To do: Regional and Revisional differences in the BIOS.

The PlayStation (abbreviated PSX, PS1, PS one, or PS) is Sony's first game console, the result of a bad falling-out with Nintendo.

Hidden Text

The PlayStation SCPH-1001 BIOS contains a heaping of what appears to be debug console output, either used during the console's development, or used for game development on the console. It appears to have been compiled to MIPS using the C language. Variables beginning with a "%" are format variables.

Realtime Kernel/Bootstrap Loader

Normally unseen when using a real PlayStation, the following text is generated for console output when using the PCSX emulator, and possibly a devkit as well. It contains information related to the PlayStation kernel and boot process as the console loads.

PS-X Realtime Kernel Ver.2.5

Copyright 1993,1994 (C) Sony Computer Entertainment Inc.



PS-X ROM monitor Ver.2.3

Copyright 1993,1994 (C) Sony Computer Entertainment Inc.



setup file    : %s

KERNEL SETUP!



boot file     : %s

boot address  : %08x %08x

Execute !



BOOTSTRAP LOADER Type C Ver 2.1   03-JUL-1994

Copyright 1993,1994 (C) Sony Computer Entertainment Inc.



SYSTEM.CNF;1

PSX.EXE;1



Change effective memory : %d MBytes

Effective memory must be 2/8 MBytes



cdrom:

cdrom:

EXEC:PC0(%08x)  T_ADDR(%08x)  T_SIZE(%08x)

                S_ADDR(%08x)  S_SIZE(%08)

End of Main



EXEC:PC0(%08x)  T_ADDR(%08x)  T_SIZE(%08x)

                S_ADDR(%08x)  S_SIZE(%08)

End of Main

PIO Loader

The PIO (Parallel Input/Output) feature was intended to be used for debugging, but was exploited to boot unsigned code on such devices such as the Action Replay. At offset 0xE288 is a string which all PIO equipment must return to the console in order to have code execution passed to the device. Following that appears to be a primitive shell of some sort. It is unclear whether any development kits made use of the PIO Loader or whether this was an early development leftover.

Licensed by Sony Computer Entertainment Inc.



PIO SHELL for PlayStation(tm)

tty

CONSOLE



DIP SWITCH : %02X

fd=%d

write=%x

read=%x

error(%d,%d)

test 6 button PAD (QUICK TYPE)

test 6 button PAD (NEW)

ret:%08x     stock:%08x

tty(s2681) bad function

%s baud rate set to %d

s2681(1)

s2681(0)

Control Pad Driver

At offset 0x16D34 appears to be debug output for the control pad driver. It refers to a "dual cross key" gamepad, which may be an as-yet unseen prototype controller containing two D-pads.

PS-X Control PAD Driver  Ver 3.0

TYPE : Dual cross key  ->  not supported!

TYPE : 6 free button or flying-V form

TYPE : Unknown (%d)  ->  not supported!

Bad Hankaku/SJIS Code

Location 0x601E4 contains an error message about a "bad hankaku code". Hankaku means "half-width" in the Japanese katakana system of writing.

bad hankaku code 0x%x

Offset 0x602FC contains an additional error about a "bad sjis code". SJIS is Shift-JIS, a Japanese character encoding.

bad sjis code 0x%x

Standard Libraries

Offset 0x61160 begins a long strand of textual error messages, debug messages, and file versions. These are strings from some kind of standard library to be used for any PlayStation application.

Error: Can't push matrix,stack(max 20) is full!

Error: Can't pop matrix,stack is empty!

This function is not implemented



sys.c,v 1.5 1995/06/02 01:51:14 shima Exp

SetGraphDebug:level:%d,type:%d reverse:%d

DrawPrim

GPU timeout:QUE=(%2d,%2d),CODE=(%d,%d,%08X)



ext.c,v 1.1 1995/02/15 04:59:46 shima Exp



prim.c,v 1.1 1995/02/15 05:00:08 shima Exp

tpage: (%d,%d,%d,%d)

tpage: (%d,%d,%d,%d)

clut: (%d,%d)

clip (%3d,%3d)-(%d,%d)

ofs  (%3d,%3d)

tw   (%d,%d)-(%d,%d)

dtd   %d

dfe   %d

env->tpage: (%d,%d,%d,%d)

env->tpage: (%d,%d,%d,%d)

disp   (%3d,%3d)-(%d,%d)

screen (%3d,%3d)-(%d,%d)

isinter %d

isrgb24 %d



otag.c,v 1.1 1995/02/15 05:00:07 shima Exp

OTag :prim

%5d:

bad prim:addr=%08X,type=%s,len=%d

SPU : Timeout [%s]

wait (reset)

wait (dmaf clear/W [start])

wait (tsa/W-I/O)

wait (wrdy H -> L)

wait (dmaf clear/W)

wait (ioctl/tsa-1)

wait (ioctl/tsa-2)

libspu: not supported ioctl (%d)



vsync.c,v 1.1 1995/02/15 04:57:50 shima Exp

VSync: timeout (%d:%d)



pad.c,v 1.1 1995/02/15 04:57:45 shima Exp



intr.c,v 1.1 1995/02/15 04:57:35 shima Exp



Too many interrupts

ResetCallback: _96_remove 

DMA Bus Error: code=%08x

DMA bus error: code=%08x

At offset 0x65E48 appears to be more libraries and debug messages, this time with differing versions. These are possibly earlier versions of the libraries used in most games.

CdGetStatus() : Command is Delivered.

CdGetToc() : Command is Deleiverd.

GetStatus() : cmd=%02x, pre_cmd=%02x, status=%02x

GetTN() : Done.

GetTD() : cmd=%02x, pre_cmd=%02x, result=%02x

$Id: pad.c,v 1.10 1994/07/29 10:34:09 suzu Exp $

$Id: intr.c,v 1.21 1994/07/29 10:34:06 suzu Exp $ : 	Copyright (C) by 1994 Sony Computer Entertainment Inc.

System Version Tag

Just a simple version tag near the end of the file, at offset 0x7FF32.

System ROM Version 2.2 12/04/95 A

Copyright 1993,1994,1995 (C) Sony Computer Entertainment Inc.

CD-ROM Backdoor

The CD-ROM control chip in some PlayStation models supports a debug command to disable most of the disc authentication. However, this command would have to be sent from the PlayStation itself (or modchip), presenting a chicken-and-egg problem for those who would use it to play copied discs. Additionally, these commands don't disable all authentication, so a game would still be able to detect the use of a copy.

The protection can be disabled by sending the correct command sequence to the disc drive:

Parameter for command 0x55 depends on the console's region:

However, the command does nothing in the NTSC/JP firmware.