Developer: Sony Computer Entertainment
The PlayStation (abbreviated PSX, PS1, PS one, or PS) is Sony's first game console, the result of a bad falling-out with Nintendo.
- 1 Hidden Text
- 2 Revisional Differences
- 3 Regional Differences
- 4 CD-ROM Backdoor
- 5 Regional Lockout
The BIOS contains a heaping of what appears to be debug console output, either used during the console's development, or used for game development on the console. It appears to have been compiled to MIPS using the C language. Variables beginning with a "%" are format variables.
Unless noted otherwise, all addresses noted below are for the SCPH-1001 revision.
Hidden in the BIOS at 0x129 is a small string
CEX-1000 KT-3 by S.O
CEX-3000 KT-3 by K.S
|All other revisions|
CEX-3000/1001/1002 by K.S
Realtime Kernel/Bootstrap Loader
Normally unseen when using a real PlayStation, the following text is generated for console output when using the PCSX emulator, and possibly a devkit as well. It contains information related to the PlayStation kernel and boot process as the console loads.
PS-X Realtime Kernel Ver.2.5 Copyright 1993,1994 (C) Sony Computer Entertainment Inc. PS-X ROM monitor Ver.2.3 Copyright 1993,1994 (C) Sony Computer Entertainment Inc. setup file : %s KERNEL SETUP! boot file : %s boot address : %08x %08x Execute ! BOOTSTRAP LOADER Type C Ver 2.1 03-JUL-1994 Copyright 1993,1994 (C) Sony Computer Entertainment Inc. SYSTEM.CNF;1 PSX.EXE;1 Change effective memory : %d MBytes Effective memory must be 2/8 MBytes cdrom: cdrom: EXEC:PC0(%08x) T_ADDR(%08x) T_SIZE(%08x) S_ADDR(%08x) S_SIZE(%08) End of Main EXEC:PC0(%08x) T_ADDR(%08x) T_SIZE(%08x) S_ADDR(%08x) S_SIZE(%08) End of Main
The PIO (Parallel Input/Output) feature was intended to be used for debugging, but was exploited to boot unsigned code on such devices such as the Action Replay. At offset 0xE288 is a string which all PIO equipment must return to the console in order to have code execution passed to the device. Following that appears to be a primitive shell of some sort. It is unclear whether any development kits made use of the PIO Loader or whether this was an early development leftover.
Licensed by Sony Computer Entertainment Inc. PIO SHELL for PlayStation(tm) tty CONSOLE DIP SWITCH : %02X fd=%d write=%x read=%x error(%d,%d) test 6 button PAD (QUICK TYPE) test 6 button PAD (NEW) ret:%08x stock:%08x tty(s2681) bad function %s baud rate set to %d s2681(1) s2681(0)
Control Pad Driver
At offset 0x16D34 appears to be debug output for the control pad driver. It refers to a "dual cross key" gamepad, which may be an as-yet unseen prototype controller containing two D-pads.
PS-X Control PAD Driver Ver 3.0 TYPE : Dual cross key -> not supported! TYPE : 6 free button or flying-V form TYPE : Unknown (%d) -> not supported!
Bad Hankaku/SJIS Code
Location 0x601E4 contains an error message about a "bad hankaku code". Hankaku means "half-width" in the Japanese katakana system of writing.
bad hankaku code 0x%x
Offset 0x602FC contains an additional error about a "bad sjis code". SJIS is Shift-JIS, a Japanese character encoding.
bad sjis code 0x%x
Offset 0x61160 begins a long strand of textual error messages, debug messages, and file versions. These are strings from some kind of standard library to be used for any PlayStation application.
Error: Can't push matrix,stack(max 20) is full! Error: Can't pop matrix,stack is empty! This function is not implemented sys.c,v 1.5 1995/06/02 01:51:14 shima Exp SetGraphDebug:level:%d,type:%d reverse:%d DrawPrim GPU timeout:QUE=(%2d,%2d),CODE=(%d,%d,%08X) ext.c,v 1.1 1995/02/15 04:59:46 shima Exp prim.c,v 1.1 1995/02/15 05:00:08 shima Exp tpage: (%d,%d,%d,%d) tpage: (%d,%d,%d,%d) clut: (%d,%d) clip (%3d,%3d)-(%d,%d) ofs (%3d,%3d) tw (%d,%d)-(%d,%d) dtd %d dfe %d env->tpage: (%d,%d,%d,%d) env->tpage: (%d,%d,%d,%d) disp (%3d,%3d)-(%d,%d) screen (%3d,%3d)-(%d,%d) isinter %d isrgb24 %d otag.c,v 1.1 1995/02/15 05:00:07 shima Exp OTag :prim %5d: bad prim:addr=%08X,type=%s,len=%d SPU : Timeout [%s] wait (reset) wait (dmaf clear/W [start]) wait (tsa/W-I/O) wait (wrdy H -> L) wait (dmaf clear/W) wait (ioctl/tsa-1) wait (ioctl/tsa-2) libspu: not supported ioctl (%d) vsync.c,v 1.1 1995/02/15 04:57:50 shima Exp VSync: timeout (%d:%d) pad.c,v 1.1 1995/02/15 04:57:45 shima Exp intr.c,v 1.1 1995/02/15 04:57:35 shima Exp Too many interrupts ResetCallback: _96_remove DMA Bus Error: code=%08x DMA bus error: code=%08x
At offset 0x65E48 appears to be more libraries and debug messages, this time with differing versions. These are possibly earlier versions of the libraries used in most games.
CdGetStatus() : Command is Delivered. CdGetToc() : Command is Delivered. GetStatus() : cmd=%02x, pre_cmd=%02x, status=%02x GetTN() : Done. GetTD() : cmd=%02x, pre_cmd=%02x, result=%02x $Id: pad.c,v 1.10 1994/07/29 10:34:09 suzu Exp $ $Id: intr.c,v 1.21 1994/07/29 10:34:06 suzu Exp $ : Copyright (C) by 1994 Sony Computer Entertainment Inc.
System Version Tag
Just a simple version tag near the end of the file in most revisions at offset 0x7FF32. However, the string for SCPH-1002 is at 0x423C0 instead. Likewise, the string for SCPH-1001 is at 0x42E74.
System ROM Version 1.0 Copyright 1993,1994 (C) Sony Computer Entertainment Inc.
System ROM Version 2.1 07/17/95 J Copyright 1993,1994,1995 (C) Sony Computer Entertainment Inc.
System ROM Version 2.2 12/04/95 A Copyright 1993,1994,1995 (C) Sony Computer Entertainment Inc.
System ROM Version 3.0 09/09/96 J Copyright 1993,1994,1995,1996 (C) Sony Computer Entertainment Inc.
System ROM Version 3.0 11/18/96 A Copyright 1993-1996 (C) Sony Computer Entertainment Inc.
System ROM Version 3.0 01/06/97 E Copyright 1993-1997 (C) Sony Computer Entertainment Inc.
System ROM Version 4.1 12/16/97 E Copyright 1993-1997 (C) Sony Computer Entertainment Inc.
System ROM Version 4.3 03/11/00 J Copyright 1993-2000 (C) Sony Computer Entertainment Inc.
System ROM Version 4.5 05/25/00 A Copyright 1993-2000 (C) Sony Computer Entertainment Inc.
System ROM Version 4.4 03/24/00 E Copyright 1993-2000 (C) Sony Computer Entertainment Inc.
System ROM Version 4.5 05/25/00 E Copyright 1993-2000 (C) Sony Computer Entertainment Inc.
There may be some other differences in the BIOS and menus such as:
Logo Screen Differences
|SCPH-100x to SCPH-550x (3.0 and Earlier)||SCPH-700x to SCPH-900x (4.0 and 4.1)||SCPH-10x (PSone) (4.3 and 4.5)|
There are noticeable differences in the Sony Computer Entertainment logo screen across various revisions. In BIOS versions 4.0 and earlier, the words pop into view as soon as the logo is formed (except on the SCPH-1000 and -3000 models). On BIOS versions 4.1 and later, the words fade in as soon as the logo is formed. Also noticeable is how unevenly scaled the words are, and that the TM symbol is above the words 'Computer Entertainment' as opposed to being on the right of the two words in the later versions. Lastly, after the model SCPH-9001, the TM symbol was replaced by a ® symbol. Differences also exist in the PlayStation logo screen between the aforementioned BIOS versions. In BIOS versions 3.0 and earlier, the textures containing words are unevenly scaled as previously mentioned. On BIOS versions 4.0 and later, this issue is corrected. As previously mentioned as well, after the model SCPH-9001, the TM symbol was replaced by a ® symbol (except in Japan where it was always there from the start). Otherwise, there are no obvious differences regarding howis drawn between all PlayStation consoles worldwide.
System Menu Differences and Similarities
|SCPH-1002, DTL-H3002 and SCPH-5502||SCPH-10x|
The menu on the SCPH-10x model series uses simple icons with text above them. On the other hand, the menu on the SCPH-1002, DTL-H3002 and SCPH-5502 models has a similar background, but with different icons and no text.
The menus have briefly changed their gradient colors for button plates (such as the SCPH-5501, and SCPH-7001 firmwares). Some of the cursors have changed their colors as well.
Ditto. The screen was scaled vertically in the SCPH-7502 firmware to take advantage of the higher resolution.
CD Player and Memory Card Screens
|SCPH-9001 (4.1A) and earlier||PS one (SCPH-101) (4.5A)|
The CD Player on the PS one model has awhere the player can select from a list of presets that change the way the music sounds so as to emulate the specified environment with the PlayStation's built-in reverberation processor. Seeing as no other CD player at the time had a reverberation processor, this addition was considered to be mind-blowing.
The Memory Card menu also brings interesting changes between the different styles of the system menu. On the blue menu, the title above each memory card is generically labelled "Card", while the tiled menu tends to be more specific by labelling each title, "Memory Card Slot". The "Memory Card" header also appears to have been removed on the tiled menu.
Another detail that may have been left out is the animation of exiting the CD Player or Memory Card menu. On the blue menus, the "Exit" text fades to black when either of the four face buttons is pressed with it highlighted, while the tiled menus do something more interesting; the blue tile behind the "Exit" text acts like it is a door opening to the root menu.
Saving and loading SoundScope things
Later PlayStation consoles (SCPH-700x and above) included Sound Scope in the CD player which can be accessed by pressing "Select" while an audio CD is inserted and playing.
|Japan (SCPH-5500)||US (SCPH-1001)|
The SCPH-1000 and SCPH-5500 firmwares use a green-colored pencil as the navigation cursor, while SCPH-7000 uses a pink cursor (as well as SCPH-7001, and SCPH-7502). Their button plates have been colored differently. The "MAIN MENU" header also saw changes to its gradient and offset.
Error Message Screens
|SCPH-1000 to SCPH-5000 (NTSC-J)||SCPH-1001 to SCPH-7001 (NTSC)||SCPH-1002 to SCPH-5002 (Europe)||SCPH-10x (PSone)|
NTSC-J and NTSC consoles (from SCPH-100x to SCPH-700x) make use of a message informing the user to use a PlayStation disc, whereas PAL region consoles have a different appearance by using a diagram instead. SCPH-10x consoles retain the "Please insert PlayStation® format disc" message.
It should be noted the gradient "splash" on the bottom right (shown on the Japanese and US consoles) changes in colour depending on the model, and the trademark symbol used for the PlayStation logo is different.
The CD-ROM control chip in some PlayStation models supports a debug command to disable most of the disc authentication. However, this command would have to be sent from software running on the PlayStation itself, requiring either a parallel port cartridge, or an exploit such as tonyhax (involving specifically crafted Tony Hawk's Pro Skater 2 and Tony Hawk's Pro Skater 3 save data, among others) to be used as a solderless backup loading option. Additionally, these commands don't disable all authentication, so a game would still be able to detect the use of a copy.
The protection can be disabled by sending the correct command sequence to the disc drive:
Parameter for command 0x55 depends on the console's region:
However, the command does nothing in the NTSC/JP firmware.
As noted in the previous section, Japanese versions of the retail PlayStation boot ROM are a bit more strict than those from other regions. Notably, a Japanese boot ROM will not boot a game from a different region, even if the console's security is defeated via modchip. On a Japanese console, this will only result in the ability to play bootlegs and copies of Japanese games ("SCEI" region), but not authentic discs sold outside Japan, or even bootlegs with an overseas ("SCEA" or "SCEE") region flag. (A simple, if tedious and expensive, workaround is to create a disc image from an overseas game on a computer, patch the region to Japan using a third-party utility, and burn the modified disc image onto a CD-R; a less tedious workaround is booting from a Karat-published Pro Action Replay CDX disc, a rebadged GameShark CDX designed for Japanese consoles.)
There is one notable exception: the original v1.0 boot ROM from 1994 contains a bug which effectively disables its region blocking. When this BIOS detects a disc from outside Japan, instead of blocking the boot process, it will simply block the PlayStation logo from appearing. After the SCE logo appears, the screen will cut to black, and the game will start immediately. This boot ROM only shipped inside the very earliest SCPH-1000 consoles starting in December 1994, and by early 1995 it had already been replaced with boot ROM v1.0a, which patches the loophole.