Sony Computer Entertainment
Regional and Revisional differences in the BIOS.
The PlayStation (abbreviated PSX, PS1, PS one, or PS) is Sony's first game console, the result of a bad falling-out with Nintendo.
The PlayStation SCPH-1001 BIOS contains a heaping of what appears to be debug console output, either used during the console's development, or used for game development on the console. It appears to have been compiled to MIPS using the C language. Variables beginning with a "%" are format variables.
Realtime Kernel/Bootstrap Loader
Normally unseen when using a real PlayStation, the following text is generated for console output when using the PCSX emulator, and possibly a devkit as well. It contains information related to the PlayStation kernel and boot process as the console loads.
PS-X Realtime Kernel Ver.2.5 Copyright 1993,1994 (C) Sony Computer Entertainment Inc. PS-X ROM monitor Ver.2.3 Copyright 1993,1994 (C) Sony Computer Entertainment Inc. setup file : %s KERNEL SETUP! boot file : %s boot address : %08x %08x Execute ! BOOTSTRAP LOADER Type C Ver 2.1 03-JUL-1994 Copyright 1993,1994 (C) Sony Computer Entertainment Inc. SYSTEM.CNF;1 PSX.EXE;1 Change effective memory : %d MBytes Effective memory must be 2/8 MBytes cdrom: cdrom: EXEC:PC0(%08x) T_ADDR(%08x) T_SIZE(%08x) S_ADDR(%08x) S_SIZE(%08) End of Main EXEC:PC0(%08x) T_ADDR(%08x) T_SIZE(%08x) S_ADDR(%08x) S_SIZE(%08) End of Main
The PIO (Parallel Input/Output) feature was intended to be used for debugging, but was exploited to boot unsigned code on such devices such as the Action Replay. At offset 0xE288 is a string which all PIO equipment must return to the console in order to have code execution passed to the device. Following that appears to be a primitive shell of some sort. It is unclear whether any development kits made use of the PIO Loader or whether this was an early development leftover.
Licensed by Sony Computer Entertainment Inc. PIO SHELL for PlayStation(tm) tty CONSOLE DIP SWITCH : %02X fd=%d write=%x read=%x error(%d,%d) test 6 button PAD (QUICK TYPE) test 6 button PAD (NEW) ret:%08x stock:%08x tty(s2681) bad function %s baud rate set to %d s2681(1) s2681(0)
Control Pad Driver
At offset 0x16D34 appears to be debug output for the control pad driver. It refers to a "dual cross key" gamepad, which may be an as-yet unseen prototype controller containing two D-pads.
PS-X Control PAD Driver Ver 3.0 TYPE : Dual cross key -> not supported! TYPE : 6 free button or flying-V form TYPE : Unknown (%d) -> not supported!
Bad Hankaku/SJIS Code
Location 0x601E4 contains an error message about a "bad hankaku code". Hankaku means "half-width" in the Japanese katakana system of writing.
bad hankaku code 0x%x
Offset 0x602FC contains an additional error about a "bad sjis code". SJIS is Shift-JIS, a Japanese character encoding.
bad sjis code 0x%x
Offset 0x61160 begins a long strand of textual error messages, debug messages, and file versions. These are strings from some kind of standard library to be used for any PlayStation application.
Error: Can't push matrix,stack(max 20) is full! Error: Can't pop matrix,stack is empty! This function is not implemented sys.c,v 1.5 1995/06/02 01:51:14 shima Exp SetGraphDebug:level:%d,type:%d reverse:%d DrawPrim GPU timeout:QUE=(%2d,%2d),CODE=(%d,%d,%08X) ext.c,v 1.1 1995/02/15 04:59:46 shima Exp prim.c,v 1.1 1995/02/15 05:00:08 shima Exp tpage: (%d,%d,%d,%d) tpage: (%d,%d,%d,%d) clut: (%d,%d) clip (%3d,%3d)-(%d,%d) ofs (%3d,%3d) tw (%d,%d)-(%d,%d) dtd %d dfe %d env->tpage: (%d,%d,%d,%d) env->tpage: (%d,%d,%d,%d) disp (%3d,%3d)-(%d,%d) screen (%3d,%3d)-(%d,%d) isinter %d isrgb24 %d otag.c,v 1.1 1995/02/15 05:00:07 shima Exp OTag :prim %5d: bad prim:addr=%08X,type=%s,len=%d SPU : Timeout [%s] wait (reset) wait (dmaf clear/W [start]) wait (tsa/W-I/O) wait (wrdy H -> L) wait (dmaf clear/W) wait (ioctl/tsa-1) wait (ioctl/tsa-2) libspu: not supported ioctl (%d) vsync.c,v 1.1 1995/02/15 04:57:50 shima Exp VSync: timeout (%d:%d) pad.c,v 1.1 1995/02/15 04:57:45 shima Exp intr.c,v 1.1 1995/02/15 04:57:35 shima Exp Too many interrupts ResetCallback: _96_remove DMA Bus Error: code=%08x DMA bus error: code=%08x
At offset 0x65E48 appears to be more libraries and debug messages, this time with differing versions. These are possibly earlier versions of the libraries used in most games.
CdGetStatus() : Command is Delivered. CdGetToc() : Command is Deleiverd. GetStatus() : cmd=%02x, pre_cmd=%02x, status=%02x GetTN() : Done. GetTD() : cmd=%02x, pre_cmd=%02x, result=%02x $Id: pad.c,v 1.10 1994/07/29 10:34:09 suzu Exp $ $Id: intr.c,v 1.21 1994/07/29 10:34:06 suzu Exp $ : Copyright (C) by 1994 Sony Computer Entertainment Inc.
System Version Tag
Just a simple version tag near the end of the file, at offset 0x7FF32.
System ROM Version 2.2 12/04/95 A Copyright 1993,1994,1995 (C) Sony Computer Entertainment Inc.
The CD-ROM control chip in some PlayStation models supports a debug command to disable most of the disc authentication. However, this command would have to be sent from the PlayStation itself (or modchip), presenting a chicken-and-egg problem for those who would use it to play copied discs. Additionally, these commands don't disable all authentication, so a game would still be able to detect the use of a copy.
The protection can be disabled by sending the correct command sequence to the disc drive:
Parameter for command 0x55 depends on the console's region:
However, the command does nothing in the NTSC/JP firmware.