SCPH-100x and CD player swap trick bug?

[Elijah]

Hi, supposedly the very first releases of the PS1 SCPH-100x series had a bug which would allow you to play backups of games burned on to a CD-R without a modchip or cheat cartridge/disc very easily and safely, but it was removed from later batches of this very series, and all consoles after that. Is there any way to identify a console of the earliest batch which, therefore, allows you to perform the easy swap?

Since I'm a European I'm specifically wondering how to identify for PAL machines (SCPH-1002), but of course any other information would be welcome.

[Joe Musashi]

You need to be using RGB scart to run an NTSC disc.

Swap trick is possible on all 100x units in my experience. Do you need help with doing it?

[Elijah]

Yes, I have a SCART cable. I already use it to play NTSC games on my PS2, but I am going to get an SCPH-1002 PS1, and from my reasearch it appears that only the intial batch will work with the CD player bug swap trick, and the second batch of SCPH-100x and all consoles after that have it fixed, and can only use the harder and "riskier" double-swap trick.

[Joe Musashi]

Ok, I wasn't aware of this. Every SCPH-1000 I've ever owned was "enabled".

If you can get yourself one of those springs from the cheat carts, it makes for a much neater setup than a big lump of blue-tack. :)

[Elijah]

Yep, I got a spring from a pen. :P

Wow, I just bought an SCPH-1002 today, and it works perfectly with this trick! I guess I got one from an early batch, no need for gamesharks or the othe nasty swap tricks! This is definitely my most favorite PS1 model; even the construction is more solid than the later ones, and it has the nice RCA connectors on the back.

[Elijah]

I was just wondering though... when I just wanted to test out if the trick worked on the machine, I opened the lid and booted the machine with nothing inside it, selected the CD player, then I simply pressed the sensor down with my finger after I inserted my original game to get it spin up and be read, replaced it with the backup once the original stopped spinning, and closed the lid. How will the trick work exactly if there is a spring pressing the sensor down the whole time once I fit it?

[Joe Musashi]

You have to keep the sensor pressed down otherwise it'll re-read the new disc. It won't read a disc if there isn't one in there so it's fine to have the spring in place the whole time.

[Dr.Wily]

I confirm ! I recently bought a SCPH-1002 who don't accept swap trick.

The question is :

Is an updated BIOS or other protection method ?

[Elijah]

It turns out that my machine was modded anyway... and that the swap trick only works on the very first revision of the SCPH-1001/2 (and it should work on all SCPH-1000). The method of "patching" of this exploit on Sony's part was to use an updated BIOS as far as I can tell.

[Dr.Wily]

I have the very first PAL batch bought the firsts days back in 1995. Swapping on this early model works fine. Plus, I have a defect motherboard of this model, I can swap its bios with second 1002 batch to see if I can run NTSC and backup.

I never found other dump of the 1002 bios that one provided on the web. I wonder if the second 1002 batch has ever been dumped...

[l_oliveira]

Actually they changed the Mechanics Controller.

It does the check twice:

Firstly when reading the disc TOC.

2nd time is when the main CPU queries the CD-ROM drive hardware to fetch the 4 letters you see on the bottom of the screen:

SCEI SCEA or SCEE.

Because the wooble check can only be performed at 1x you see the disc slow down once or twice depending on the version of the mechacon firmware. ;)

Also, they screwed the JPN PS bios so it requires this text string on the disc first sector:

Licensed by Sony Computer Entertainment Inc.

Only the 2nd version of the JPN bios (and all newer versions, including the one they put on the JPN PS2s) perform that extra check.

Eventually they did add that check to the other two regions but then at the time they were making PSOnes... :lol:

[san186]

I remember reading back in the days of OPM that it had to be a PSX model with a serial number beginning with A. No idea if it was shit or not, mine began with a B or C but i used an external modchip which hated 80min cdrs :@

[Dr.Wily]

l_oliveira --> ok, if you'r right, the wooble check is performed by mechacon itself, not by BIOS. It's mean that scph-100x's bioses are strictly the same whatever revision of this specific batch (100x).

If the mechacon is a standalone device, detached from bios, how is working action replay, gameshark or others stuff plugged on parallel port who "re-enable" CDA flaw on 1st models ?

san186 -->

scph-1000 : a5951124 -> audio swap working
scph-1002 : c6456002 -> audio swap not working *
scph-1002 : c5575695 -> audio swap working

* : during swap this PSX acting oddly :

- With a CD-R, 95% of time I have the "insert PS game" screen. Other 5%, screen stuck on memory card / music menues. CD-R run flawlessly on others PSX or with // port "modchip".

- With an original game CD but has diferent zone (jap on pal machine) PSX hangs on memory card / music screen after swapping.

[jinn]

I think the PU-7 boards are the only ones with the MUSIC CD Trick

[Elijah]

PU-7 is the original SCPH-1000. So are you saying that only the SCPH-1000 could do this? I don't think that's the case since we have individuals like Dr.Willy saying that it works just fine on their consoles.

[Dr.Wily]

Definitively it's not a bug (I think).

Here the motherboards of PSX SCPH-1002. Both is P8, but its layout is diferent, components revision too.

SCPH-1002 bought in the first out days in 1995 (swap working) :

• Motherboard comp. side
• Motherboard under side
• BIOS

other SCPH-1002 (swap not working or has strange behave) :

• Motherboard comp. side
• Motherboard under side
• BIOS

I don't believe that the "Px" revision realy mean something. Here two P8 mobo, diferent layout and components.

[l_oliveira]

PU-07 only exists on Early Japanese machines (the units with S-Video port).

The protection rely on TWO components:

The mechanics controller (CD Drive CPU)
The BIOS


The mechacon does provide the protection mechanism and it rely on the BIOS behavior to do it's job. What your AR codes do is change the BIOS behavior, which cause the mechacon to not perform the second/third checks. But then, on the early motherboards at the time the disc spins up the drive is already fully unlocked.

No matter what BIOS you put on a PU-07 mobo it will aways check the wobble only once while checking the TOC. It's possible to check for the wobble through explicit low level commands sent for the drive, and even at sectors other than the TOC area but again, on the early machines, that has no effect on the game running or not.

The modchip detection program found on some games rely on that behavior of the mechacon chip. It moves the laser to a specific track where it has specially crafted data meant to trick the modchip into thinking that the drive is reading the TOC, making the modchip inject the licence ASCII data on the serial input.

If no modchip is installed, there will be no letters on the serial buffer and the game execution proceeds normally. If there's a modchip, the matching licence code will be found, the code will branch to a routine which prints a message like this:



And that's all about it.