[DOWNLOAD] TMD Collection #01

[Administrator]

A collection of .TMD's that can be used with 'BootEdit by Loser 2000' (via here).
If you want to make your own, read here: http://psxdev.net/forum/viewtopic.php?f=51&t=159

IMAGES:
(Here are a few examples)



DOWNLOAD:
http://psxdev.net/forum/download/file.php?id=95

---

[nocash]

Does that mean that it's possible to change the "PS" logo on the cdrom disc? And it's working on real hardware, and with all kernel revisions? I always thought that it'd be impossible to change the "PS" logo since the kernel (at least in PSone) does compare the whole disc logo against a copy in ROM, byte-by-byte... using this code:

Code: Select all

                 ;------------------
                 verify_ps_logo:
                  .....
8004D068 00009021 mov     r18,0    ;index
8004D06C AFB1001C mov     [sp+1Ch],r17
8004D070 3C108009 mov     r16,80090000h
8004D074 3C118007 mov     r17,80070000h
8004D078 8E100A90 mov     r16,[r16+0A90h] ;=A0010000h (cdrom data)
8004D07C 26319360 sub     r17,6CA0h       ;=80069360h (expected data)
                 @@lop:
8004D080 82220000 movbs   r2,[r17]
8004D084 82030000 movbs   r3,[r16]
8004D088 26310001 add     r17,1h
8004D08C 10620006 je      r3,r2,@@match
8004D090 26100001 add     r16,1h
8004D094 0C00C297 call    80030A5Ch  ;\post_r4
8004D098 24040007 mov     r4,7h      ;/
8004D09C 24040042 mov     r4,42h     ;8004D0A0 0C01A3F4 call    80068FD0h  ; syserror A(A1h)
8004D0A4 2405038D mov     r5,38Dh    ;/
                 @@match:
8004D0A8 26520001 add     r18,1h   ;index
8004D0AC 24013278 mov     r1,3278h ;len
8004D0B0 1641FFF3 jne     r18,r1,@@lop
8004D0B4 00000000 nop
                  .....
                 ;------------------

[Administrator]

Yes, it can be changed and it boots on real hardware. It's in the boot sectors on the CD-ROM. I've actually extracted the original "PlayStation" TMD from (this image here).

The kernel might just be checking the TMD header info is correct to make sure the libraries that render the TMD itself don't cause any lockups or crashes, because like what 'Trimesh' said in another post, there is no EDC.

[rama3]

There's a quite useful compilation disc to download (Google) called "Psx Hacker Kit Beta 8 (18 in 1)".
It is patched with a custom PS logo and works on hardware, in case you want to try

[nocash]

There's a quite useful compilation disc to download (Google) called "Psx Hacker Kit Beta 8 (18 in 1)".
It is patched with a custom PS logo and works on hardware, in case you want to try

Thanks, nice to have some disc image ready for use.

From what I can see, it's working on many consoles, but not on all consoles in all regions.
With kernel version up to v3.0 it's working in all regions (EDIT: except japan).
With kernel version v4.0 and up it's booting in US only (not japan, not europe).

Looking at kernel v4.5e, the byte-by-byte logo verification is skipped depending on the variable at [8009099Ch], that variable contains some region flag (set depending on the last byte of the kernel's version/region string). The US kernel skips the verification, but the PAL version does execute it (and hangs with system error before even displaying the custom logo). The special case would be modchips with region-patch feature, with that modchips it should boot even on PAL PSones.

The kernel might just be checking the TMD header info is correct to make sure the libraries that render the TMD itself don't cause any lockups or crashes, because like what 'Trimesh' said in another post, there is no EDC.

Yes, the three posts at http://www.psxdev.net/forum/viewtopic.p ... =80#p12537 about the logo & missing ECC/EDC brought me on that. I don't understand if/how the (missing) ECC/EDC are related to the logo.

Looking at the licence sectors in a PAL disc image... the ECC/EDC fields are containing nonzero values, that doesn't look as if they are missing, at least not on that disc (unless my disc-image recording tool should have automatically inserted the missing values). TriMesh, are you sure that the values are missing? And are they missing on all discs? Maybe they've been missing only on older discs - and it got fixed before releasing the first PAL titles? Then, that could explain why the PAL kernel insists on the correct logo, whilst US kernels are passing even with changed logos.

[TriMesh]

It seems to be down to which version of the SDK was used, and the burner that was used to create the master discs. Most of the early Japanese PSX games have zeros in that area, and these discs will boot on any console that can be coerced into booting Japanese discs. I haven't actually checked, but I suspect that even if the disc does contain valid EDC/ECC data it's not being used when reading the license data.

I would go back and check the Japanese boot ROMs again - none of them except the original V1.0 will boot discs with modified license data sectors. The V1.0 (installed in most SCPH-1000) will, but if the license data doesn't match then it suppresses the display of that black boot screen.

My guess is that this check was never put into the US and Asia models because they use the same boot ROM, but boot different territory discs (NTSC:U/C and NTSC:J), and Sony didn't want to make a special boot ROM with English text but NTSC:J disc verification.

[LameGuy64]

I think the bad EDC/ECC in the license sectors could be the result of a crude license patcher tool used to inject the license data but did not inject the correct EDC/ECC information. Reason why I think that could be the case is because BUILDCD (the tool they used to compile disc images) won't inject the license data properly so I thought they could have used a quickly put together tool to inject the license data prior burning the image onto a gold disc. That, or it could be Sony's attempt to prevent people from reading the license sectors thinking that making the EDC/ECC information invalid would prevent CD drives from reading said sectors.

[nocash]

Oops, yes, the "Psx Hacker Kit Beta 8 (18 in 1)" doesn't boot with any japanese kernels (even v1.0J won't boot (maybe it dislikes the changed logo, or the changed licence strings, or the homebrew exe or whatever)).

The Hacker Kit has the licence string (on sector 4) replaced something saying "PSX HK B7... Presented by Pavlik 2006" and has the PS logo (on sector 5..11) replaced by some nuclear sign. Normally that sectors should look like so:

Code: Select all

the Licence String in sector 4 is,
  000h 32    Line 1      ("          Licensed  by          ")
  020h 32+6  Line 2 (EU) ("Sony Computer Entertainment Euro"," pe   ") ;\either
  020h 32+1  Line 2 (JP) ("Sony Computer Entertainment Inc.",0Ah)      ; one of
  020h 32+6  Line 2 (US) ("Sony Computer Entertainment Amer","  ica ") ;/these
  041h 1983  Empty (JP)    (filled by repeating pattern 62x30h,1x0Ah, 1x30h)
  046h 1978  Empty (EU/US) (filled by 00h-bytes)
The Playstation Logo in sectors 5..11 contains data like so,
  0000h ..   41h,00h,00h,00h,00h,00h,00h,00h,01h,00h,00h,00h,1Ch,23h,00h,00h
  0010h ..   51h,01h,00h,00h,A4h,2Dh,00h,00h,99h,00h,00h,00h,1Ch,00h,00h,00h
  0020h ..   ...
  3278h 588h FF-filled (remaining bytes on sector 11)

Does somebody know how that would look like on asian discs? I guess the license string in sector 4 might be different there(?)

And the PS logo in sector 5..11, I would assume that those 3278h bytes are 1:1 same in all regions, or do some discs use different logos/colors?

For some reason, the US/ASIA kernel is intentionally skipping the code that verifies those 3278h-bytes (ie. kernel v4.5e and v4.5a differ only by the region byte ("E" or "A"), and the logo-check exists in both versions, but it is skipped when the region byte is "A"). Though that skipping doesn't make too much sense to me (the logo contains only the "PS" symbol, not the region-specific "Licensed by..." text).

[TriMesh]

The Asia model consoles work with standard NTSC:J discs, identical to the ones sold in the Japanese market. Even the discs that are marked "For Japan Only" work with no problems on the Asian console models. I have some localized discs with the text translated to Chinese, but they are just NTSC:J and say "Sony Computer Entertainment Inc" on the boot screen.

Looking at the parts list for the Asian console shows that there are no unique parts in it except for the power supply. It uses the same CD sub MCU as the Japanese model and the same boot ROM as the US one. Interestingly, it also generates video with the same 7.5IRE setup level as the US model rather than the 0IRE setup that Japanese NTSC uses. I assume this is because it was sold in Taiwan which used standard US spec NTSC TVs which might crush the black levels when fed with a 0IRE signal.

The only reason I can think of for skipping the license sector verification completely is if there were some discs released in the US market that had non-standard license data on them, and this was never noticed because the early US consoles didn't check it.

The 1.0J boot ROM can boot non-Japanese discs. This is clearly a bug, since what happens is that the code checks for the Japanese license data and if it doesn't match then it won't display the black license screen - but it boots the disc anyway.