At this point, it just waits for the door switch and then the whole cycle repeats. Then wait for the speed line to go back to X1 again (second protection check - this is also why it screws up on the very early boot ROM, since that doesn't have this check). You can't just gate the data using the speed line because the anti-modchip test is carried out using CD-Audio play mode, and that's X1 too.Īfter reset or door close, delay for a bit (two different delays for reset or door close) then start looking for the speed to switch to X1 (first protection check) - after this is detected, wait for the speed to switch back to X2 and start another timer.
It's not as simple as just switching the data on and off - there are a series of delays for each part of the boot, and the speed line is basically used just as a hint to know exactly where the boot is right now.
On PU-7 / PU-8 / PU-18 / PU-20, the code attempts to work out where in the boot sequence the console is by monitoring the X1/X2 speed control line. Mayumi (and MM3, since it appears to have been largely copied from Mayumi) there are two different operating modes depending on which sort of board the chip is installed in.
An EXE file would be much nicer for CRC32 viewing since it could be booted from expansion port (if present).Īsking because rama just told me that nobody knows how "MultiMode3 and Mayumi4" modchips are working - as far as I understood they can defeat a special protection in Dino Crisis - and knowing where the pins are connected to would certainly help to understand how it works. they are working only if you have a CDR and a modchip installed on all boards that you want to check. The CRC32 tools from Shendo and Redump are CUE/BIN only, ie. at double speed, the game can't really detect if there's a 500 baud SCEX string coming from the disc (instead, it can only detect if a modchip outputs a 250 baud SCEX signal despite of running in double speed mode). drive SPEED, the TOC/SCEX is read at single-speed, and other sectors are (normally) read at double speed, so that should actually work for sensing when to output the SCEX signal, but only if the games are really using double speed (which might apply for most or all games, but it would be very easy to produce a game that defeats that kind of modchips by using single speed for SCEX reading).Īh, and, at double speed, the SCEX signal would be 500 baud instead of 250 baud, and the cdrom firmware won't recognize 500 baud signals at all. I've seen a modchip connecting to D2 and A18, maybe this is chip doing that the same way, too (though it should work only for US-vs-PAL, and shouldn't won't work for Japanese boards). The other two pins might connect to the BIOS ROM for patching the region byte. the SPI-bus input, that would make more sense (to watch the SUBQ signal for knowing the position & when to output SCEx on which sectors). the SPI-bus output, which should be unused in pre-SCPH-9000 consoles. the SCEx signal transferred at 250 baud, connecting there makes sense for modchips. Now that you have that "rare" board around, do you have some tools for dumping it's BIOS or displaying its CRC32 on TV, for adding it in the viewtopic.php?f=70&t=1065 thread? Thanks for the pin-outs & confirming that it's a SCPH-3000 board! I've added a note in the viewtopic.php?f=70&t=557&p=4284#p4284 thread, saying that the 424660 cdrom/firmware is also used on that board. In my opinion we have to change the peoples mind first, so we don't confuse them with more advanced diagrams that nobody can apply. It might also to consider that most people just don't have the time to read a couple of ps1_specs pages(thanks for that btw) think about what they read there and apply their new knowledge afterwards.Sad but true. Normal People just don't care what signal comes to what pin/point, they don't care how this chip actually works. I understand your point and its a pretty good one.
Well this one is made for a public release in mind therefore I didn't make it to "complicated". But if you don't have that kind of commerical interests, and if you know that one of the pins is a Reset signal, why can't you annotate that as "Pin Y = Reset"? Nocash wrote:No! I hate modchip diagrams! Can somebody explain why those modchip diagrams always consist of nothing but numbers and arrows? I understand that commercial modchip manufacturers don't want other people to figure out how modchips are working.