will not output the weird non-EFM signal my burner did. They would probably consider it defective actually.
There is nothing to do with multisession in my method. To burn the pattern on an already burned disc, I'm abusing a feature of the burner.
But it should be also possible to swap a blank disc with the burned one when it enters in sleep mode and stops the motor (or by using the "Start/Stop Unit" MMC command) which will trick it and accept to burn.
Basically, the way I actually burned this CD-R is in 2 times using the Yamaha CRW-F1:
1. I burned the entire disc as usual but with a EFM rate of 1.6x slower so the disc speed in the PS1 will increase due to the EFM clock recovery of the CLV mode and this will cause to shift the 22kHz wobble to 35kHz. That way, it will be out of range of the wobble detector inside the PS1 while our own will be read.
I did it in software by adjusting the EFM encoder clock register in the reversed firmware. Now in hardware, my theory is that you need to see where the encoder clock input signal is, remove it and use a frequency generator to change it to 1.6x slower.
I guess that's how cunningfellow did, but I think this may cause bad side-effects on some drives.
cunningfellow wrote: βApril 5th, 2024, 12:24 am The burner was a HP4020i (rebrand of philips CDD2000 I think). I did not modify the firmware at all. I am not smart enough to do that kind of thing. It just had blue wires and lifted pins so I could change the rate at which the EFM data was being spat out.
2. Then I burned the SCEx pattern using the unique DiscT@2 feature of this drive that I could modify to allow overwriting existing data but also seeking quite precisely in the lead-in before burning and other stuff.
Replicating that feature in hardware would involve switching on and off the writing power of the laser, but not the reading one. You don't want to completely shutdown the laser diode even for a fraction of a second otherwise the burning process will stop as it will not be able to track the disc anymore.
Also, messing with the laser diode can destroy it easily. One of the first hardware tests I did 2 years ago was to wire a button on the laser diode driver ENABLE pin so I could drive the laser diode by hand when I wanted. I pushed the button and the burner stopped.
Then I made a small circuit to control it with an arduino at a few kHz which fried it the moment the arduino sent the pulses.
IIRC, these tests were done in reading power where the drive was in idle mode so I was surprised of the damage.
Now with a bit more hardware knowledge and reversing, there are 3 digital signals driving the laser diode usually called ENR, EN2, EN3.
ENR is for reading, EN2 and EN3 are for writing and are sometimes combined for different writing strategies (CD-R, CD-RW burning or erasing).
If you disable both EN2 and EN3, the burner "should" continue the burning process in reading power safely.
I actually made a little circuit with a relay to be able to disable them so I can test a few things. BUT by checking at the laser driver analog amplifiers inputs INR, IN2 and IN3, IN3 increases significantly in less than 2s while EN3 is manually disabled. If EN3 was enabled again, I bet the laser would be damaged.
Here is an example of what it looks like, the blue trace is IN2, and the pink one is IN3 (the large parts are due to the EFM switching noises, in reality they are just lines, the power does not oscillate): This behaviour seems due to the Automatic Laser Power Control circuit (ALPC) which is really annoying.
Oh and obviously, the switching frequency depends on the EFM rate and the burning speed. If you burn at 1x and change the EFM rate at 1.6x slower, then 22kHz / 1.6 = 13.75kHz.
If you (or anybody else) want to give it a try, then an oscilloscope would be required to see the data sent to the laser diode, carefully watch IN2 and IN3 to avoid damaging the laser diode and see how the PS1 reacts by checking the RF and tracking signals.
As a side note, I'm still working on this project and I think I found something to be more reliable at least on PS1 versions where the wobble detector is not inside the DSP (before PU-22 based on https://www.psdevwiki.com/ps1/CD_drive).
For PU-22 and later, I saw with my SCPH-102 that the tolerances are much tighter and it may not work for these versions with this method.
You do not have the required permissions to view the files attached to this post.
-
gwald Verified
- Net Yaroze Enthusiast
- Posts: 309
- Joined: Sep 18, 2013
- I am a: programmer/DBA
- PlayStation Model: Net Yaroze
- Contact:
Thanks for the detailed reply, I read it several times to understand this better
They read the data of the CDR, that's what I assumed also, so it's strange to me that the Detal guy modified a CDR burner, unless Datel disc's are CDR's?? He did say "CD-R masteringhouse".... I doubt it!
Anyway, sorry for more noob questions...
From my little understanding, the Yamaha drives can burn at slower speed (long pits and lands) for better reading of the media at the cost of less media, probably a good practice for 80min CDR's getting them close to the preferred 74min.
But they were only doing x1.176, x1.6 longer pits/lands would make an 80min CDR down to 50min, not complaining![Very Happy :D](./images/smilies/icon_e_biggrin.gif)
And like you said from, viewtopic.php?p=22613#p22613![Smile :)](./images/smilies/icon_e_smile.gif)
I guess it's the SCEx bytes modulated (@ 35kHz), converted into polar coordinates and converted into image data? I have no idea where it goes on the CDR... As you suggested I'll read the CDR specs
I just ordered a Yamaha CRW-F1UX with Nero software, so I expect I'll get it in a few weeks.
I found a program which stops the CDROM from spinning called CD Throttle.
I'm assuming some values are hard coded in the firmware and that's why you patched it?
Would you mind sharing how you modded your firmware so I can do some testing also?
This is exciting stuff! You are a true pioneer and I'm happy to follow and test where I can![Smile :)](./images/smilies/icon_e_smile.gif)
I guess once it's working reliably via the CRW-F1, it could just be a program like cdrecord that burns PS1 self booting CDR's?
I assume what the CRW-F1 does in hardware can be replicated via software? Or is a custom hardware mod required on a normal CDR burner?
![Smile :)](./images/smilies/icon_e_smile.gif)
They read the data of the CDR, that's what I assumed also, so it's strange to me that the Detal guy modified a CDR burner, unless Datel disc's are CDR's?? He did say "CD-R masteringhouse".... I doubt it!
![Shrug :shrug](./images/smilies/confusion/shrug.gif)
Anyway, sorry for more noob questions...
From my little understanding, the Yamaha drives can burn at slower speed (long pits and lands) for better reading of the media at the cost of less media, probably a good practice for 80min CDR's getting them close to the preferred 74min.
But they were only doing x1.176, x1.6 longer pits/lands would make an 80min CDR down to 50min, not complaining
![Very Happy :D](./images/smilies/icon_e_biggrin.gif)
And like you said from, viewtopic.php?p=22613#p22613
I can understand that post a lot better now, thanksdavid4599 wrote: βSeptember 2nd, 2023, 11:37 am A CD player is searching for the good pits/lands frequency and will automatically adapt the spindle speed (CLV mode). If the pits/lands are burned longer, the player will just increase the speed and the bitrate will stay the same (176kbps in 1x and 353kbps in 2x), musics and movies timings won't change. The donwnside is that the disc can hold less information since the pits/lands density is lower.
Also, in the real world, I guess spinning the disc faster increases vibrations or something mechanical like that and errors happen more often.
![Smile :)](./images/smilies/icon_e_smile.gif)
So you burn your data track with 1.6x slower EFM rate, which sets the CDR ATIP frequency to 35kHz speed.1. I burned the entire disc as usual but with a EFM rate of 1.6x slower so the disc speed in the PS1 will increase due to the EFM clock recovery of the CLV mode and this will cause to shift the 22kHz wobble to 35kHz. That way, it will be out of range of the wobble detector inside the PS1 while our own will be read.
How did you create the SCEx image?2. Then I burned the SCEx pattern using the unique DiscT@2 feature of this drive that I could modify to allow overwriting existing data but also seeking quite precisely in the lead-in before burning and other stuff.
I guess it's the SCEx bytes modulated (@ 35kHz), converted into polar coordinates and converted into image data? I have no idea where it goes on the CDR... As you suggested I'll read the CDR specs
I just ordered a Yamaha CRW-F1UX with Nero software, so I expect I'll get it in a few weeks.
I found a program which stops the CDROM from spinning called CD Throttle.
I'm assuming some values are hard coded in the firmware and that's why you patched it?
Would you mind sharing how you modded your firmware so I can do some testing also?
This is exciting stuff! You are a true pioneer and I'm happy to follow and test where I can
![Smile :)](./images/smilies/icon_e_smile.gif)
I guess once it's working reliably via the CRW-F1, it could just be a program like cdrecord that burns PS1 self booting CDR's?
I assume what the CRW-F1 does in hardware can be replicated via software? Or is a custom hardware mod required on a normal CDR burner?
- david4599
- Curious PSXDEV User
- Posts: 16
- Joined: Mar 20, 2022
- I am a: Programmer, RE enthusiast
- PlayStation Model: 5502, 102
- Location: France
The Datel products are definitely pressed CD-ROMs, not CD-Rs.
I guess the CD-ROM and CD-R glass masters can be made using the same machines?
If I'm not wrong, to make a CD-ROM glass master, the machines send the EFM pattern to the LBR and for CD-R, they just turn on the laser beam constantly to create the groove while oscillating it to create the ATIP.
I think the Playstation and Datel CDs are made using a mix of the CD-ROM and CD-R process. The 22kHz oscillator of the ATIP generation part has to be enabled and essentially a modchip lets the 22kHz enter the LBR or not. That way, the laser beam wiggles accordingly to the SCEx pattern while outputing the EFM of the game data.
Datel probably had acquaintance or were friends with some people in a CD factory to convince them to modify their machines.
The coordinates conversion is done by Nero not to get deformed pictures but we don't need to do it here because we don't really send pictures but just a pixels array.
I'm not sending the image with Nero though but with my modified version of f1tattoo from qpxtool. f1tattoo just converts the image in a simple bytes array and sends it in blocks into the burner.
Coincidently, once burned, the alternating pattern is already around 15kHz in the lead-in and we can adjust it by changing the EFM rate to 1.6x when burning which will increase the frequency to around 24kHz (and at the same time this will increase the original 22kHz to 35kHz).
The pattern has to be burned somewhere between 98:00:00 and 99:59:74 (ATIP time codes in the lead-in).
Even if we had the full firmware source code, I'm not sure that the microcontroller would have the ability to bypass the CD encoder and independently drive the laser diode.
DiscT@2 doesn't activate the CD encoder to get rid of the EFM generation and instead sends bitmap bytes to the DSP via a special command specific to that feature that manipulates clock signals driving the laser diode directly.
A hardware mod would be definitely easier to inject our own signal but I believe ALPC will be an issue as said in my last post.
Now the tests I did last week show that by using this DiscT@2 method, the result depends on the drive itself.
I was quite excited with the one I tested because I could get boot success 90% of the time using another trick (even if the success also depends on the angle we insert the disc on the motor probably because of the tracking stability and the overall drive state).
But I also tested with another drive on the same SCPH-5502 and that was a complete failure, 0% success... The SCEx code seen in the tracking signal was just too weak for the 22kHz filter to detect.
There is a bit of mystery that I can't fully explain with this issue but I think the sled's parked position is a bit too much on the left on some drives and that causes the lens to stay on the center when reading the lead-in beginning. However, the lens has to go to the left in order to the SCEx pattern to be really well detected because that creates better tracking differences between the E and F photodiodes.
I can't really share all the stuff right now as there are quite a lot of explanations I would need to say to setup everything and do proper testing.
I would prefer taking the time to gather the knowledge in some articles with detailed information, schematics, pictures, videos, firmware patches and scripts but documenting such a big project without forgetting anything important is a challenge.
There will be probably 3 articles: The SCEx protection code simulation, the reversing of the CRW-F1 and how to (not perfectly) replace the fried laser diode of this burner.
Actually, I began the F1 reversing one, and the laser replacement one is basically done even though I have to add/modify some stuff I learned with my other attempt a few months ago.
But before continuing writing them, I have a few other tests to do on the other method involving changing the tracking balance register according to the SCEx data while burning.
Also, as long as it's not reliable enough for every drive, an oscilloscope is required for troubleshooting and adjusting the pattern. Testing stuff blindly would be too hard.
Btw, something I neglected until recently was the cleaning of the spindle motors. Once the WD-40 was applied inside them, that was like night and day. This was clearly the main cause of the struggling issue when the PS1 was reading the game in my Twitter video.
Alexfree's guide and John-John's video (in French) helped on that.
I guess the CD-ROM and CD-R glass masters can be made using the same machines?
If I'm not wrong, to make a CD-ROM glass master, the machines send the EFM pattern to the LBR and for CD-R, they just turn on the laser beam constantly to create the groove while oscillating it to create the ATIP.
I think the Playstation and Datel CDs are made using a mix of the CD-ROM and CD-R process. The 22kHz oscillator of the ATIP generation part has to be enabled and essentially a modchip lets the 22kHz enter the LBR or not. That way, the laser beam wiggles accordingly to the SCEx pattern while outputing the EFM of the game data.
Datel probably had acquaintance or were friends with some people in a CD factory to convince them to modify their machines.
I can change the EFM rate when I want while burning so I can increase the disc speed only in the lead-in and decrease by little steps until reaching the program area. By doing that, it's still possible to get almost the full 80min.
Basically, the SCEx image is just made of alternating black/white pixels (burned/less burned areas) to mimic the 22kHz where there is a 1 in the SCEx data.
The coordinates conversion is done by Nero not to get deformed pictures but we don't need to do it here because we don't really send pictures but just a pixels array.
I'm not sending the image with Nero though but with my modified version of f1tattoo from qpxtool. f1tattoo just converts the image in a simple bytes array and sends it in blocks into the burner.
Coincidently, once burned, the alternating pattern is already around 15kHz in the lead-in and we can adjust it by changing the EFM rate to 1.6x when burning which will increase the frequency to around 24kHz (and at the same time this will increase the original 22kHz to 35kHz).
The pattern has to be burned somewhere between 98:00:00 and 99:59:74 (ATIP time codes in the lead-in).
Not only values, but code that I changed or even added by removing unused functions and data (mainly related to an aging mode to test the burner which takes more than 1000 lines of C, so there is quite a lot of space for custom code).
That would need some work to trigger my custom firmware commands but also to adapt the stuff related to DiscT@2 and the RAW burning mode but yeah, probably.
I don't think any normal burner can replicate DiscT@2 in software. The EFM conversion and the error correction things made in non programmable DSP chips prevent burning too long pits/lands.
Even if we had the full firmware source code, I'm not sure that the microcontroller would have the ability to bypass the CD encoder and independently drive the laser diode.
DiscT@2 doesn't activate the CD encoder to get rid of the EFM generation and instead sends bitmap bytes to the DSP via a special command specific to that feature that manipulates clock signals driving the laser diode directly.
A hardware mod would be definitely easier to inject our own signal but I believe ALPC will be an issue as said in my last post.
Now the tests I did last week show that by using this DiscT@2 method, the result depends on the drive itself.
I was quite excited with the one I tested because I could get boot success 90% of the time using another trick (even if the success also depends on the angle we insert the disc on the motor probably because of the tracking stability and the overall drive state).
But I also tested with another drive on the same SCPH-5502 and that was a complete failure, 0% success... The SCEx code seen in the tracking signal was just too weak for the 22kHz filter to detect.
There is a bit of mystery that I can't fully explain with this issue but I think the sled's parked position is a bit too much on the left on some drives and that causes the lens to stay on the center when reading the lead-in beginning. However, the lens has to go to the left in order to the SCEx pattern to be really well detected because that creates better tracking differences between the E and F photodiodes.
I can't really share all the stuff right now as there are quite a lot of explanations I would need to say to setup everything and do proper testing.
I would prefer taking the time to gather the knowledge in some articles with detailed information, schematics, pictures, videos, firmware patches and scripts but documenting such a big project without forgetting anything important is a challenge.
There will be probably 3 articles: The SCEx protection code simulation, the reversing of the CRW-F1 and how to (not perfectly) replace the fried laser diode of this burner.
Actually, I began the F1 reversing one, and the laser replacement one is basically done even though I have to add/modify some stuff I learned with my other attempt a few months ago.
But before continuing writing them, I have a few other tests to do on the other method involving changing the tracking balance register according to the SCEx data while burning.
Also, as long as it's not reliable enough for every drive, an oscilloscope is required for troubleshooting and adjusting the pattern. Testing stuff blindly would be too hard.
Btw, something I neglected until recently was the cleaning of the spindle motors. Once the WD-40 was applied inside them, that was like night and day. This was clearly the main cause of the struggling issue when the PS1 was reading the game in my Twitter video.
Alexfree's guide and John-John's video (in French) helped on that.
-
gwald Verified
- Net Yaroze Enthusiast
- Posts: 309
- Joined: Sep 18, 2013
- I am a: programmer/DBA
- PlayStation Model: Net Yaroze
- Contact:
Thanks for the reply... amazing research and work
I didn't know you could control the speed (EFM rate) like that!
Does the laser head move when it detects the speed change, and could increasing/decreasing it, create the SCEX wobble?
Can you control the EFM speed while in DiscT@2 mode?
Maybe a combination of EMF rate fluctuation and the DiscT@2 image could make it more reliable?
![Praise :praise](./images/smilies/bow/blue.gif)
![Clapping :clap](./images/smilies/eusa/clap.gif)
This is very very impressive!
I didn't know you could control the speed (EFM rate) like that!
![Shocked :shock:](./images/smilies/icon_eek.gif)
![Surprised :o](./images/smilies/icon_e_surprised.gif)
Does the laser head move when it detects the speed change, and could increasing/decreasing it, create the SCEX wobble?
Can you control the EFM speed while in DiscT@2 mode?
Maybe a combination of EMF rate fluctuation and the DiscT@2 image could make it more reliable?
That makes sense, sounds good. Well keep us up to date!david4599 wrote: βJune 3rd, 2024, 9:46 am I can't really share all the stuff right now as there are quite a lot of explanations I would need to say to setup everything and do proper testing.
I would prefer taking the time to gather the knowledge in some articles with detailed information, schematics, pictures, videos, firmware patches and scripts but documenting such a big project without forgetting anything important is a challenge.
![Praise :praise](./images/smilies/bow/blue.gif)
- david4599
- Curious PSXDEV User
- Posts: 16
- Joined: Mar 20, 2022
- I am a: Programmer, RE enthusiast
- PlayStation Model: 5502, 102
- Location: France
Thanks!
If you mean changing the EFM speed between slow and fast at 22kHz to create the wobble, I'm not sure that there would be enough voltage difference as side effect on the E and F tracking photodiodes.
I don't believe this kind of fluctuation trick would work though. The tracking signal will probably not be affected much if at all.
Theoretically no, it should stay on the track. The spindle motor just has to accelerate or decelerate to keep the same EFM frequency as its reference clock.
If you mean changing the EFM speed between slow and fast at 22kHz to create the wobble, I'm not sure that there would be enough voltage difference as side effect on the E and F tracking photodiodes.
The motor speed used for tattooing can be modified but the image width and the laser power need to be adjusted.
I don't believe this kind of fluctuation trick would work though. The tracking signal will probably not be affected much if at all.
- david4599
- Curious PSXDEV User
- Posts: 16
- Joined: Mar 20, 2022
- I am a: Programmer, RE enthusiast
- PlayStation Model: 5502, 102
- Location: France
So, after further testing, I'm not totally sure but it seems that only the counterfeited/clones KSM drives have issues reading the DiscT@2 SCEx pattern in the lead-in beginning.david4599 wrote: βJune 3rd, 2024, 9:46 am Now the tests I did last week show that by using this DiscT@2 method, the result depends on the drive itself.
I was quite excited with the one I tested because I could get boot success 90% of the time using another trick (even if the success also depends on the angle we insert the disc on the motor probably because of the tracking stability and the overall drive state).
But I also tested with another drive on the same SCPH-5502 and that was a complete failure, 0% success... The SCEx code seen in the tracking signal was just too weak for the 22kHz filter to detect.
There is a bit of mystery that I can't fully explain with this issue but I think the sled's parked position is a bit too much on the left on some drives and that causes the lens to stay on the center when reading the lead-in beginning. However, the lens has to go to the left in order to the SCEx pattern to be really well detected because that creates better tracking differences between the E and F photodiodes.
I have several original drives (ACM, ADM, AEM, 2x AEM sleds, BAM) that I hooked up on my 5502 and they all read the pattern but not the only ADM clone one I have (which is the one with 0% success I'm talking about in the quote).
I even tested to put the clone sled inside an original ADM frame (plastic thing with spindle and sled motors attached) and it doesn't work.
However, it works the other way around, putting an original ADM sled inside the clone frame.
The difference is in the sled itself. Would this be a different manufacturing/QA-related stuff of the lens focus/tracking part? Or the laser + sensor chip? I don't know.
The good news is that using original drives, this seems quite reliable and I am now more confident that it will work for any of them (again, only before PU-22 for this DiscT@2 method).
Using a 5502, it often works, on 50 tries, I only had a few fails!
On a 1002, it doesn't work that well though.
Sometimes it fails because the disc tends to spin a bit too much faster when the drive sees the pattern due to the longer burned pits and this causes the SCEx bitstream to be higher than 250bit/s at the end (SCEx bit ~ 3.8-3.9ms). From testing, the SCEx bit duration should be between 3.9ms and 4.2ms.
I'm fixing this by increasing the size of the last 2 letters of "SCEx" in the DiscT@2 image but the tolerances are tight and the results are not always consistent.
Also, I had the case where the lens was stuck on a track where the pattern was, like if the drive was in pause mode.
It couldn't read the pattern entirely and then the SCEx reading timed out.
The WD-40 worked but it evaporated (as mentioned here). I bought some light oil and I had no issue since.david4599 wrote: βJune 3rd, 2024, 9:46 am Btw, something I neglected until recently was the cleaning of the spindle motors. Once the WD-40 was applied inside them, that was like night and day. This was clearly the main cause of the struggling issue when the PS1 was reading the game in my Twitter video.
Alexfree's guide and John-John's video (in French) helped on that.
The biggest problem I had on these aged drives is actually the seized spindle motor that needs to be lubricated for better stability and disc readability.
Lubricating it also helps to seek in the lead-in beginning and read the custom SCEx pattern there.
- masterg0r0
- Active PSXDEV User
- Posts: 65
- Joined: Jul 18, 2021
- I am a: Programmer
- Motto: They see me rollin'
- PlayStation Model: 1002+7502
- Location: UK
Hey, David
I saw your PS1 wobble groove video on Twitter. Love seeing your work so far.
I saw your PS1 wobble groove video on Twitter. Love seeing your work so far.
PSX Dev. Console: SCPH-7502 (PAL), MM3, Xplorer with Caetla 0.38.
Computer: Compaq Armada 1750, Windows 98SE, Pentium II 333MHz, 256MB RAM, 40GB IDE HDD, ESS AudioDrive, CD Drive, 3.5" Floppy (broken).
Computer: Compaq Armada 1750, Windows 98SE, Pentium II 333MHz, 256MB RAM, 40GB IDE HDD, ESS AudioDrive, CD Drive, 3.5" Floppy (broken).
Who is online
Users browsing this forum: No registered users and 2 guests