The game on its own is rather interesting for its capabilities for the period, but even more interesting is the copy-protection bypass feature included as a cheat code that made it into the commercial copy of the game...
> copy-protection bypass feature included as a cheat code that made it into the commercial copy of the game..
Was that intentional feature from the devs or did the devs forgot to remove a development/debug feature from the final production build of the game by accident?
The video references the fact that the game was originally intended to be a multi disc release and this was a tech demo / test of the disc swap feature.
The code to do the disc swap was intentionally obfuscated. If it was really meant for a tech demo, why keep it in the retail build? If it was accidentally left in, why hide it? I feel like the most obvious answer is that a developer wanted a personal backdoor for playing pirated games. Another possible answer is that having the backdoor would allow the developer to get around paying for debug consoles ($5k at the time) that can play test builds off CD-Rs. You could buy like 16 retail consoles for the price of a single debug unit.
> I feel like the most obvious answer is that a developer wanted a personal backdoor for playing pirated games.
My bet would be that it was left in to be more of a “private party trick” than a real means of piracy.
Alien Resurrection came pretty late in the PS1 life cycle, by which time it was much cheaper to get a mod chip fitted to the console then it would be to purchase the game at retail (Even the stealth chips with much better mimicked the correct expected behavior which bypassed in game copy protection checks), and would boot the pirated game much quicker then using this method.
But I guess it could have been a "Well if everything else fails, I'll still have this one weird trick up my sleeve", a method of last resort if Sony managed to pull a rabbit out of their hat in the later revisions of the console, but one that was never needed.
That's what was reportedly said by the developer in the video. I mean, if you did want to sneak in your own piracy backdoor I doubt you would publicly confess to it after any amount of time.
That being said - going through an entire Sony Playstation certification, mastering and physical product distribution cycle in the year 2000 is a pretty intense (expensive, slow + outrageous consequences for everyone involved) way of getting around copy protection.
As with seemingly everything PS1 related there is a healthy dose of misleading information here. What the game implements is known as an assisted swap trick and is nothing new, neither now nor at the time. In particular, after entering the cheat code, the game will:
- stop the CD-ROM drive's spindle motor, so that the disc can be safely removed while manually holding the lid sensor down to trick the drive into thinking a licensed PS1 disc is still present;
- wait for user input, as the lid sensor obviously cannot be used to determine when the new disc is ready;
- turn the spindle motor back on and force the game's ISO9660 driver to rescan the contents of the disc;
- parse SYSTEM.CNF, a text file containing the path to the main executable, then hand that path over to the kernel and let it load the game.
The fact that the PS1's optical drive only validated a disc's license when it was first inserted, and didn't invalidate it until the lid switch was released, was a pretty well known one even back then. Swapping out a legitimate game for a burned one as it spun up during startup was a rite of passage for many PS1 owners, and plenty of third-party cartridges that would plug into the back of the console (before Sony eventually removed the port for that) offered assisted swap trick functionality as well. Some games with anti-piracy checks did actually force the drive to authenticate the disc multiple times in order to detect and block disc swapping.
The video is partially misleading as it compares this feature to the likes of modern PS1 modding solutions such as Unirom or tonyhax, which do not require fiddling with the lid sensor as they instead activate an undocumented backdoor in the drive's firmware [1]. The backdoor was first discovered in 2013 and no code to enable it is known to be present in this game or in any officially pressed disc.
For the reverse engineers out there, the function responsible for this feature is at 0x8003ec84 in ALIEN.BIN (which is a regular PS1 executable). Interestingly, the string "SYSTEM.CNF" is shuffled and XOR-obfuscated, possibly to reduce the chance of Sony and/or the general public finding out about the functionality.
feel like you're missing the point of the video. no one is saying its new. It's that it made it into a commercial game that passed through Sony TRC and was kept a secret for 23 years until the developer reached out to me
I apologize for sounding offensive or otherwise dismissive of the discovery. I'm just clarifying what this actually is, as I have already seen discussions on Discord about this being a "game changing" exploit that will make copies of Alien Resurrection impossible to obtain for reasonable prices, or that it would have killed the console if it was discovered back in the day. While it is remarkable that this feature managed to make it past Sony's review process (and that it had obfuscation measures intentionally put in place), functionally it isn't any different from what unlicensed third party products such as the PS-X-Change or Import Player already did, and it's not like you strictly needed any of those to perform the disc swap trick anyway. A mention of those in the video, as well as a few more details on what the cheat code actually does behind the scenes, would have helped clear things up.
It's worth pointing out that there have been other instances of developers sneaking "forbidden" functionality past QA as well. For instance, an indie game developer famously tried to sneak a Perl (IIRC) interpreter into a Switch game and only got it taken down by Nintendo after publicly disclosing it.
Your clarification was provided based on baggage from discord that isn't talked about on the video at all.
The video never said that it would "make copies of the game impossible to obtain for reasonable prices" or that it would have killed the console.
You also said:
> healthy dose of misleading information here (emphasis mine).
Charitably, "here" could be read as either the video or the HN thread, but since neither contain those points, I agree that your comment came off as dismissive since it reads as strawmanning both the video and the contents of this thread based on stuff that's happened on discord in order to swoop in with a correction that wasn't needed.
Otherwise, your post contained useful additional information.
Based on my own interests, the interesting thing in the video is indeed the points that the poster raised, namely how procedure used for multi-disc games got past Sony QA despite being a single disc game, which could have been flagged through scanning of the APIs called. (Presuming there weren't other genuine uses for the same API call outside of multi-disc games, which I'd be happy to learn about).
On the video he mentions the youtube channel of the guy who told him about this cheat code.
That code has been running a youtube channel for 4 years and had at that time 529 subscribers. 2 hours after the shout out from a channel with 777k subscribers, he has 1000 subscribers.
17 comments
[ 1.9 ms ] story [ 50.3 ms ] threadWas that intentional feature from the devs or did the devs forgot to remove a development/debug feature from the final production build of the game by accident?
My bet would be that it was left in to be more of a “private party trick” than a real means of piracy.
Alien Resurrection came pretty late in the PS1 life cycle, by which time it was much cheaper to get a mod chip fitted to the console then it would be to purchase the game at retail (Even the stealth chips with much better mimicked the correct expected behavior which bypassed in game copy protection checks), and would boot the pirated game much quicker then using this method.
But I guess it could have been a "Well if everything else fails, I'll still have this one weird trick up my sleeve", a method of last resort if Sony managed to pull a rabbit out of their hat in the later revisions of the console, but one that was never needed.
That being said - going through an entire Sony Playstation certification, mastering and physical product distribution cycle in the year 2000 is a pretty intense (expensive, slow + outrageous consequences for everyone involved) way of getting around copy protection.
- stop the CD-ROM drive's spindle motor, so that the disc can be safely removed while manually holding the lid sensor down to trick the drive into thinking a licensed PS1 disc is still present;
- wait for user input, as the lid sensor obviously cannot be used to determine when the new disc is ready;
- turn the spindle motor back on and force the game's ISO9660 driver to rescan the contents of the disc;
- parse SYSTEM.CNF, a text file containing the path to the main executable, then hand that path over to the kernel and let it load the game.
The fact that the PS1's optical drive only validated a disc's license when it was first inserted, and didn't invalidate it until the lid switch was released, was a pretty well known one even back then. Swapping out a legitimate game for a burned one as it spun up during startup was a rite of passage for many PS1 owners, and plenty of third-party cartridges that would plug into the back of the console (before Sony eventually removed the port for that) offered assisted swap trick functionality as well. Some games with anti-piracy checks did actually force the drive to authenticate the disc multiple times in order to detect and block disc swapping.
The video is partially misleading as it compares this feature to the likes of modern PS1 modding solutions such as Unirom or tonyhax, which do not require fiddling with the lid sensor as they instead activate an undocumented backdoor in the drive's firmware [1]. The backdoor was first discovered in 2013 and no code to enable it is known to be present in this game or in any officially pressed disc.
For the reverse engineers out there, the function responsible for this feature is at 0x8003ec84 in ALIEN.BIN (which is a regular PS1 executable). Interestingly, the string "SYSTEM.CNF" is shuffled and XOR-obfuscated, possibly to reduce the chance of Sony and/or the general public finding out about the functionality.
[1] https://psx-spx.consoledev.net/cdromdrive/#cdrom-secret-unlo...
feel like you're missing the point of the video. no one is saying its new. It's that it made it into a commercial game that passed through Sony TRC and was kept a secret for 23 years until the developer reached out to me
It's worth pointing out that there have been other instances of developers sneaking "forbidden" functionality past QA as well. For instance, an indie game developer famously tried to sneak a Perl (IIRC) interpreter into a Switch game and only got it taken down by Nintendo after publicly disclosing it.
The video never said that it would "make copies of the game impossible to obtain for reasonable prices" or that it would have killed the console.
You also said: > healthy dose of misleading information here (emphasis mine).
Charitably, "here" could be read as either the video or the HN thread, but since neither contain those points, I agree that your comment came off as dismissive since it reads as strawmanning both the video and the contents of this thread based on stuff that's happened on discord in order to swoop in with a correction that wasn't needed.
Otherwise, your post contained useful additional information.
Based on my own interests, the interesting thing in the video is indeed the points that the poster raised, namely how procedure used for multi-disc games got past Sony QA despite being a single disc game, which could have been flagged through scanning of the APIs called. (Presuming there weren't other genuine uses for the same API call outside of multi-disc games, which I'd be happy to learn about).
That code has been running a youtube channel for 4 years and had at that time 529 subscribers. 2 hours after the shout out from a channel with 777k subscribers, he has 1000 subscribers.