How to dump your CDROM BIOS (Firmware)

Members research, findings and information that can be useful towards the PlayStation 1.
User avatar
Shadow
Verified
Admin / PSXDEV
Admin / PSXDEV
Posts: 2670
Joined: Dec 31, 2012
PlayStation Model: H2000/5502
Discord: Shadow^PSXDEV

Post by Shadow » February 18th, 2018, 8:34 pm

You can send it to either Trimesh or myself. NO$CASH has disappeared for some reason. Just send the board though. We don't need the plastic case or anything else to dump it.
Development Console: SCPH-5502 with 8MB RAM, MM3 Modchip, PAL 60 Colour Modification (for NTSC), PSIO Switch Board, DB-9 breakout headers for both RGB and Serial output and an Xplorer with CAETLA 0.34.

PlayStation Development PC: Windows 98 SE, Pentium 3 at 400MHz, 128MB SDRAM, DTL-H2000, DTL-H2010, DTL-H201A, DTL-S2020 (with 4GB SCSI-2 HDD), 21" Sony G420, CD-R burner, 3.25" and 5.25" Floppy Diskette Drives, ZIP 100 Diskette Drive and an IBM Model M keyboard.

Orion_
Verified
Legendary Programmer
Legendary Programmer
Posts: 240
Joined: Aug 13, 2012
I am a: Programmer
PlayStation Model: Net Yaroze
Location: France
Contact:

Post by Orion_ » August 31st, 2018, 4:26 am

Here I try again ...
This time with a Teensy 3.5, it's like an Arduino but ARM based, more powerful, with more RAM and a builtin SD card slot (so I could save the ROM directly on the SD Card)
Unfortunately I got no luck again ...
I don't get any serial data from the HC05 on the PSX board :(
(I really have no luck whenever I try to do electronics anyway...)

Here is my dump program: http://orionsoft.free.fr/storage/PSX_HC05.txt
And my wiring:
http://orionsoft.free.fr/storage/hc05_pu8_1.jpg
http://orionsoft.free.fr/storage/hc05_pu8_2.jpg

I tried to swap RX/TX, no luck, and I also tried to remove the while (!Serial1.available()); but all I get are zeroes as datas.
I might try adding a "while (!Serial1.availableForWrite());" before sending the dumper program to the PSX

Any help appreciated, so we could finally have a Net Yaroze HC05 dump...
Retro game development on Playstation and other consoles http://orionsoft.free.fr/

Orion_
Verified
Legendary Programmer
Legendary Programmer
Posts: 240
Joined: Aug 13, 2012
I am a: Programmer
PlayStation Model: Net Yaroze
Location: France
Contact:

Post by Orion_ » September 3rd, 2018, 6:35 am

ok I tried using my arduino as an USB to Serial converter (just remove the ATMega chip), and still no luck
all my soldering are good (verified twice), I send the dumper data from my PC at 9600 bauds to the PSX (I can see it's going through the arduino TX led)
then, I wait for data, and I get nothing back from the PSX :/
I tried everything, swapping RX/TX etc... nothing
I give up
Retro game development on Playstation and other consoles http://orionsoft.free.fr/

User avatar
Shadow
Verified
Admin / PSXDEV
Admin / PSXDEV
Posts: 2670
Joined: Dec 31, 2012
PlayStation Model: H2000/5502
Discord: Shadow^PSXDEV

Post by Shadow » September 3rd, 2018, 3:27 pm

Your website isn't working so I can't see your images. Did you solder the correct voltage rails to the HC05 in order to activate the built-in dumper?

Pull pin 17 high by soldering it to 3V5 and connect pin 31 to 7V5.

Also, pin 31 is the subcode data, so be sure to disconnect it from the DSP or else it won't work ;)
Note: If you don't do this, you can damage the board because of the excessive voltages :!:
Development Console: SCPH-5502 with 8MB RAM, MM3 Modchip, PAL 60 Colour Modification (for NTSC), PSIO Switch Board, DB-9 breakout headers for both RGB and Serial output and an Xplorer with CAETLA 0.34.

PlayStation Development PC: Windows 98 SE, Pentium 3 at 400MHz, 128MB SDRAM, DTL-H2000, DTL-H2010, DTL-H201A, DTL-S2020 (with 4GB SCSI-2 HDD), 21" Sony G420, CD-R burner, 3.25" and 5.25" Floppy Diskette Drives, ZIP 100 Diskette Drive and an IBM Model M keyboard.

Orion_
Verified
Legendary Programmer
Legendary Programmer
Posts: 240
Joined: Aug 13, 2012
I am a: Programmer
PlayStation Model: Net Yaroze
Location: France
Contact:

Post by Orion_ » September 3rd, 2018, 9:57 pm

I did all that, as you can see on my photos.
the only thing I did not is letting RX pin high at boot.
Retro game development on Playstation and other consoles http://orionsoft.free.fr/

User avatar
Shadow
Verified
Admin / PSXDEV
Admin / PSXDEV
Posts: 2670
Joined: Dec 31, 2012
PlayStation Model: H2000/5502
Discord: Shadow^PSXDEV

Post by Shadow » September 4th, 2018, 12:21 am

Orion_ wrote: September 3rd, 2018, 9:57 pm I did all that, as you can see on my photos.
the only thing I did not is letting RX pin high at boot.
As I said, I can't see your photos. Please upload them to a server which works and isn't based on 'free hosting' crap like 'Weeble' or 'Geeble' or whatever :roll:

Image

:no!
You do not have the required permissions to view the files attached to this post.
Development Console: SCPH-5502 with 8MB RAM, MM3 Modchip, PAL 60 Colour Modification (for NTSC), PSIO Switch Board, DB-9 breakout headers for both RGB and Serial output and an Xplorer with CAETLA 0.34.

PlayStation Development PC: Windows 98 SE, Pentium 3 at 400MHz, 128MB SDRAM, DTL-H2000, DTL-H2010, DTL-H201A, DTL-S2020 (with 4GB SCSI-2 HDD), 21" Sony G420, CD-R burner, 3.25" and 5.25" Floppy Diskette Drives, ZIP 100 Diskette Drive and an IBM Model M keyboard.

Orion_
Verified
Legendary Programmer
Legendary Programmer
Posts: 240
Joined: Aug 13, 2012
I am a: Programmer
PlayStation Model: Net Yaroze
Location: France
Contact:

Post by Orion_ » September 4th, 2018, 2:40 am

it seems like your internet provider sucks (or maybe you have an AV software blocking) because my website is reachable from all over the world (just tested USA and Australia)
https://www.webpagetest.org/result/1809 ... 6dde06cc9/

Image
Image
http://www.mirari.fr/tt09
Retro game development on Playstation and other consoles http://orionsoft.free.fr/

User avatar
Shadow
Verified
Admin / PSXDEV
Admin / PSXDEV
Posts: 2670
Joined: Dec 31, 2012
PlayStation Model: H2000/5502
Discord: Shadow^PSXDEV

Post by Shadow » September 4th, 2018, 11:42 am

Strange. My ISP is Telstra and I'm using Cloudflares DNS. Never had a problem with them.

Why did you have to code your own TTY handler. Why can't you just use a serial window and dump it directly (IE: echo all bytes received)?
Development Console: SCPH-5502 with 8MB RAM, MM3 Modchip, PAL 60 Colour Modification (for NTSC), PSIO Switch Board, DB-9 breakout headers for both RGB and Serial output and an Xplorer with CAETLA 0.34.

PlayStation Development PC: Windows 98 SE, Pentium 3 at 400MHz, 128MB SDRAM, DTL-H2000, DTL-H2010, DTL-H201A, DTL-S2020 (with 4GB SCSI-2 HDD), 21" Sony G420, CD-R burner, 3.25" and 5.25" Floppy Diskette Drives, ZIP 100 Diskette Drive and an IBM Model M keyboard.

Orion_
Verified
Legendary Programmer
Legendary Programmer
Posts: 240
Joined: Aug 13, 2012
I am a: Programmer
PlayStation Model: Net Yaroze
Location: France
Contact:

Post by Orion_ » September 4th, 2018, 5:24 pm

because I received no bytes at all. see my post: http://www.psxdev.net/forum/viewtopic.p ... 808#p14801
and because as suggested by trimesh, echoing bytes while receiving them might slow down the process and miss coming bytes.
Retro game development on Playstation and other consoles http://orionsoft.free.fr/

rama3
Verified
/// PSXDEV | ELITE ///
/// PSXDEV | ELITE ///
Posts: 510
Joined: Apr 16, 2017

Post by rama3 » September 5th, 2018, 2:44 am

Is your 3.5V point correct? Normally, you have 7.6V on pin 1, then ground on 2, then 3.5V on pin 3.

I would recommend making the ground connection closer to the Mechacon. Maybe that big plane near it is ground? You could use one side of the capacitor then.
The reason is that you want to keep the path for all currents short. It is important for stuff like data transmission.
It would be best if you soldered the connections to your Arduino as well.
At least solder the ground wire.

Is RX1 and TX1 correct for your dumper? If there's "0" versions as well, try using those! :)

User avatar
Shadow
Verified
Admin / PSXDEV
Admin / PSXDEV
Posts: 2670
Joined: Dec 31, 2012
PlayStation Model: H2000/5502
Discord: Shadow^PSXDEV

Post by Shadow » September 5th, 2018, 5:20 pm

Best thing to do would be to eliminate your Teensy microcontroller dumper and see if the HC05 is even outputting data. If you have an oscilloscope, I'd pop it on there and have a look. Otherwise, grab yourself an FTDI (IE: use something which doesn't require code to function).

Image
Development Console: SCPH-5502 with 8MB RAM, MM3 Modchip, PAL 60 Colour Modification (for NTSC), PSIO Switch Board, DB-9 breakout headers for both RGB and Serial output and an Xplorer with CAETLA 0.34.

PlayStation Development PC: Windows 98 SE, Pentium 3 at 400MHz, 128MB SDRAM, DTL-H2000, DTL-H2010, DTL-H201A, DTL-S2020 (with 4GB SCSI-2 HDD), 21" Sony G420, CD-R burner, 3.25" and 5.25" Floppy Diskette Drives, ZIP 100 Diskette Drive and an IBM Model M keyboard.

Orion_
Verified
Legendary Programmer
Legendary Programmer
Posts: 240
Joined: Aug 13, 2012
I am a: Programmer
PlayStation Model: Net Yaroze
Location: France
Contact:

Post by Orion_ » September 5th, 2018, 9:28 pm

Orion_ wrote: September 3rd, 2018, 6:35 am ok I tried using my arduino as an USB to Serial converter (just remove the ATMega chip), and still no luck
all my soldering are good (verified twice), I send the dumper data from my PC at 9600 bauds to the PSX (I can see it's going through the arduino TX led)
then, I wait for data, and I get nothing back from the PSX :/
I tried everything, swapping RX/TX etc... nothing
I give up
Retro game development on Playstation and other consoles http://orionsoft.free.fr/

User avatar
Shadow
Verified
Admin / PSXDEV
Admin / PSXDEV
Posts: 2670
Joined: Dec 31, 2012
PlayStation Model: H2000/5502
Discord: Shadow^PSXDEV

Post by Shadow » September 6th, 2018, 12:54 am

Why are you using your dumper program? Just use the one built into the HC05. Or am I missing something here...

EDIT: Ah, I see now. The Arduino doesn't support RS232 protocols without the user altering the hardware or doing it in software by relaying the serial data. I'd honestly just ditch the Arduino and use a proper RS232 device like the FTDI.
Development Console: SCPH-5502 with 8MB RAM, MM3 Modchip, PAL 60 Colour Modification (for NTSC), PSIO Switch Board, DB-9 breakout headers for both RGB and Serial output and an Xplorer with CAETLA 0.34.

PlayStation Development PC: Windows 98 SE, Pentium 3 at 400MHz, 128MB SDRAM, DTL-H2000, DTL-H2010, DTL-H201A, DTL-S2020 (with 4GB SCSI-2 HDD), 21" Sony G420, CD-R burner, 3.25" and 5.25" Floppy Diskette Drives, ZIP 100 Diskette Drive and an IBM Model M keyboard.

Myria
Curious PSXDEV User
Curious PSXDEV User
Posts: 17
Joined: Nov 05, 2014

Post by Myria » February 27th, 2021, 9:22 pm

Recently, some PS2 Mechacons from the SCPH-7xxxx series have been dumped. Here's what I see, with PS1 implications included.

SCPH-50000 and later have what is likely an entirely rewritten Mechacon, code-named Dragon, compared to earlier PS2s. 50000+ use ARM7TDMI, while earlier ones are supposedly SPC970, a custom Sony microcontroller related to the SNES sound CPU (SPC700). The test commands and EEPROM are very different between the two, leading to the rewrite suspicion.

* The region is selected via a Magicgate-encrypted portion of EEPROM rather than by using different Mechacon chips with different ROMs. TEST versus retail is also selected this way. Pre-50000 are currently believed to use different ROMs per region like PS1 did.
* There's a way to hook up a serial port to enable test functionality; this is used primarily for calibration but also for selecting the region. There are holes in the metal plates around the board meant for pins to touch these points without full disassembly or soldering.
* "for Japan" is a hardwired PS1 string for all regions and types.
* There is no secret unlock command for either PS1 or PS2.
* The only secret "unlock" command (S command 03:A4) clears the region so that the built-in serial test mode can change it. It requires proving that you know the Magicgate keys.
* The PS1 test commands are all fake except the SCEx counter stuff, which functions correctly (it will, in fact, detect a PS1 mod chip).
* TEST systems consider any CD that has a data track to be a PS1 disk unless it's a pressed PS2 disk or a PS2 master disk. Put in a PC CD-ROM and it'll just have a black PS1 logo screen and hang.
* PS1 command 1A on TEST systems returns "SCEI" if region is Japan but " " like PS1 debugs and Yaroze otherwise. No idea why.
* China-region PS2s use SCEx string "SCEC" for PS1 disks, which probably do not exist. Traditional Chinese / Southeast Asia and Korean models use SCEI.

tic
Interested PSXDEV User
Interested PSXDEV User
Posts: 6
Joined: Jan 31, 2020

Post by tic » April 6th, 2021, 7:04 pm

And its imposible send commands to the mechacon in ps2 mode?

I understand that when ps2 boot mechacon detect if it's a psx disc in ps2 mode?.

So why it's no possible send nocash unlock commands to mechacon in ps2 mode and simply then change to psx mode/execute disc?.

(speaking the old mechacon of course).

tic
Interested PSXDEV User
Interested PSXDEV User
Posts: 6
Joined: Jan 31, 2020

Post by tic » April 15th, 2021, 3:13 am

wisi wrote: September 26th, 2017, 11:17 pm Tested some PS1 CD commands on a PS2 SCPH-79004 (DECKARD model) in PS1 mode (if there is a hardware PS1 mode at all):
I wasn't sure exactly how commands are supposed to be sent, which may be why the transfer seemed unreliable at times. The other possibility being that I did the tests from patch code in DECKARD, so the code was running ~10 times faster than the original IOP. The CD PS1 mode registers couldn't be accessed before the (PS1) game started to run for some reason - I think it is because some initialization that I skipped (otherwise the known PS1-mode switching actions were all done - like writing to the corresponding CDVD DSP register and remapping the CDVD DSP to the PS1 CD range).
Another odd things was that when the INTerrupt value in 0x1F801803.Index1 would change from 0 to the actual value (on polling), sometimes it would first become one value and only on the second read does it turn to the expected INT value. This may be explained by the PPC running faster and the default method being waiting for interrupt rather than polling the register directly.
Also adding printing of the values written/read from CD registers would cause processing to stall at some point - maybe the added delay from the (bit-banged) serial printing would result in interrupts missed and that disturbed communication.
The test was done by intercepting the very first write to CD registers and executing the test-code then.
Here is what the first few accesses to CD registers look like ("<=" denotes write, while "=>" denotes read):

Code: Select all

 1F801800 <=  00000001  
 1F801803 <=  0000001F   ISR Interrupt Status Register

 1F801800 <=  00000001   
 1F801802 <=  0000001F   IER Interrupt Enable Register

 1F801800 =>  00000019   

 1F801800 <=  00000001   
 1F801803 <=  00000040   clear param FIFO

 1F801800 <=  00000000    
 1F801802 <=  00000000   write to param FIFO params: 0x00, 0x02, 0x04
 1F801802 <=  00000002   
 1F801802 <=  00000004   

 1F801801 <=  00000002   write to CMD reg

 1F801800 =>  00000038   poll command completion maybe

 1F801800 <=  00000001     
 1F801803 =>  000000E7   read ISR

 1F801800 <=  00000001   
 1F801803 <=  00000007   write to ISR to clear interrupt

 1F801800 <=  00000000   
 1F801800 =>  00000038   

 1F801800 <=  00000001   
 1F801803 =>  000000E0   

 1F801800 <=  00000001   
 1F801803 <=  00000007   

 1F801800 <=  00000000   
Commands:
The secret-unlock commands (0x50 - 0x56) do not seem to work - booting an unofficial disk after issuing them causes loading from it to stall. Responses to them are 0x13 0x40 (0x13 is not 0x11, because the motor was on at that time). (Tried with string "Inc." and "(Europe)"). I didn't test if arguments get cleared from the parameter buffer (my test code always sends a command to clear the arguments after each command).
0x19 0x22 Get Region ID String returns "for Japan", which probably explains why the above do not work.
0x19 0x20 Get Version returns: 98 06 11 C3.
There doesn't seem to be any main commands that respond as valid in the range 0x1F - 0xFF.
From the 0x19 sub-commands in the range 0x77 - 0xFF, unlike on the PS1, commands 0x80 - 0x8F seem to be valid: each takes 2 arguments - the sub-command number and another byte, and each always returns a stat byte (0x12) and zeroes (tested both with argument = 0x00 and 0xFF).
0x19 0x60 RAM Read does not work (sadly) - always returns zeroes for the whole range 0x0000 - 0xFFFF, otherwise the command is accepted as valid.

Doing that test on a non-DECKARD PS2 may be more difficult, as the IOP can't have code loaded from before switching to PS1 mode and the EE can't access its memory either in PS1 mode, so the only ways of loading code on the IOP in PS1 mode are by using a modchip or a PS1 disk. *The PS2 TOOL seems to have an option for *disabling* the EE access to IOP memory in PS1 mode so it is possible that early IOP revisions had support for that. There is also no way of exiting PS1 mode on the IOP once it has been entered (on the other hand, the EE can be switched back), but for a reset. The only known way of triggering PS1 mode is through a dedicated reset line, which is controlled by the EE.
The PS1 mode of the CDVD device should* be available in PS2 mode of the IOP, but that hasn't been tested. *The PS1 mode clock should be used in that mode, which may prevent correct communication with the IOP running with the PS2 mode clock.

Any news on reading the CDROM firmware of the DTL-H2000?
I have send the cd commands in my v3(in ps2 mode) . As you can suppose it fail,it return me int=7 and returns never.
I think it need cd/dvd in ps1 mode. but How it works?

how is enable cd/dvd ps1 mode by the ps1drv?.I have search and search but i not found nothing.Only the register that seet speed in cdvd controler and the register that reset the iop to psx mode...

and how is set the 33mhz clock in iop?

locarno
Curious PSXDEV User
Curious PSXDEV User
Posts: 19
Joined: Oct 05, 2014

Post by locarno » May 3rd, 2021, 5:54 am

Shadow wrote: May 15th, 2014, 3:23 am Okay, I'm dumping my SCPH-102 and 1002.

We can't disable line wrapping I'm sorry.
Maybe if I recoded the PHP logic. I'll have a look into that.
Did you finally dumped scph-102?

User avatar
Shadow
Verified
Admin / PSXDEV
Admin / PSXDEV
Posts: 2670
Joined: Dec 31, 2012
PlayStation Model: H2000/5502
Discord: Shadow^PSXDEV

Post by Shadow » May 26th, 2021, 11:54 am

locarno wrote: May 3rd, 2021, 5:54 am
Shadow wrote: May 15th, 2014, 3:23 am Okay, I'm dumping my SCPH-102 and 1002.

We can't disable line wrapping I'm sorry.
Maybe if I recoded the PHP logic. I'll have a look into that.
Did you finally dumped scph-102?
No, I never dumped the SCPH-102. I only dumped my SCPH-1002.
Development Console: SCPH-5502 with 8MB RAM, MM3 Modchip, PAL 60 Colour Modification (for NTSC), PSIO Switch Board, DB-9 breakout headers for both RGB and Serial output and an Xplorer with CAETLA 0.34.

PlayStation Development PC: Windows 98 SE, Pentium 3 at 400MHz, 128MB SDRAM, DTL-H2000, DTL-H2010, DTL-H201A, DTL-S2020 (with 4GB SCSI-2 HDD), 21" Sony G420, CD-R burner, 3.25" and 5.25" Floppy Diskette Drives, ZIP 100 Diskette Drive and an IBM Model M keyboard.

wisi
Curious PSXDEV User
Curious PSXDEV User
Posts: 11
Joined: Jan 27, 2016

Post by wisi » May 29th, 2021, 3:23 am

tic wrote: April 15th, 2021, 3:13 am I have send the cd commands in my v3(in ps2 mode) . As you can suppose it fail,it return me int=7 and returns never.
I think it need cd/dvd in ps1 mode. but How it works?

how is enable cd/dvd ps1 mode by the ps1drv?.I have search and search but i not found nothing.Only the register that seet speed in cdvd controler and the register that reset the iop to psx mode...

and how is set the 33mhz clock in iop?
See how PS1DRV (from the same model) switches the IOP into PS1 mode. Well... it is what you saw - maybe that CDVD reg has some effect and maybe it is the /SSRST line too (controlled by 0x1000F240 on the EE). It is still a bit unclear how the CDVD subsystem switches to PS1 mode - for most devices this is done with the /SSRST line (EE->/SRST->IOP->/SSRST) which resets all devices into PS1 mode, which also makes them (the IOP included) switch to their PS1 mode clock, but it may be that the CDVD DSP and the Mechacon need to detect a PS1 CD to switch to PS1 mode too.
I did the tests on a DECKARD model, so I could access the IOP mem from EE and CDVD regs too in PS1 mode. On a non-DECKARD model this is not possible in PS1 mode, because the SBUS interface changes to PGIF mode which doesn't support the EE access to IOP memory. To test on such a PS2, you'd need to somehow load your own code on the IOP after it switches to PS1 mode, and more or less the only way of doing this is using some CD which loads your code, for example from the controller port (if you want fast testing and don't want to waste multiple CDs while testing).

CRTRevivalDreamer
What is PSXDEV?
What is PSXDEV?
Posts: 2
Joined: Jun 12, 2021

Post by CRTRevivalDreamer » June 12th, 2021, 3:28 am

Near (the man behind the higan and ares multi-system emulators - formerly known as byuu) needs dumps of the missing retail PlayStation CD-ROM Firmwares in order to improve his PlayStation emulation core in ares!

Post Reply

Who is online

Users browsing this forum: No registered users and 3 guests