PlayStation

PlayStation
Developer: Sony Computer Entertainment Publisher: Sony Computer Entertainment Released in JP: December 3, 1994 Released in US: September 9, 1995 Released in EU: September 29, 1995 Released in AU: November 15, 1995 Released in AS: 1995 This console has hidden development-related text. This console has debugging material. This console has regional differences. This console has revisional differences.

The PlayStation (abbreviated PSX, PS1, PS one, or PS) is Sony's first game console, and the result of a bad falling out with Nintendo who partnered up with Philips instead to release some (rather poor) Nintendo games on their CD-i game console. Despite that, its $299 launch price and extensive game library led it to become the most popular game console of its generation; in addition, it introduced the Dual Analog controller to audiences as one of the first controllers with two analog sticks, which was eventually replaced by the more popular and ubiquitous DualShock.

Further proving the success of the console, the PS one, a smaller revision, was released in 2000 and sold more units than the PlayStation 2 during the rest of the year.

Hidden Text

The BIOS contains a heaping of what appears to be debug console output, either used during the console's development, or used for game development on the console. It appears to have been compiled to MIPS using the C language. Variables beginning with a "%" are format variables.

Unless noted otherwise, all addresses noted below are for the SCPH-1001 revision.

Developer Credits

Hidden in the BIOS at 0x129 is a small string

Version(s)	String
SCPH-1000 SCPH-1002	CEX-1000 KT-3 by S.O
SCPH-3500	CEX-3000 KT-3 by K.S
All other revisions	CEX-3000/1001/1002 by K.S

Realtime Kernel/Bootstrap Loader

Normally unseen when using a real PlayStation, the following text is generated for console output when using the PCSX emulator, and possibly a devkit as well. It contains information related to the PlayStation kernel and boot process as the console loads.

PS-X Realtime Kernel Ver.2.5
Copyright 1993,1994 (C) Sony Computer Entertainment Inc.

PS-X ROM monitor Ver.2.3
Copyright 1993,1994 (C) Sony Computer Entertainment Inc.

setup file    : %s
KERNEL SETUP!

boot file     : %s
boot address  : %08x %08x
Execute !

BOOTSTRAP LOADER Type C Ver 2.1   03-JUL-1994
Copyright 1993,1994 (C) Sony Computer Entertainment Inc.

SYSTEM.CNF;1
PSX.EXE;1

Change effective memory : %d MBytes
Effective memory must be 2/8 MBytes

cdrom:
cdrom:
EXEC:PC0(%08x)  T_ADDR(%08x)  T_SIZE(%08x)
                S_ADDR(%08x)  S_SIZE(%08)
End of Main

EXEC:PC0(%08x)  T_ADDR(%08x)  T_SIZE(%08x)
                S_ADDR(%08x)  S_SIZE(%08)
End of Main

PIO Loader

The PIO (Parallel Input/Output) feature was intended to be used for debugging, but was exploited to boot unsigned code on such devices such as the Action Replay. At offset 0xE288 is a string which all PIO equipment must return to the console in order to have code execution passed to the device. Following that appears to be a primitive shell of some sort. It is unclear whether any development kits made use of the PIO Loader or whether this was an early development leftover.

Licensed by Sony Computer Entertainment Inc.

PIO SHELL for PlayStation(tm)
tty
CONSOLE

DIP SWITCH : %02X
fd=%d
write=%x
read=%x
error(%d,%d)
test 6 button PAD (QUICK TYPE)
test 6 button PAD (NEW)
ret:%08x     stock:%08x
tty(s2681) bad function
%s baud rate set to %d
s2681(1)
s2681(0)

Control Pad Driver

At offset 0x16D34 appears to be debug output for the control pad driver. It refers to a "dual cross key" gamepad, which may be an as-yet unseen prototype controller containing two D-pads.

PS-X Control PAD Driver  Ver 3.0
TYPE : Dual cross key  ->  not supported!
TYPE : 6 free button or flying-V form
TYPE : Unknown (%d)  ->  not supported!

Bad Hankaku/SJIS Code

Location 0x601E4 contains an error message about a "bad hankaku code". Hankaku means "half-width" in the Japanese katakana system of writing.

bad hankaku code 0x%x

Offset 0x602FC contains an additional error about a "bad sjis code". SJIS is Shift-JIS, a Japanese character encoding.

bad sjis code 0x%x

Standard Libraries

Offset 0x61160 begins a long strand of textual error messages, debug messages, and file versions. These are strings from some kind of standard library to be used for any PlayStation application.

Error: Can't push matrix,stack(max 20) is full!
Error: Can't pop matrix,stack is empty!
This function is not implemented

sys.c,v 1.5 1995/06/02 01:51:14 shima Exp
SetGraphDebug:level:%d,type:%d reverse:%d
DrawPrim
GPU timeout:QUE=(%2d,%2d),CODE=(%d,%d,%08X)

ext.c,v 1.1 1995/02/15 04:59:46 shima Exp

prim.c,v 1.1 1995/02/15 05:00:08 shima Exp
tpage: (%d,%d,%d,%d)
tpage: (%d,%d,%d,%d)
clut: (%d,%d)
clip (%3d,%3d)-(%d,%d)
ofs  (%3d,%3d)
tw   (%d,%d)-(%d,%d)
dtd   %d
dfe   %d
env->tpage: (%d,%d,%d,%d)
env->tpage: (%d,%d,%d,%d)
disp   (%3d,%3d)-(%d,%d)
screen (%3d,%3d)-(%d,%d)
isinter %d
isrgb24 %d

otag.c,v 1.1 1995/02/15 05:00:07 shima Exp
OTag :prim
%5d:
bad prim:addr=%08X,type=%s,len=%d
SPU : Timeout [%s]
wait (reset)
wait (dmaf clear/W [start])
wait (tsa/W-I/O)
wait (wrdy H -> L)
wait (dmaf clear/W)
wait (ioctl/tsa-1)
wait (ioctl/tsa-2)
libspu: not supported ioctl (%d)

vsync.c,v 1.1 1995/02/15 04:57:50 shima Exp
VSync: timeout (%d:%d)

pad.c,v 1.1 1995/02/15 04:57:45 shima Exp

intr.c,v 1.1 1995/02/15 04:57:35 shima Exp

Too many interrupts
ResetCallback: _96_remove 
DMA Bus Error: code=%08x
DMA bus error: code=%08x

At offset 0x65E48 appears to be more libraries and debug messages, this time with differing versions. These are possibly earlier versions of the libraries used in most games.

CdGetStatus() : Command is Delivered.
CdGetToc() : Command is Delivered.
GetStatus() : cmd=%02x, pre_cmd=%02x, status=%02x
GetTN() : Done.
GetTD() : cmd=%02x, pre_cmd=%02x, result=%02x
$Id: pad.c,v 1.10 1994/07/29 10:34:09 suzu Exp $
$Id: intr.c,v 1.21 1994/07/29 10:34:06 suzu Exp $ : 	Copyright (C) by 1994 Sony Computer Entertainment Inc.

System Version Tag

Just a simple version tag near the end of the file in most revisions at offset 0x7FF32. However, the string for SCPH-1002 is at 0x423C0 instead. Likewise, the string for SCPH-1001 is at 0x42E74.

Version	String
SCPH-1001 SCPH-1002	System ROM Version 1.0 Copyright 1993,1994 (C) Sony Computer Entertainment Inc.
SCPH-3500	System ROM Version 2.1 07/17/95 J Copyright 1993,1994,1995 (C) Sony Computer Entertainment Inc.
SCPH-1001	System ROM Version 2.2 12/04/95 A Copyright 1993,1994,1995 (C) Sony Computer Entertainment Inc.
SCPH-5501 SCPH-7003	System ROM Version 3.0 09/09/96 J Copyright 1993,1994,1995,1996 (C) Sony Computer Entertainment Inc.
SCPH-5501 SCPH-7003	System ROM Version 3.0 11/18/96 A Copyright 1993-1996 (C) Sony Computer Entertainment Inc.
SCPH-5502 SCPH-5552	System ROM Version 3.0 01/06/97 E Copyright 1993-1997 (C) Sony Computer Entertainment Inc.
SCPH-7502 SCPH-9002	System ROM Version 4.1 12/16/97 E Copyright 1993-1997 (C) Sony Computer Entertainment Inc.
SCPH-100	System ROM Version 4.3 03/11/00 J Copyright 1993-2000 (C) Sony Computer Entertainment Inc.
SCPH-101	System ROM Version 4.5 05/25/00 A Copyright 1993-2000 (C) Sony Computer Entertainment Inc.
SCPH-102A	System ROM Version 4.4 03/24/00 E Copyright 1993-2000 (C) Sony Computer Entertainment Inc.
SCPH-102B	System ROM Version 4.5 05/25/00 E Copyright 1993-2000 (C) Sony Computer Entertainment Inc.

Revisional Differences

To do: There may be some other differences in the BIOS and menus such as: Memory Card screens Mouse support on later consoles This Wikipedia article has some info about different BIOS versions

Logo Screen Differences

SCPH-100x to SCPH-550x (3.0 and Earlier)	SCPH-700x to SCPH-900x (4.0 and 4.1)	SCPH-10x (PSone) (4.3 and 4.5)

There are noticeable differences in the Sony Computer Entertainment logo screen across various revisions. In BIOS versions 4.0 and earlier, the words pop into view as soon as the logo is formed (except on the SCPH-1000 and -3000 models). On BIOS versions 4.1 and later, the words fade in as soon as the logo is formed. Also noticeable is how unevenly scaled the words are, and that the TM symbol is above the words 'Computer Entertainment' as opposed to being on the right of the two words in the later versions. Lastly, after the model SCPH-9001, the TM symbol was replaced by a ® symbol. Differences also exist in the PlayStation logo screen between the aforementioned BIOS versions. In BIOS versions 3.0 and earlier, the textures containing words are unevenly scaled as previously mentioned. On BIOS versions 4.0 and later, this issue is corrected. As previously mentioned as well, after the model SCPH-9001, the TM symbol was replaced by a ® symbol (except in Japan where it was always there from the start). Otherwise, there are no obvious differences regarding how the PlayStation logo itself is drawn between all PlayStation consoles worldwide.

System Menu Differences and Similarities

SCPH-1002, DTL-H3002 and SCPH-5502	SCPH-10x

The menu on the SCPH-10x model series uses simple icons with text above them. On the other hand, the menu on the SCPH-1002, DTL-H3002 and SCPH-5502 models has a similar background, but with different icons and no text.

SCPH-1001	SCPH-7001

The menus have briefly changed their gradient colors for button plates (such as the SCPH-5501, and SCPH-7001 firmwares). Some of the cursors have changed their colors as well.

SCPH-7001	SCPH-7502

Ditto. The screen was scaled vertically in the SCPH-7502 firmware to take advantage of the higher resolution.

CD Player and Memory Card Screens

SCPH-9001 (4.1A) and earlier	PS one (SCPH-101) (4.5A)

The CD Player on the PS one model has a new addition where the player can select from a list of presets that change the way the music sounds so as to emulate the specified environment with the PlayStation's built-in reverberation processor. Seeing as no other CD player at the time had a reverberation processor, this addition was considered to be mind-blowing.

The Memory Card menu also brings interesting changes between the different styles of the system menu. On the blue menu, the title above each memory card is generically labelled "Card", while the tiled menu tends to be more specific by labelling each title, "Memory Card Slot". The "Memory Card" header also appears to have been removed on the tiled menu.

Another detail that may have been left out is the animation of exiting the CD Player or Memory Card menu. On the blue menus, the "Exit" text fades to black when either of the four face buttons is pressed with it highlighted, while the tiled menus do something more interesting; the blue tile behind the "Exit" text acts like it is a door opening to the root menu.

SoundScope

To do: Saving and loading SoundScope things

Later PlayStation consoles (SCPH-700x and above) included Sound Scope in the CD player which can be accessed by pressing "Select" while an audio CD is inserted and playing.

Regional Differences

Main Menu

Japan (SCPH-5500)	US (SCPH-1001)

The SCPH-1000 and SCPH-5500 firmwares use a green-colored pencil as the navigation cursor, while SCPH-7000 uses a pink cursor (as well as SCPH-7001, and SCPH-7502). Their button plates have been colored differently. The "MAIN MENU" header also saw changes to its gradient and offset.

Error Message Screens

SCPH-1000 to SCPH-5000 (NTSC-J)	SCPH-1001 to SCPH-7001 (NTSC)	SCPH-1002 to SCPH-5002 (Europe)	SCPH-10x (PSone)

NTSC-J and NTSC consoles (from SCPH-100x to SCPH-700x) make use of a message informing the user to use a PlayStation disc, whereas PAL region consoles have a different appearance by using a diagram instead. SCPH-10x consoles retain the "Please insert PlayStation® format disc" message.

It should be noted the gradient "splash" on the bottom right (shown on the Japanese and US consoles) changes in colour depending on the model, and the trademark symbol used for the PlayStation logo is different.

CD-ROM Backdoor

The CD-ROM control chip in some PlayStation models supports a debug command to disable most of the disc authentication. However, this command would have to be sent from software running on the PlayStation itself. Because no game (other than Alien Resurrection) provides such behavior, this generally requires either a parallel port cartridge, or an exploit such as tonyhax (involving specifically crafted Tony Hawk's Pro Skater 2 and Tony Hawk's Pro Skater 3 save data, among others) to be used as a solderless backup loading option. Additionally, these commands don't disable all authentication, so a game would still be able to detect the use of a copy.

The protection can be disabled by sending the correct command sequence to the disc drive:

Command	Parameter String
0x50	none
0x51	Licensed by
0x52	Sony
0x53	Computer
0x54	Entertainment
0x55	see below
0x56	none

Parameter for command 0x55 depends on the console's region:

Region	Parameter
NTSC/US	of America/America
PAL/Europe	(Europe)/Europe
NTSC/JP	Inc.

However, the command does nothing in the NTSC/JP firmware.

(Source: Nocash)

Regional Lockout

As noted in the previous section, Japanese versions of the retail PlayStation boot ROM are a bit more strict than those from other regions. Notably, a Japanese boot ROM will not boot a game from a different region, even if the console's security is defeated via modchip. On a Japanese console, this will only result in the ability to play bootlegs and copies of Japanese games ("SCEI" region), but not authentic discs sold outside Japan, or even bootlegs with an overseas ("SCEA" or "SCEE") region flag. (A simple, if tedious and expensive, workaround is to create a disc image from an overseas game on a computer, patch the region to Japan using a third-party utility, and burn the modified disc image onto a CD-R; a less tedious workaround is booting from a Karat-published Pro Action Replay CDX disc, a rebadged GameShark CDX designed for Japanese consoles.)

There is one notable exception: the original v1.0 boot ROM from 1994 contains a bug which effectively disables its region blocking. When this BIOS detects a disc from outside Japan, instead of blocking the boot process, it will simply block the PlayStation logo from appearing. After the SCE logo appears, the screen will cut to black, and the game will start immediately. This boot ROM only shipped inside the very earliest SCPH-1000 consoles starting in December 1994, and by early 1995 it had already been replaced with boot ROM v1.0a, which patches the loophole.