SCPH-100x and CD player swap trick bug?

Discussion in 'Sony Programming and Development' started by Elijah, Jul 25, 2010.

  1. Elijah

    Elijah Intrepid Member

    Joined:
    Jan 4, 2010
    Messages:
    677
    Likes Received:
    3
    Hi, supposedly the very first releases of the PS1 SCPH-100x series had a bug which would allow you to play backups of games burned on to a CD-R without a modchip or cheat cartridge/disc very easily and safely, but it was removed from later batches of this very series, and all consoles after that. Is there any way to identify a console of the earliest batch which, therefore, allows you to perform the easy swap?

    Since I'm a European I'm specifically wondering how to identify for PAL machines (SCPH-1002), but of course any other information would be welcome.
     
    Last edited: Jul 25, 2010
  2. Joe Musashi

    Joe Musashi Spirited Member

    Joined:
    Jun 13, 2008
    Messages:
    120
    Likes Received:
    0
    You need to be using RGB scart to run an NTSC disc.

    Swap trick is possible on all 100x units in my experience. Do you need help with doing it?
     
    Last edited: Jul 25, 2010
  3. Elijah

    Elijah Intrepid Member

    Joined:
    Jan 4, 2010
    Messages:
    677
    Likes Received:
    3
    Yes, I have a SCART cable. I already use it to play NTSC games on my PS2, but I am going to get an SCPH-1002 PS1, and from my reasearch it appears that only the intial batch will work with the CD player bug swap trick, and the second batch of SCPH-100x and all consoles after that have it fixed, and can only use the harder and "riskier" double-swap trick.
     
  4. Joe Musashi

    Joe Musashi Spirited Member

    Joined:
    Jun 13, 2008
    Messages:
    120
    Likes Received:
    0
    Ok, I wasn't aware of this. Every SCPH-1000 I've ever owned was "enabled".

    If you can get yourself one of those springs from the cheat carts, it makes for a much neater setup than a big lump of blue-tack. :)
     
  5. Elijah

    Elijah Intrepid Member

    Joined:
    Jan 4, 2010
    Messages:
    677
    Likes Received:
    3
    Yep, I got a spring from a pen. :p

    Wow, I just bought an SCPH-1002 today, and it works perfectly with this trick! I guess I got one from an early batch, no need for gamesharks or the othe nasty swap tricks! This is definitely my most favorite PS1 model; even the construction is more solid than the later ones, and it has the nice RCA connectors on the back.
     
    Last edited: Jul 26, 2010
  6. Elijah

    Elijah Intrepid Member

    Joined:
    Jan 4, 2010
    Messages:
    677
    Likes Received:
    3
    I was just wondering though... when I just wanted to test out if the trick worked on the machine, I opened the lid and booted the machine with nothing inside it, selected the CD player, then I simply pressed the sensor down with my finger after I inserted my original game to get it spin up and be read, replaced it with the backup once the original stopped spinning, and closed the lid. How will the trick work exactly if there is a spring pressing the sensor down the whole time once I fit it?
     
    Last edited: Jul 26, 2010
  7. Joe Musashi

    Joe Musashi Spirited Member

    Joined:
    Jun 13, 2008
    Messages:
    120
    Likes Received:
    0
    You have to keep the sensor pressed down otherwise it'll re-read the new disc. It won't read a disc if there isn't one in there so it's fine to have the spring in place the whole time.
     
  8. Dr.Wily

    Dr.Wily Peppy Member

    Joined:
    Sep 25, 2006
    Messages:
    391
    Likes Received:
    11
    I confirm ! I recently bought a SCPH-1002 who don't accept swap trick.

    The question is :

    Is an updated BIOS or other protection method ?
     
  9. Elijah

    Elijah Intrepid Member

    Joined:
    Jan 4, 2010
    Messages:
    677
    Likes Received:
    3
    It turns out that my machine was modded anyway... and that the swap trick only works on the very first revision of the SCPH-1001/2 (and it should work on all SCPH-1000). The method of "patching" of this exploit on Sony's part was to use an updated BIOS as far as I can tell.
     
    Last edited: May 18, 2011
  10. Dr.Wily

    Dr.Wily Peppy Member

    Joined:
    Sep 25, 2006
    Messages:
    391
    Likes Received:
    11
    I have the very first PAL batch bought the firsts days back in 1995. Swapping on this early model works fine. Plus, I have a defect motherboard of this model, I can swap its bios with second 1002 batch to see if I can run NTSC and backup.

    I never found other dump of the 1002 bios that one provided on the web. I wonder if the second 1002 batch has ever been dumped...
     
  11. l_oliveira

    l_oliveira Officer at Arms

    Joined:
    Nov 24, 2007
    Messages:
    3,879
    Likes Received:
    245
    Actually they changed the Mechanics Controller.

    It does the check twice:

    Firstly when reading the disc TOC.

    2nd time is when the main CPU queries the CD-ROM drive hardware to fetch the 4 letters you see on the bottom of the screen:

    SCEI SCEA or SCEE.

    Because the wooble check can only be performed at 1x you see the disc slow down once or twice depending on the version of the mechacon firmware. ;)

    Also, they screwed the JPN PS bios so it requires this text string on the disc first sector:

    Licensed by Sony Computer Entertainment Inc.

    Only the 2nd version of the JPN bios (and all newer versions, including the one they put on the JPN PS2s) perform that extra check.

    Eventually they did add that check to the other two regions but then at the time they were making PSOnes... :lol:
     
    Last edited: May 19, 2011
  12. san186

    san186 Rapidly Rising Member

    Joined:
    Jan 20, 2006
    Messages:
    98
    Likes Received:
    0
    I remember reading back in the days of OPM that it had to be a PSX model with a serial number beginning with A. No idea if it was shit or not, mine began with a B or C but i used an external modchip which hated 80min cdrs :mad:
     
  13. Dr.Wily

    Dr.Wily Peppy Member

    Joined:
    Sep 25, 2006
    Messages:
    391
    Likes Received:
    11
    l_oliveira --> ok, if you'r right, the wooble check is performed by mechacon itself, not by BIOS. It's mean that scph-100x's bioses are strictly the same whatever revision of this specific batch (100x).

    If the mechacon is a standalone device, detached from bios, how is working action replay, gameshark or others stuff plugged on parallel port who "re-enable" CDA flaw on 1st models ?

    san186 -->

    scph-1000 : a5951124 -> audio swap working
    scph-1002 : c6456002 -> audio swap not working *
    scph-1002 : c5575695 -> audio swap working

    * : during swap this PSX acting oddly :

    - With a CD-R, 95% of time I have the "insert PS game" screen. Other 5%, screen stuck on memory card / music menues. CD-R run flawlessly on others PSX or with // port "modchip".

    - With an original game CD but has diferent zone (jap on pal machine) PSX hangs on memory card / music screen after swapping.
     
  14. jinn

    jinn Peppy Member

    Joined:
    Feb 8, 2011
    Messages:
    396
    Likes Received:
    4
    I think the PU-7 boards are the only ones with the MUSIC CD Trick
     
  15. Elijah

    Elijah Intrepid Member

    Joined:
    Jan 4, 2010
    Messages:
    677
    Likes Received:
    3
    PU-7 is the original SCPH-1000. So are you saying that only the SCPH-1000 could do this? I don't think that's the case since we have individuals like Dr.Willy saying that it works just fine on their consoles.
     
  16. Dr.Wily

    Dr.Wily Peppy Member

    Joined:
    Sep 25, 2006
    Messages:
    391
    Likes Received:
    11
    Definitively it's not a bug (I think).

    Here the motherboards of PSX SCPH-1002. Both is P8, but its layout is diferent, components revision too.

    SCPH-1002 bought in the first out days in 1995 (swap working) :


    other SCPH-1002 (swap not working or has strange behave) :

    I don't believe that the "Px" revision realy mean something. Here two P8 mobo, diferent layout and components.
     
    Last edited: May 20, 2011
  17. l_oliveira

    l_oliveira Officer at Arms

    Joined:
    Nov 24, 2007
    Messages:
    3,879
    Likes Received:
    245
    PU-07 only exists on Early Japanese machines (the units with S-Video port).

    The protection rely on TWO components:

    The mechanics controller (CD Drive CPU)
    The BIOS


    The mechacon does provide the protection mechanism and it rely on the BIOS behavior to do it's job. What your AR codes do is change the BIOS behavior, which cause the mechacon to not perform the second/third checks. But then, on the early motherboards at the time the disc spins up the drive is already fully unlocked.

    No matter what BIOS you put on a PU-07 mobo it will aways check the wobble only once while checking the TOC. It's possible to check for the wobble through explicit low level commands sent for the drive, and even at sectors other than the TOC area but again, on the early machines, that has no effect on the game running or not.

    The modchip detection program found on some games rely on that behavior of the mechacon chip. It moves the laser to a specific track where it has specially crafted data meant to trick the modchip into thinking that the drive is reading the TOC, making the modchip inject the licence ASCII data on the serial input.

    If no modchip is installed, there will be no letters on the serial buffer and the game execution proceeds normally. If there's a modchip, the matching licence code will be found, the code will branch to a routine which prints a message like this:

    [​IMG]

    And that's all about it.
     
    Last edited: May 20, 2011
sonicdude10
Draft saved Draft deleted
Insert every image as a...
  1.  0%

Share This Page