PSNee further development

[rama3]

Both the original PsNee and my mod support PU-18.
There is no complete walktrough for installation yet. I recommend you read through this thread and look at the latest code.
It will give you a good idea on what you need.

[Oxygeen]

Thanks for your reply, I've read the previous page where Element18592 got problem with his arduino nano running hot, Is there a chance that i got in the same situation with an arduino pro mini (5v 16m) or is it prefereable to go 5v 8m ?

[rama3]

Pro mini 16Mhz is perfect and use it with 3.5V.
I've tested these boards installed in a PSX with variable 3.5V supply and they work fine down to 3.0V, which is the minimum before the PSX power supply controller shuts off the rail

Element18592 uses an Arduino with a different layout. I will have to adapt the code to those models.
It'll be a while before my batch arrives from China.

By the way, I did this install yesterday. It's an altered code and the mini is installed in a LATE PU-8. Just shows a nice location for the board and where to get good power and ground.
I plan to do more pics of working installs later.

[rama3]

Yes, I'm sure.
Using the scope on this signal shows it nearly fully dragged high.
I don't know how that is, but the ATmega pin is configured as a regular input.

Edit:
Arduino docs say an input pin has 100 megohm resistance. Should really be plenty so no idea..

Are you sure your board isn't damaged? I just tried connecting an Atmega I/O pin to that point with the pin in input mode and it had no detectable effect...

So I looked at the gate situation again. The signal is indeed working fine when a modchip input pin is connected.
I guess I don't really understand what I see on the scope though. The scope shows what looks to be a permanent high.
I can spot some flickering at times though, which might be the intended low pulses that will generate the license strings for HC-05 pin 17.
I've now restored the gate function for PU-7 .. PU-18, since the original signal is still working and now I can use this wire for automatic board detection

[nocash]

i recently decieded to dust off my old SCPH-5552 PS1 (PU-18 motherboard)... is it possible to have a wiring diagram of some sort ?

I've been trying to make a "what pin is where" table for all mainboards here: http://www.psxdev.net/forum/viewtopic.php?f=47&t=1283 but for your PU-18 board, you would need the GATE signal, which is still filed as "unknown which pin it is meant to be on PU-18 boards" (or does anybody know that stuff?).
At the moment your best option would be to download PU-18 wiring diagrams for random modchips, and check if any of the depicted pins works when connecting your GATE signal to it.

[Oxygeen]

Pro mini 16Mhz is perfect and use it with 3.5V.
I've tested these boards installed in a PSX with variable 3.5V supply and they work fine down to 3.0V, which is the minimum before the PSX power supply controller shuts off the rail

Element18592 uses an Arduino with a different layout. I will have to adapt the code to those models.
It'll be a while before my batch arrives from China.

By the way, I did this install yesterday. It's an altered code and the mini is installed in a LATE PU-8. Just shows a nice location for the board and where to get good power and ground.
I plan to do more pics of working installs later.

Thanks for your help, i'll order the arduino right away

i recently decieded to dust off my old SCPH-5552 PS1 (PU-18 motherboard)... is it possible to have a wiring diagram of some sort ?

I've been trying to make a "what pin is where" table for all mainboards here: http://www.psxdev.net/forum/viewtopic.php?f=47&t=1283 but for your PU-18 board, you would need the GATE signal, which is still filed as "unknown which pin it is meant to be on PU-18 boards" (or does anybody know that stuff?).
At the moment your best option would be to download PU-18 wiring diagrams for random modchips, and check if any of the depicted pins works when connecting your GATE signal to it.

My PS1 was equipped back in the day from the previous owner by a PIC12c508, but i never knezw what bios was on there, so i never knew what the modchip does exactly, i never played backup games.

But yesterday i gave it a shot, tried to burn, every games that i could fine, some where .cue, others in .bin. The only one who worked (and i still don't know how) was Crash Team Racing NTSC (on a PAL console + PAL TV. kek.) I tried some Europeen games, no luck, even my own GT2 GT Mode disc, backuped and burnt on a CD-R, nothing.

I don't know what's goin' on, maybe some potato soldering issues and chip starting to die...

By searching around this chip i've found this wiring guide : http://modchip.aeug.org/install/508-pu18.html


@Rama, you said that your pro mini work on PU-18, where did you took the gate signal ?

[rama3]

Point 5 in old diagrams. http://www.fatcat.co.nz/psx/install/550 ... m3pu18.jpg

[Oxygeen]

Thanks Rama, i ordered the arduino to make the mod myself, i will be able to manage thing if it went wrong, which was impossible with this previously installed PIC

[rama3]

One Arduino?
Why not go with a nice 5 pack for a dollar each? These things are just so useful

[rama3]

Subchannel "Point" can be 01h..99h or A0h..A2h during Lead-In, 01h..99h are for the tracks, and on a disc with many tracks those are outnumbering the special A0h..A2h values, so you should accept 01h..99h, too. Would be better to verify the 16bit CRC for making sure that it's intact lead-in data.
Ah, or the A0h..A2h values occuring every some sectors, interleaved with the 01h..99h values?

The 0xA values are not interleaved. On a game disk with many audio tracks, it takes 1 to 2 seconds for them to finally appear.
I've still decided not to unlock such disks on audio tracks because:
- it would cause the chip to "unlock" music disks, instead of going straight to the CD player
- a boot delay of ~2 seconds is acceptable to me for the very few games that have many audio tracks

I'm using the re-release of Tomb Raider 2, which has 71 tracks in the TOC. The extra delay is barely noticeable, mainly because the rest of the injection timing works so well (only 2 injections necessary to unlock the HC-05).

CRC verification isn't necessary. If these sectors are bad, the console has too many issues to read anything, anyway :p

[culexus]

Thank you rama3 for making this

Just installed the pro mini 5V in my psone 102-PAL. It works great but some games stops loading most of them do loade fine.
I only hooked up 3 wires (data,subq,sqck). did I miss something?
My Psone is brand new so this mod was really nice

[culexus]

Got a funny error when loading Wipeout 3, the intro plays nice but when it starts to load the game menu the controller starts to shake and the loading stops followed by graphich error. Like gpu memmory glitch. Any idea?

[rama3]

You did use 3.5V, right? Never connect a modchip to 5V!

[culexus]

Yeah I did hook it up for the 3.5v. The only thing I may have done wrong was to uploade the sketch with my 5v ftdi when the arduino was hooked up inside the psone. This may have bleeded 5v into the psone and therfore exposed some chips to 5v:(

The other thing may be to thin/long gnd and vcc line. Or that I burn the backup games on bad disks and with high writespeed.

I will try lower writespeed another image of the same game. If not change the vcc and gnd with fat wire. If this do not help I will donor the pro mini over to the next motherboard to see if there will be the motherboard that is failing.
Is there any solution to hook up a capacitor on the 3.5v near the pro mini just to give it headroom if there is a power surge?
1uF 10v.....?

[rama3]

These mini Arduino boards have excellent power regulation for what little they consume. I don't think you have a power problem.
You said "some games stops loading" and you use a PAL PM-41. I don't have the region patch stuff for these consoles yet, so it will only boot PAL licensed disks.

I have no idea what's going on with your Wip3out.

[culexus]

I just tested wip3out in my pstwo with modchip and it boots fine:) so the disk is ok.
Now I will test the mod in a pu-23 pal board and see if this will boot the wipeot..

[rama3]

New version:
- final modchip function I / Os: SQCK, SCLK, data, gate_wfck
- hysteresis for injections, fixes anti-mod occasionally triggering when using worn drives
- optimized injection timing for multi-region, multi BIOS versions (Sony added more protection checks over time)
- first attempt to make it more portable to other Arduino variants
- auto console detection works reliably, with and without Arduino bootloader present
- pin assignments changed for practical / installation reasons (ICSP capability, wire routing)
- so many changes, it surely contains all new bugs

Pin assignments are finalized. We can start producing final installation images / help!
As always, I appreciate code reviews and bug fixes. I'm sorry some of it got so messy ;p

Code: Select all

// This PsNee version is meant for Arduino boards.
// 16Mhz and 8Mhz variants are supported. "Pro Micro" etc supported and recommended
// "Arduino Pro Micro" has a different pin assignment and needs porting. (ToDo)

// PAL PM-41 support isn't implemented yet. (ToDo)

// This code is multi-region, meaning it will unlock PAL, NTSC-U and NTSC-J machines.

// Use PU22_MODE for PU-22, PU-23, PM-41 mainboards.
boolean pu22mode;

#define ARDUINO_UNO_BOARD

#ifdef ARDUINO_UNO_BOARD
  // board pins
  #define sqck 6          // connect to PSX HC-05 SQCK pin
  #define subq 7          // connect to PSX HC-05 SUBQ pin
  #define data 8          // connect to point 6 in old modchip diagrams
  #define gate_wfck 9     // connect to point 5 in old modchip diagrams
  // MCU input / output
  #define SUBQPORT PIND       // Atmel MCU port for the 2 SUBQ sampling inputs
  #define SQCKBIT 6           // ATmega PD6 "SQCK" Mechacon pin 26 (PU-7 and early PU-8 Mechacons: pin 41)
  #define SUBQBIT 7           // ATmega PD7 "SUBQ" Mechacon pin 24 (PU-7 and early PU-8 Mechacons: pin 39)
  #define GATEWFCKPORT PINB   // Atmel MCU port for the gate input (used for WFCK)
  #define DATAPORT PORTB      // Atmel MCU port for the gate input (used for WFCK)
  #define GATEWFCKBIT 1       // ATmega PB1
  #define DATABIT 0           // ATmega PB0
#endif

//Timing
const int delay_between_bits = 4000;      // 250 bits/s (microseconds)
const int delay_between_injections = 90;  // 72 in oldcrow. PU-22+ work best with 80 to 100 (milliseconds)

//SCEE: 1 00110101 00, 1 00111101 00, 1 01011101 00, 1 01011101 00
//SCEA: 1 00110101 00, 1 00111101 00, 1 01011101 00, 1 01111101 00
//SCEI: 1 00110101 00, 1 00111101 00, 1 01011101 00, 1 01101101 00
const boolean SCEEData[44] = {1,0,0,1,1,0,1,0,1,0,0,1,0,0,1,1,1,1,0,1,0,0,1,0,1,0,1,1,1,0,1,0,0,1,0,1,0,1,1,1,0,1,0,0}; //SCEE
const boolean SCEAData[44] = {1,0,0,1,1,0,1,0,1,0,0,1,0,0,1,1,1,1,0,1,0,0,1,0,1,0,1,1,1,0,1,0,0,1,0,1,1,1,1,1,0,1,0,0}; //SCEA
const boolean SCEIData[44] = {1,0,0,1,1,0,1,0,1,0,0,1,0,0,1,1,1,1,0,1,0,0,1,0,1,0,1,1,1,0,1,0,0,1,0,1,1,0,1,1,0,1,0,0}; //SCEI

void inject_SCEX(char region)
{
  const boolean *SCEXData;
  switch (region){
    case 'e': SCEXData = SCEEData; break;
    case 'a': SCEXData = SCEAData; break;
    case 'i': SCEXData = SCEIData; break;
  }

  digitalWrite(LED_BUILTIN, HIGH); // Arduino UNO Pin 13 / PB5
  
  // pinMode(data, OUTPUT) is used more than it has to be but that's fine.
  for (byte bit_counter = 0; bit_counter < 44; bit_counter = bit_counter + 1)
  {
    if (*(SCEXData+bit_counter) == 0)
    {
      pinMode(data, OUTPUT);
      bitClear(GATEWFCKPORT,DATABIT); // data low
      delayMicroseconds(delay_between_bits);
    }
    else
    {
      if (pu22mode) {
        pinMode(data, OUTPUT);
        unsigned long now = micros();
        do {
          bool wfck_sample = bitRead(GATEWFCKPORT, GATEWFCKBIT);
          bitWrite(DATAPORT,DATABIT,wfck_sample); // output wfck signal on data pin
        }
        while ((micros() - now) < delay_between_bits);
      }
      else { // not PU 22 mode
        pinMode(data, INPUT);
        delayMicroseconds(delay_between_bits);
      }
    }
  }
  pinMode(data, OUTPUT);
  bitClear(GATEWFCKPORT,DATABIT); // pull data low
  digitalWrite(LED_BUILTIN, LOW);
  delay(delay_between_injections);
}

//--------------------------------------------------
//     Setup
//--------------------------------------------------
void setup()
{
  pinMode(data, INPUT); 
  pinMode(gate_wfck, INPUT); 
  pinMode(subq, INPUT); // PSX spi data in
  pinMode(sqck, INPUT); // PSX spi clock in
  
  pinMode(LED_BUILTIN, OUTPUT); // Blink on injection / debug.
  digitalWrite(LED_BUILTIN, HIGH); // mark begin of setup
  
  Serial.begin (1000000);
  Serial.print("MCU frequency: "); Serial.print(F_CPU); Serial.println(" Hz");
  Serial.println("Waiting for SQCK..");
  
  // Board detection
  while (!digitalRead(sqck));   // wait for console power on (in case Arduino is powered externally)
  while (!digitalRead(gate_wfck));   // wait for gate / WFCK signal to appear

  // GATE: __-----------------------  // this is a PU-7 .. PU-20 board!
  //
  // WFCK: __-_-_-_-_-_-_-_-_-_-_-_-  // this is a PU-22 or newer board!

  unsigned int highs, lows = 0;
  unsigned long now = millis();
  do {
    if (digitalRead(gate_wfck) == 1) highs++;
    if (digitalRead(gate_wfck) == 0) lows++;
    delayMicroseconds(200);   // good for ~5000 reads in 1s
  }
  while ((millis() - now) < 1000); // sample 1s

  Serial.print("highs: "); Serial.print(highs); Serial.print(" lows: "); Serial.println(lows);
  // typical readouts
  // PU-22: highs: 2449 lows: 2377
  if (lows > 100) {
    pu22mode = 1;
  }
  else {
    pu22mode = 0;
  }
  Serial.print("pu22mode: "); Serial.println(pu22mode);

  // Power saving
  // Disable the ADC by setting the ADEN bit (bit 7)  of the
  // ADCSRA register to zero.
  ADCSRA = ADCSRA & B01111111;
  // Disable the analog comparator by setting the ACD bit
  // (bit 7) of the ACSR register to one.
  ACSR = B10000000;
  // Disable digital input buffers on all analog input pins
  // by setting bits 0-5 of the DIDR0 register to one.
  DIDR0 = DIDR0 | B00111111;

  digitalWrite(LED_BUILTIN, LOW); // setup complete
}

void loop()
{
  static byte scbuf [12] = { 0 }; // We will be capturing PSX "SUBQ" packets, there are 12 bytes per valid read.
  static unsigned int timeout_clock_counter = 0;
  static byte bitbuf = 0;   // SUBQ bit storage
  static bool sample = 0;
  
  byte scpos = 0;           // scbuf position
  
  noInterrupts(); // start critical section
// yes, a goto jump label. This is to avoid a return out of critical code with interrupts disabled.
// It prevents bad behaviour, for example running the Arduino Serial Event routine without interrupts.
// Using a function makes shared variables messier.
// SUBQ sampling is essential for the rest of the functionality. It is okay for this to take as long as it does.
start:
  for (byte bitpos = 0; bitpos<8; bitpos++) { // Capture 8 bits for 12 runs > complete SUBQ transmission
    do {
      // nothing, reset on timeout
      timeout_clock_counter++;
      if (timeout_clock_counter > 1000){
        scpos = 0;  // reset SUBQ packet stream
        timeout_clock_counter = 0;
        bitpos = 0;
        goto start;
      }
    }
    while (bitRead(SUBQPORT, SQCKBIT) == 1); // wait for clock to go low..

    do {
      // nothing
    } while ((bitRead(SUBQPORT, SQCKBIT)) == 0); // and high again..
    
    // sample the bit now!
    sample = bitRead(SUBQPORT, SUBQBIT);
    bitbuf |= sample << bitpos;
    
    timeout_clock_counter = 0; // no problem with this bit
  }
 
  scbuf[scpos] = bitbuf;
  scpos++;
  bitbuf = 0;

  // repeat for all 12 bytes
  if (scpos < 12){
    goto start;
  }

  interrupts(); // end critical section

  // log SUBQ packets
  if (!(scbuf[0] == 0 && scbuf[1] == 0 && scbuf[2] == 0 && scbuf[3] == 0)){ // a bad sector read is all 0 except for the CRC fields. Don't log it.
    for (int i = 0; i<12;i++) {
      if (scbuf[i] < 0x10) Serial.print("0"); // padding
        Serial.print(scbuf[i], HEX);
        Serial.print(" ");
      }
      Serial.println("");
  }

  // check if read head is in wobble area
  // We only want to unlock game discs (0x41) and only if the read head is in the outer TOC area.
  // We want to see a TOC sector repeatedly before injecting (helps with timing and marginal lasers).
  static byte hysteresis  = 0;

  // All this logic is because we don't know if the HC-05 is actually processing a getSCEX() command.
  // Hysteresis is used because older drives exhibit more wiggle room. They might see a few TOC sectors when they shouldn't.
  if ( 
    (scbuf[0] == 0x41 &&  scbuf[1] == 0x00 &&  scbuf[6] == 0x00) &&   // [0] = 41 means psx game disk. the other 2 checks are garbage protection
    (scbuf[2] == 0xA0 || scbuf[2] == 0xA1 || scbuf[2] == 0xA2 ||      // if [2] = A0, A1, A2 ..
    (scbuf[2] == 0x01 && (scbuf[3] >= 0x98 || scbuf[3] <= 0x02) ) )   // .. or = 01 but then [3] is either > 98 or < 02
  ) {
    hysteresis++;
  }
  else if ( hysteresis > 0 && 
          ((scbuf[0] == 0x01 || scbuf[0] == 0x41) && (scbuf[1] == 0x00 /*|| scbuf[1] == 0x01*/) &&  scbuf[6] == 0x00)
  ) {  // This CD has the wobble into CD-DA space. (started at 0x41, then went into 0x01)
    hysteresis++;
  }
  else if (hysteresis > 0) {
    hysteresis--; // None of the above. Initial detection was noise. Decrease the counter.
  }

  // Some anti mod routines position the laser very close to the TOC area. Only inject if we're pretty certain it is required.
  // hysteresis below 10 occasionally triggers injections in Silent Hill (NTSC-J) when using a worn drive
  if (hysteresis >= 14){ 
    hysteresis = 0;
    Serial.println("INJECT!INJECT!INJECT!INJECT!INJECT!INJECT!INJECT!INJECT!INJECT!");

    pinMode(data, OUTPUT);
    digitalWrite(data, 0); // pull data low
    if (!pu22mode){
      pinMode(gate_wfck, OUTPUT);
      digitalWrite(gate_wfck, 0);
    }
    
    // HC-05 is waiting for a bit of silence (pin low) before it begins decoding.
    delay(delay_between_injections);
    for (byte loop_counter = 0; loop_counter < 2; loop_counter++)
    {
      inject_SCEX('e'); // e = SCEE, a = SCEA, i = SCEI
      inject_SCEX('a'); // injects all 3 regions by default
      inject_SCEX('i'); // makes it easier for people to get working
    }

    if (!pu22mode){
      pinMode(gate_wfck, INPUT); // high-z the line, we're done
    }
    pinMode(data, INPUT); // high-z the line, we're done
  }
// keep catching SUBQ packets forever
}

[culexus]

These mini Arduino boards have excellent power regulation for what little they consume. I don't think you have a power problem.
You said "some games stops loading" and you use a PAL PM-41. I don't have the region patch stuff for these consoles yet, so it will only boot PAL licensed disks.

I have no idea what's going on with your Wip3out.

So I found the problem my old memmory card was corrupted, after deleting everrything on it and cleaning contacts it works. Now wip3out loads fine on the psone.

I did also mod the PU-23 and it`s up and running:) did thake some pictures of the main board before and after the mod. If interrested I can make a guide for this board with your newest code that I will test later

[rama3]

Would be great, thanks!

[culexus]

Is it okey to update the code when it still is connected to the psx? I got a 5v ftdi but i can remove the 5v from the ftdi and let the psx power it with the 3.5V. What do you recommende? Or desolder the pro mini for update?