Love Copetti. Even as someone who is not particularly knowledgeable of everything he’s talking about, I I really enjoy thumbing through his writing and diagrams. There’s just something really fun about trying to understand what is going on under the hood with these machines, especially fifth and sixth generation consoles
Did read this years ago and read it today again. Just so happy that there are people producing such quality work. Even if I personally don't know much about any of it, I still find myself being totally sucked in while reading.
I worked on the Metal Gear Solid port from PSX to PC, and Konami programmers chose a wild trick to store how the "C4" bomb was planted - either on the wall, or on the ground.
Essentially the pointer pointed to the same physical memory address, but if it was planted on the wall (or on the ground, I forgot) - then it was OR-ing it with 80000000h or was A0000000h - or maybe something else - lol was long time ago.
It was fun porting this on PC, and right now I don't even remember what I did exactly - hahaha
This is also how the memory card bootloader works.
There is a faulty array iterator in the BIOS code that can copy arbitrary data to locations higher up in the memory map than the base pointer. Normally that wouldn't let you overwrite any executable code because the base pointer is very high up (might be a stack pointer?). But because of the memory aliasing, if you set the right value the write "wraps around" and lets you clobber the BIOS.
This means you can boot a custom BIOS, effectively, by just going into the memory card screen. From there you can execute a PSX.EXE without going through the mechacon checks, bypassing copy protection
---
I wouldn't mind learning more about the MGS port. Do you remember much about it?
It uses TCL for most of the scripting, IIRC. In fact I think MGS 1-4 use the same lineage of scripting languages.
MGS2 source code was leaked recently, but my guess would be that was a complete rewrite and shared very little from the PSX codebase.
Nowadays this stuff is standardized by hardware extensions.
Arm Top Byte Ignore (TBI), Intel Linear-Address Masking (LAM) and its fixed version Linear Address Space Separation (LASS), AMD Upper Address Ignore (UAI) still unsecure from SLAM exploits. Then you have security extensions build on top of this like ARM Memory Tagging Extension (MTE).
...and resulted in some models having a backwards-compatibility mode not too dissimilar to the PC's A20 gate, although for only a short period of time.
Interesting! Trying to find that particular code in the decompiled code is proving challenging. I wonder if they haven't yet discovered and documented that yet!
What a beautifully designed website. Everything is thoughtfully set-up and well placed. A great example of a well curated digital garden. It feels well kept and very human crafted.
Executing the instruction after the jump seemed mental, but after a few days it was second nature. N64 had related issue: had to find an instruction to put between two multiplies. If the first multiple multiplied by zero or otherwise finished in two cycles, the CPU would freeze if the next instruction was also a multiply.
Another weird corner case is that COP2 (GTE) instructions actually start executing one instruction early with respect to where the program counter is. As a result when an exception happens the kernel interrupt handler checks to see if the next instruction is COP2 and has to add 4 to the program counter in order to not execute it twice.
Also COP2 instructions were not allowed in branch delay slots (presumably for similar reasons), however some games (from memory Tekken3) do actually do this. I always wondered if it was a sneaky anti-emulation thing :) (because many emulators had issues with this, or needed special handling).
The PS1 architecture is fascinating - it will also reveal why PS1 games have such a unique, recognizable style that games are trying to recreate nowadays.
The architecture which made me fall in love with RISC (or "load-store" if you prefer) and see the error of my ways with x86 (insert your derogatory term here).
21 comments
[ 4.3 ms ] story [ 41.3 ms ] threadPS1 games do not hold up so good, but PS2 games uprezzed to 1440p-4k are basically perfect imo.
I worked on the Metal Gear Solid port from PSX to PC, and Konami programmers chose a wild trick to store how the "C4" bomb was planted - either on the wall, or on the ground.
Essentially the pointer pointed to the same physical memory address, but if it was planted on the wall (or on the ground, I forgot) - then it was OR-ing it with 80000000h or was A0000000h - or maybe something else - lol was long time ago.
It was fun porting this on PC, and right now I don't even remember what I did exactly - hahaha
There is a faulty array iterator in the BIOS code that can copy arbitrary data to locations higher up in the memory map than the base pointer. Normally that wouldn't let you overwrite any executable code because the base pointer is very high up (might be a stack pointer?). But because of the memory aliasing, if you set the right value the write "wraps around" and lets you clobber the BIOS.
This means you can boot a custom BIOS, effectively, by just going into the memory card screen. From there you can execute a PSX.EXE without going through the mechacon checks, bypassing copy protection
---
I wouldn't mind learning more about the MGS port. Do you remember much about it?
It uses TCL for most of the scripting, IIRC. In fact I think MGS 1-4 use the same lineage of scripting languages.
MGS2 source code was leaked recently, but my guess would be that was a complete rewrite and shared very little from the PSX codebase.
Arm Top Byte Ignore (TBI), Intel Linear-Address Masking (LAM) and its fixed version Linear Address Space Separation (LASS), AMD Upper Address Ignore (UAI) still unsecure from SLAM exploits. Then you have security extensions build on top of this like ARM Memory Tagging Extension (MTE).
https://en.wikipedia.org/wiki/Classic_Mac_OS_memory_manageme...
...and resulted in some models having a backwards-compatibility mode not too dissimilar to the PC's A20 gate, although for only a short period of time.
https://github.com/FoxdieTeam/mgs_reversing/blob/master/sour...
Look here - https://github.com/search?q=repo%3AFoxdieTeam%2Fmgs_reversin...
Does anyone have recommendations for a PS1 web/js/wasm emulator? PCSX-Redux [0] has been great on desktop, and DuckStation [1] as well.
I found a few js/emscripten efforts, but if anyone has a rec, I'd appreciate it. Thanks!
[0] https://github.com/grumpycoders/pcsx-redux/
[1] https://duckstation.org/
Also COP2 instructions were not allowed in branch delay slots (presumably for similar reasons), however some games (from memory Tekken3) do actually do this. I always wondered if it was a sneaky anti-emulation thing :) (because many emulators had issues with this, or needed special handling).