PSX Modchip FAQ

[Ne0]

i found this neat little FAQ regarding every common faqs asked about the nature of a psx modchip including the color correction chip. i wanted to add this post as future source of "reference" for those who will be interested in chipping their psx consoles. currently at this moment, "stealth 2" chips are the best ones out right now. check out the link below for more info. enjoy!

reference source: http://modchip.aeug.org/faq.html


"The Playstation 1 Mod Chip FAQ"

1. What is a "mod chip"?
2. How does a mod chip work?
3. What kinds of mod chip are there?
4. What is the differences between the number of wires?
5. What is the history behind the mod chip?
6. Why won't my early mod chip work on a SCPH-550x or later console?
7. What is an "anti-piracy mod chip"?
8. How does a anti-piracy mod chip work?
9. What is a "color correction chip"?
10. How does a color correction chip work?
11. Does the mod chip cause FMV skipping?
12. Why don't mod chips work on current japanese PS models?
13. Where can I buy these chips?
14. How do I make CD-R copies of games?
15. What's this about anti-chip protection?
16. How do the "Stealth" modchips defeat this protection?

Q1. What is a "mod chip"?
A1. The "mod chip" is a programmable microcontroller that when connected
to a Sony Playstation will allow you to play games from any region. It
has the unfortunate side-effect of allowing copied CD-R games and bootlegged
games, generally from southeast asian sources, to work as well.

Q2. How does a mod chip work?
A2. The mod chip will generally have a minimum of two i/o connections to the
playstation mainboard. These go to opposite sides of an inverter gate which
transmits subcode data information from the CD controller to the main CPU.
This data stream indicates the region of the CD in use. By driving the input
of this gate logically low, the output is floated. Then on the other side
a new data stream can be injected by the mod chip.

The data that the CPU is looking for is a serial data stream at 250bps
consisting of the characters SCEI, SCEE or SCEA depending on whether the
console is Asian, PAL or North American. By sending all three data streams
in a rotating sequence, the chip can satisfy the console that it is reading
a CD of the appropriate region.

Q3. What kinds of mod chip are there?
A3. The original mod chip was implemented on the PIC16C54, a popular
inexpensive OTP EPROM-based 8-bit microcontroller from Arizona Microchip,
later known as just Microchip. Early reverse-engineered versions of the
chip were implemented on the same hardware.

The initial "Old Crow" reverse of the chip used a Zilog Z8-series
microcontroller, which is comparable featurewise with the 16C54. A
back-port soon followed to the 16C54, as well as the EEPROM based
16C84, which is very popular outside the US, particularly in the pirate
satellite TV industry in Europe.

In early 1997, the 12C508 microcontroller became available from Microchip.
The "Old Crow" as well as at least one of the earlier reverse-engineers
ported the mod chip code to this chip independently. The 12C508 (and its
double-size memory but otherwise identical sibling the 12C509) represented
a cheaper (approximately half the cost for blanks) and simpler (did not
need a reset circuit, saving one connection, and could be run off an
internal RC oscillator, optionally saving a second) platform for the mod
chip code.

In addition, several other individuals have ported the Old Crow code to
run on other processors, most notably the Atmel and other 8051-clone
microcontrollers.

Q4. What is the differences between the number of wires?
A4. Historically there have been mod chips with 4, 5, 6 and 10 wires.

The original mod chips were 10-wire. There have been claims that four
of these wires are red herrings, but having seen source code for the original
Hong Kong 10-wire chips, these wires did actually serve a function to time
the start-up of the data sequence. All known 10-wire chips are 16C54s.
Connections: Ground, Vdd, Clock, Reset, Gate, Data, 4 timing inputs.

6-wire chips are generally 16C54 or 16C84 based. Instead of timing when
to start sending the data stream they simply just start sending it after
an initial delay from power-on or closing of the drive door.
Connections: Ground, Vdd, Clock, Reset, Gate, Data.

There are several variants on 5-wire chips. Known to exist are Atmel AVR-
series, Zilog Z8 and Microchip 12C508. All are chips that do not require
the special reset requirements of the earlier Microchip parts.
Connections: Ground, Vdd, Clock, Gate, Data.

The 4-wire chip took advantage of the Microchip 12C508/9's ability to run
from a (reasonably accurate) internal RC clock. This is the most common
chip found today. This is the minimum number of connections for a mod
chip using the method of defeating the region detection used in A2.
Connections: Ground, Vdd, Gate, Data.

The "Old Crow" did create a prototype 3-wire chip which was more a "proof-
of-concept" than anything else. It worked by omitting the gate wire and
carefully monitoring the incoming bitstream on the data connection, then
forcing individual bits in the bitstream high at appropriate times. The
timing required was rather complex and due to the nature of the bitstream,
only would function on a North American console.
Connections: Ground, Vdd, Data.

Q5. What is the history behind the mod chip?
A5. The original mod chip was created in Hong Kong in early 1996 by a western
engineer working under contract to a Hong Kong company. These chips were
sold worldwide for anywhere from US$40-80.

During 1996 there was at least one successful reverse-engineering of the chip,
done by an individual in the Netherlands. There may have possibly been others.
The effect of these chips was to drive the pricing down to the US$25 level
as the original Hong Kong sources had to compete with their western
competition.

The real breakthrough occurred in early 1997 when the "Old Crow", using an
original Hong Kong-sourced chip provided by the author, successfully reversed
the chip and made the source code publically available on a web site. Within
weeks the price of chips was down to the US$10-20 level.

Later in 1997 the availability of the lower cost 12C508 microcontroller and
a port to it by the Old Crow and the unnamed Dutch programmer (done
independently within a week or two of one another) has driven prices to
the current $5-15 range.

Q6. Why won't my early mod chip work on a SCPH-550x or later console?
A6. The early (pre-june-1997 non-4-wire) mod chips had timing loops dependent
on the clock frequency provided from the PS console being 4.0 MHz. The SCPH-
550x and later consoles had a different clock frequency on the mainboard,
rendering older chips useless in these consoles. Later releases of the
"Old Crow" code (v5.3 and higher) for microcontrollers using externally
supplied clock frequencies had support for these boards by alternately
sending the data streams at rates compatable with one clock, then the other.

Q7. What is an "anti-piracy mod chip"?
A7. Playstations equipped with anti-piracy mod chips will boot original games
from all regions but will refuse to boot CDR copies or bootlegs. They are
popular with game stores that wish to sell imported games without losing
business to piracy.

Q8. How does a anti-piracy mod chip work?
A8. Anti-piracy chips are somewhat more sophisticated than the standard mod
chip code. Instead of blocking the original data stream entirely, the anti-
piracy chip lets the first three bytes of the four byte sequence pass through
the inverter gate, then blocks the final byte while sending its own altered
one-byte code. The 3-wire proof-of-concept chip mentioned in A4 is a
variant on this idea.

Q9. What is a "color correction chip"?
A9. When playing an NTSC game on a PAL console or vice-versa, you will
generally get a picture without color. Unless you are using a TV with a
SCART connector and an appropriate cable from the PS, are able to process
the signal through a multisystem VCR or have a multisystem TV, the only
way to view these games in color is with a color correction modification.

Q10. How does a color correction chip work?
A10. Video in all PS models is provided by the Sony CXA1645 video generator
chip. This chip is capable of generating both PAL and NTSC video, however
the colorburst signal overlaid on the video is generated by a fixed-frequency
crystal oscillator on the mainboard. The color correction mod works by
hard-wiring an alternate frequency colorburst crystal to the CXA1645 chip.
Note that the color correction modification involves either cutting copper
traces on the PS mainboard or unsoldering pins from surface mounted
components. It has the potential of permanently breaking the console if
botched and should only be performed by competent installers. If you have
the capability of getting corrected color by SCART cable or multisystem TV,
you would be better served by using one of those rather than installing a
colormod.

The color correction modification is generally sold in one of two forms,
either as a seperate subcircuit from the mod chip (in which case the raw
cost for the parts can be as low as US$0.60, half the cost of the average
blank 12C508 chip) or more increasingly on a well-engineered, professionally
replicated printed circuit board fitted along with a mod chip under the
common name 'colormod/colourmod'. These boards offer an all-in-one solution
as well as some element of additional safety during install and secure mounting
away from any metal components that might short the chip out.

Q11. Does the mod chip cause FMV skipping?
A11. In a word, NO. The mod chip only affects information coming from the CD
subcode channel. This is out of band data. It does not touch the regular data
being read off of a CD. The well known PS FMV skipping is caused by bad
engineering in the CD assembly itself.

Q12. Why don't mod chips work on current japanese PS models?
A12. Since partway through the production run of the SCPH-3000 model consoles
there has been a firmware incompatability that renders them incapable of
running other region games. Copies of japanese games will boot, and strangely
enough copies of other region games with the boot sector of a japanese game
substituted will boot, isolating this problem to something related to the
boot sector.

Q13. Where can I buy these chips?
A13. Since the author is a mod chip vendor himself, this would be a serious
conflict of interest. Check appropriate Usenet groups and web pages.
Since all versions of the code currently being used give functionally
equivalent results, look for a vendor whose value-added, technical knowledge
and reliability/reputation you feel are superior. Most of this is just plain
common sense. Some things to possibly consider:

a. Installation instructions - detailed? online as well as printed?
b. Shipping method/packing - Is COD available? What shipping
methods do they use?
c. Reputation/professionalism - how long have they been around?
(check dejanews, etc.), Does their website look well-run?
d. Availability of credit card/online ordering - Do they take credit
cards? Is a secure web server or credit card escrow system
such as AT&T's SecureBuy or First Virtual in use?
e. Technical knowledge - Do they seem to know how the chip functions
or are they just taking the Old Crow code, programming it
into blanks and selling them?
f. Other Value-added - Are prewired chips available? Is installation
service available?
g. Netequette - Does the vendor spam the newgroups with dozens of
identical postings daily?

Q14. How do I make CD-R back up of my original retail copy?

note: www.fileforums.com does not condone piracy nor the discussion of it (downloading warez) on the site/forums. you will get yourself banned and have your thread permanently closed if you decide to discuss this in the forums. you have been warned!

A14. a. EDIT: cd-r back up (copy from "your original") games are created by ripping the retail copy of your game using popular ripping apps such as alcohol 52%/120%, clone-cd, or IMGburn which are sufficient tools to create a good rip from your retail game. the compatible disc image files are .iso, .bin, and .img. and these can be burned onto a cd-r disc for your console.

b. in late 1998, sony implemented a new disc protection security designed to detect psx consoles with modchips installed. the first appereance of this new disc security check began with NTSC-J psx games and later moved to NTSC-U games. the new anti-modchip security detection rendered the earlier modchips (the hong-kong & old crow chips) helpless. the stealth 2 modchip is able to bypass completely any of the anti-modchip security detections.

the screen (ghostbusters screen) appears right after psx logo or seconds shortly after the game starts loading when a psx game with the anti-modchip protection detects a modchip.




c. a new method had been developed in order to aid the older modchips to bypass the anti-modchip detection that had arrived with the newer games. this method called for the creation of a patch that basically removes the code out of the game that detects if a modchip is installed in your psx console.

basically, the patch is applied to the disc image by using a the pertaining disc patcher (XPSz or PPF-o-matic).




Q15. What's this about anti-chip protection?
A15. Starting with the release of Popolog and the demo version of IQ Final,
there has been a check for an installed modchip in some japanese games. This
is accomplished by calling the region-check routine without first seeking to
the appropriate point on the CD, thus this test will succeed if there is
a chip present, but fail if no chip is present. (The region-check routine
appears to be partially implemented in hardware and only accessable by a
firmware call)

Q16. How do the "Stealth" modchips defeat this protection?
A16. The "Stealth" chips simply stop sending data after they have performed
their function to start up the game. Exact implementation details vary from
vendor to vendor from a simple timeout to timeout with reset on various
hardware signals to complex timeouts with monitor of multiple signals.