PS2 Emulation

From PS3 Developer wiki
Revision as of 20:54, 30 September 2021 by Sandungas (talk | contribs) (All GXemu and SOFTemu configs moved to PS2 Official Configs)
Jump to navigation Jump to search

Description

Simplified block diagram of a PS2
source

Emulation of Playstation 2 is currently handled by 3 kind of emulators. CECH-A/B models use ps2_emu.self able to use built-in PS2 hardware (EE/GS/Rambus memory), and have best compatibility. CECH-C/E use ps2_gxemu, this emulator use physical Graphic Synthesizer found in this ps3 model, but Emotion Engine is fully emulated here, also there is no Rambus memory. All other models emulate PS2 thru fully software based ps2_netemu used for ps2 classics, and hacked now to use decrypted ISO files. Earlier before Sony provided ps2 classics on PS Store there was another soft only emulator strongly based on ps2_gxemu. It was called ps2_softemu, and had support for original PS2 CDVD. Only emulator not able to run physical discs is ps2_netemu.

Emulators are self files, but not typical one. Emulators are not truly PS3 Game OS elf executables, but Guest OS'es running on LV1 of PS3. This mean that LV2, or more friendly Game OS is unloaded before emulator is loaded. This also mean that while emulators are running we can't call any LV2 function. Also LV1 syscalls are limited to call from all emulators, but can be fully unlocked.

All emulators use built-in stripped developement version of PS2 BIOS with disabled debug functions that can affect some games. This is done because some games print debug info on screen when found that are run on dev bios. Bios between ps2_emu, and ps2_gxemu/ps2_netemu are different. Ps2_emu BIOS is able to run only on ps2emu version of emulator due to RDRAM check.

PS3 models without Emotion Engine unit use "SPE-compatible SIMD graphics-rounding mode for VMX/Altivec Instructions" for FPU, and VU0 emulated floats calculations. This is set on emulator init by HV call 97 with param 1. VU1 actually run at SPE core so no compatibility mode need (or can) to be set. SPE compatible mode for PPE mean that rounding mode is set as round to zero, denormals are treated as zero, and there are no infinities or NaNs. So literally what PS2 VU was originally. Although SPE, and PPE SPE compatibility mode can still be inaccurate comparing to PS2. Good example here are TriAce games, or Castlevania COD where SPE calculation is wrong by 1 bit making games unplayable without patch. This is due to some PS2 math algo specific inaccuracies in FPU/VU implementation that are not present on any other hardware.

Note:

PS2 emulators workload comparison

PS2 (GS+EE)
Core Job Source Notes
SPU0 Spu2 SPU Assembly Spu2 emulator
SPU1 Sif SPU Assembly Some kind of bridge to IOP, since SIF is part of EE hardware.
SPU2 Timer SPU Assembly IOP timers.
SPU3-6 - - Unknown, emulator seems to not use them
SPU7 - - Unavailable: Factory disabled SPU
PPU:0 PS2-Devices C++ and PPU ASM
PPU:1 IOP PPU ASM Interpreter, dmas, iop hw regs, etc.
PS2-EE Emotion Engine Hardware CXD2953AGB Only in CECHAxx and CECHBxx PS3 models with COK-001 motherboard
PS2-GS Graphic Synthesizer
PS2_GX
Core Job Source Notes
SPU0 IOP SPU ASM I/O Processor (originally PS1 main processor)
SPU1 PS2-SPU2 SPU ASM Sound processing unit 2
SPU2 IPU SPU ASM Image Processing Unit
SPU3 VU1 SPU ASM Vector Unit 1
SPU4 EEDMA SPU ASM EE DMA plus VIF1 handler
SPU5 GSGIF SPU ASM GIF (GS Interface, very limited since GS is on board)
SPU6 ? ? Emulator never access it directly but can be possibly used for MagicGate. Emulator sends/receives MG data thru virtual uart port 10.
SPU7 - - Unavailable: Factory disabled SPU
PPU:0 PS2-Devices C++ and PPU ASM
PPU:1 Emotion Engine C++ and PPU ASM
PS2-GS Graphic Synthesizer Hardware CXD2972GB Only in CECHCxx PS3 models with COK-002 motherboard
PS2 Software
Core Job Source Notes
SPU0 IOP SPU ASM I/O Processor (originally PS1 main processor)
SPU1 SPU2 SPU ASM Sound Processing Unit 2
SPU2 VU1 SPU ASM Vector Unit 1
SPU3 EEDMA SPU ASM Emotion Engine DMA Controller
SPU4 GSEGIF SPU ASM GIF
SPU5 GSE SPU ASM
SPU6 IPU SPU ASM Image Processing Unit
SPU7 - - Unavailable: Factory disabled SPU
PPU:0 PS2-Devices C++ and PPU ASM
PPU:1 Emotion Engine C++ and PPU ASM
PS2 Netemu
Core Job Source Notes
SPU0 IOP SPU ASM I/O Processor (originally PS1 main processor)
SPU1 SPU2 SPU ASM Sound processing unit 2 (originally SPU from PS1)
SPU2 VU1 SPU ASM Running VU1 code translated previously on PPU side.
SPU3 EEDMA SPU ASM Partial DMAC, mostly channels 1/2, and VU1 CODE r/w. Also process VIF1 commands (incl. Unpacks).
SPU4 FE SPU ASM GIF unit, processing GIF tags, handling GS internal registers, etc.
SPU5 BE SPU ASM
SPU6 IPU SPU ASM EE Image Processing Unit
SPU7 BE PPU/SPU ASM Factory disabled SPU. Emulator set name for JOB, but never try to start/set it as active. Although a lot of code in emulator is ready to use it.
PPU:0 - -
PPU:1 - -

PS2 Emulators types and versions

PS2_EMU
FW version TOC Notes
1.00 AV 0x7C3150
1.02 0x7C31F0
1.10 0x7C2168
1.11 0x7C23C8
1.30 0x8442E8
1.30 AV 0x8442E8
1.31 0x844C98
1.32 0x845CA0
1.50 0x848728
1.90 0x4D7ED8
3.66 - 3.74 0x4E9A20
4.00 - 4.01 0x4EADB8
4.10 - 4.11 0x4EAD28
4.20 - 4.21 0x4EAE30
4.23 0x4EACE0
4.25 0x4EAE30 Reverted to 4.20 - 4.21 version?
4.78 - 4.82 0x4EB8C0
PS2_GXEMU
FW version TOC Notes
1.50 0x5BDFC8
1.90 0x666C78
3.66 - 3.74 0x6766B8
4.00 - 4.11 0x677990
3.66 - 3.74 0x677AA8
4.78 - 4.82 0x678548
PS2_SOFTEMU
FW version TOC Notes
1.90 0x5C7B10
2.50 0x5C7ED8
3.41 0x5C8C00
3.66 - 3.71 0x5C8EC0
3.72 - 4.01 0x5C8E40
PS2_NETEMU
FW version TOC Notes
3.73 - 3.74 0x7D8B00
4.00 - 4.01 0x7DA200
4.10 - 4.11 0x7DA180
4.20 - 4.25 0x7DA500
4.78 - 4.83 0x751280

General observations regarding PS2 Classics emulator (ps2_netemu)

  • Virtual memory cards are per title based, but apparently run through the current memory card system. The module used to manage memory cards is: vmc_savedata_plugin.sprx - Using a regular memory card that has been renamed result in a "The save data is corrupt (8XXXXXXX) error"
  • Loads an epilepsy warning before PS2 logo (PS button menu appears during epilepsy warning if controller is synced)
  • Does not support online functionality of PS2 titles (network configuration utility inside Full Spectrum Warrior claims no network adaptor has been found, same with Syphon Filter: The Omega Strain).

- Only file that is needed in the folder for PS2 Classics is "iso.bin.enc". Removing the manuals/DXT files will cause the game to boot IMMEDIATELY to the PS2 logo upon switching to 720p/starting PS2 LPAR.

folder/file layout

(in this example GTA San Andreas Classic)

[NPUD20946]
       [USRDIR]
             [CONTENT]
                    001.dxt
                    002.dxt
                    003.dxt
                    004.dxt
                    005.dxt
                    006.dxt
                    007.dxt
                    008.dxt
                    009.dxt
                    010.dxt
                    011.dxt
                    012.dxt
                    013.dxt
                    014.dxt
                    015.dxt
                    016.dxt
                    017.dxt
                    Others.dxt
                    Manual.idx
             [SAVEDATA]
                    SCEVMC0.VME
                    SCEVMC1.VME
             CONFIG
             ISO.BIN.EDAT
             ISO.BIN.ENC
       PS3LOGO.DAT
       PARAM.SFO
       ICON0.PNG
       PIC0.PNG
       PIC1.PNG
       PIC2.PNG

Virtual PS2 (emulated machine) usage and features

Video Modes

Note: Real PS2 : http://users.neoscientists.org/~blue/ps2videomodes.txt

Video Modes
----.-----------.---------------.-----------.-----------.
 No | Name      | Resolution	| fV(Hz)    | fH(kHz)   |
----+-----------+---------------+-----------+-----------|
  0 | NTSC-NI   |  640x240(224) | 59.940    | 15.734    |
  1 | NTSC-I    |  640x480(448) | 59.820    | 15.734    |
  2 | PAL-NI    |  640x288(256) | 50.000    | 15.625    |
  3 | PAL-I     |  640x576(512) | 49.760    | 15.625    |
  4 | VESA-1A   |  640x480      | 59.940    | 31.469    |
  5 | VESA-1C   |  640x480      | 75.000    | 37.500    |
  6 | VESA-2B   |  800x600      | 60.317    | 37.879    |
  7 | VESA-2D   |  800x600      | 75.000    | 46.875    |
  8 | VESA-3B   | 1024x768      | 60.004    | 48.363    |
  9 | VESA-3D   | 1024x768      | 75.029    | 60.023    |
 10 | VESA-4A   | 1280x1024     | 60.020    | 63.981    |
 11 | VESA-4B   | 1280x1024     | 75.025    | 79.976    |
 12 | DTV-480P  |  720x480      | 59.940    | 31.469    |
 13 | DTV-1080I | 1920x1080     | 60.000    | 33.750    |
 14 | DTV-720P  | 1280x720      | ??        | ??        |
----^-----------^---------------^-----------^-----------'

Memory Mapping

ps2netemu

Mapping ELF @ 0x200000000
Name ea lpar2(netemu 4.81) size flags lpar1(lv1 4.81)
text 0x0 0x3D00000 0x300000( 3 MB) 0x8000000000000003 0000000000000003 0x7D00000
ro_work 0x300000 0x300000 0x500000( 5 MB) 0x0000000000000003 0000000000000003 0x4300000
rw_work 0x800000 0x800000 0x2A00000( 42 MB) 0x0000000000000001 0000000000000003 0x4800000
negmem 0x1FFF0000 0x3210000 0x10000( 64 KB) 0x0000000000000001 0000000000000000 0x7210000
ee_ram 0x100000000 0x64000E000000 0x2000000( 32 MB) 0x0000000000000001 0000000000000000 0x3C00000 - 0x3F00000, 0x8000000 - 0x9B00000
ee_jit_code 0xD00000000 0x680024000000 0x3000000( 48 MB) 0x8000000000000001 0000000000000003 0xBC00000 - 0xEB00000
vu0_jit_code 0xD08000000 0x580000800000 0x400000( 4 MB) 0x8000000000000001 0000000000000003 0x900000 - 0xC00000
vu0_jit_data 0xD0C000000 0x3700000 0x400000( 4 MB) 0x0000000000000002 0000000000000003 0x7700000
eeram_jit_lut 0xE00000000 0x640010000000 0x2000000( 32 MB) 0x0000000000000001 0000000000000003 0x9C00000 - 0xBB00000
eerom_jit_lut 0xE0FC00000 0x580000C00000 0x400000( 4 MB) 0x0000000000000001 0000000000000003 0xD00000 - 0x1000000
ee_dbg_ram 0x90FFF8000 0x64000E078000 0x8000( 32 KB) 0x0000000000000001 0000000000000000
iop_ram 0x400000000 0x3300000 0x200000( 2 MB) 0x0000000000000001 0000000000000000 0x7300000
iop_rom 0x50FC00000 0x580001000000 0x400000( 4 MB) 0x0000000000000001 0000000000000002 0x1100000 - 0x1400000
iop_spad 0x50F800000 0x3220000 0x10000( 64 KB) 0x0000000000000001 0000000000000002 0x7220000
spu2_ram 0x600000000 0x3500000 0x200000( 2 MB) 0x0000000000000001 0000000000000000 0x7500000
spu2_ram2 0x600200000 0x3500000 0x200000( 2 MB) 0x0000000000000001 0000000000000000 0x7500000
spu2_pcm 0x1000000000 0x3230000 0x10000( 64 KB) 0x0000000000000001 0000000000000000 0x7230000
ee_spr_lo 0x700000000 0x3201000 0x2000( 8 KB) 0x0000000000000001 0000000000000000 0x7201000
ee_spr 0x800000000 0x3203000 0x6000( 24 KB) 0x0000000000000001 0000000000000000 0x7203000
ee_vu0_dmem0 0x301004000 0x3200000 0x1000( 4 KB) 0x0000000000000001 0000000000000001 0x7200000
ee_vu0_dmem1 0x301005000 0x3200000 0x1000( 4 KB) 0x0000000000000001 0000000000000001 0x7200000
ee_vu0_dmem2 0x301006000 0x3200000 0x1000( 4 KB) 0x0000000000000001 0000000000000001 0x7200000
ee_vu0_dmem3 0x301007000 0x3200000 0x1000( 4 KB) 0x0000000000000001 0000000000000001 0x7200000
ee_rom 0x30FC00000 0x580001000000 0x400000( 4 MB) 0x0000000000000001 0000000000000001 0x1100000 - 0x1400000
vrc 0xC00000000 0x600005000000 0x1000000( 16 MB) 0x0000000000000001 0000000000000000 0x1500000 - 0x2400000
/dev/zero 0x4000000000 0x3240000 0x10000( 64 KB) 0x0000000000000001 0000000000000001 0x7240000
dma_vu0_dmem0 0x4001004000 0x3200000 0x1000( 4 KB) 0x0000000000000001 0000000000000001 0x7200000
dma_vu0_dmem1 0x4001005000 0x3200000 0x1000( 4 KB) 0x0000000000000001 0000000000000001 0x7200000
dma_vu0_dmem2 0x4001006000 0x3200000 0x1000( 4 KB) 0x0000000000000001 0000000000000001 0x7200000
dma_vu0_dmem3 0x4001007000 0x3200000 0x1000( 4 KB) 0x0000000000000001 0000000000000001 0x7200000
imm_vu0_dmem0 0x30000000 0x3200000 0x1000( 4 KB) 0x0000000000000001 0000000000000001 0x7200000
imm_vu0_dmem1 0x30001000 0x3200000 0x1000( 4 KB) 0x0000000000000001 0000000000000001 0x7200000
imm_vu0_dmem2 0x30002000 0x3200000 0x1000( 4 KB) 0x0000000000000001 0000000000000001 0x7200000
imm_vu0_dmem3 0x30003000 0x3200000 0x1000( 4 KB) 0x0000000000000001 0000000000000001 0x7200000
SGSXdr 0x1904000000 0x64000C000000 0x1700000( 23 MB) 0x0000000000000001 0000000000000000 0x2500000 - 0x3B00000
iopTrace 0x1400000000 0x3250000 0x10000( 64 KB) 0x0000000000000001 0000000000000000 0x7250000

PS2 Memory and Hardware Mapped Registers Layout

EE Virtual/Physical Memory Map
  KUSEG: 00000000h-7FFFFFFFh User segment
  KSEG0: 80000000h-9FFFFFFFh Kernel segment 0
  KSEG1: A0000000h-BFFFFFFFh Kernel segment 1
  KSSEG: C0000000h-DFFFFFFFh Supervisor segment
  KSEG3: E0000000h-FFFFFFFFh Kernel segment 3
  
  Virtual    Physical
  00000000h  00000000h  32 MB    Main RAM (first 1 MB reserved for kernel)
  20000000h  00000000h  32 MB    Main RAM, uncached
  30100000h  00100000h  31 MB    Main RAM, uncached and accelerated
  10000000h  10000000h  64 KB    I/O registers
  11000000h  11000000h  4 KB     VU0 code memory
  11004000h  11004000h  4 KB     VU0 data memory
  11008000h  11008000h  16 KB    VU1 code memory
  1100C000h  1100C000h  16 KB    VU1 data memory
  12000000h  12000000h  8 KB     GS privileged registers
  1C000000h  1C000000h  2 MB     IOP RAM
  1FC00000h  1FC00000h  4 MB     BIOS, uncached (rom0)
  9FC00000h  1FC00000h  4 MB     BIOS, cached (rom09)
  BFC00000h  1FC00000h  4 MB     BIOS, uncached (rom0b)
  70000000h  ---------  16 KB    Scratchpad RAM (only accessible via virtual addressing)

IOP Physical Memory Map
  KUSEG: 00000000h-7FFFFFFFh User segment
  KSEG0: 80000000h-9FFFFFFFh Kernel segment 0
  KSEG1: A0000000h-BFFFFFFFh Kernel segment 1
  
  Physical
  00000000h  2 MB     Main RAM (same as on PSX)
  1D000000h           SIF registers
  1F800000h  64 KB    Various I/O registers
  1F900000h  1 KB     SPU2 registers
  1FC00000h  4 MB     BIOS (rom0) - Same as EE BIOS
  
  FFFE0000h (KSEG2)   Cache control

Additional Memory
  4 MB   GS VRAM (used for framebuffer, textures, zbuffer, etc)
  2 MB   SPU2 work RAM - quadrupled from PSX's SPU
  8 MB   Memory card


Hardware Mapped Registers
EE Map
EE Timers
  100000xxh        Timer 0
  100008xxh        Timer 1
  100010xxh        Timer 2
  100018xxh        Timer 3
Image Processing Unit (IPU)
  10002000h 8h     IPU Command
  10002010h 4h     IPU Control
  10002020h 4h     IPU bit pointer control
  10002030h 8h     Top of bitstream
  10007000h 10h    Out FIFO (read)
  10007010h 10h    In FIFO (write)
Graphics Interface (GIF)
  10003000h 4h     GIF_CTRL - Control register
  10003010h 4h     GIF_MODE - Mode setting
  10003020h 4h     GIF_STAT - Status
  10003040h 4h     GIF_TAG0 - Bits 0-31 of tag before
  10003050h 4h     GIF_TAG1 - Bits 32-63 of tag before
  10003060h 4h     GIF_TAG2 - Bits 64-95 of tag before
  10003070h 4h     GIF_TAG3 - Bits 96-127 of tag before
  10003080h 4h     GIF_CNT - Transfer status counter
  10003090h 4h     GIF_P3CNT - PATH3 transfer status counter
  100030A0h 4h     GIF_P3TAG - Bits 0-31 of PATH3 tag when interrupted
  10006000h 10h    GIF FIFO
DMA Controller (DMAC)
  100080xxh        VIF0 - channel 0
  100090xxh        VIF1 - channel 1
  1000A0xxh        GIF - channel 2
  1000B0xxh        IPU_FROM - channel 3
  1000B4xxh        IPU_TO - channel 4
  1000C0xxh        SIF0 - channel 5
  1000C4xxh        SIF1 - channel 6
  1000C8xxh        SIF2 - channel 7
  1000D0xxh        SPR_FROM - channel 8
  1000D4xxh        SPR_TO - channel 9
  1000E000h 4h     D_CTRL - DMAC control
  1000E010h 4h     D_STAT - DMAC interrupt status
  1000E020h 4h     D_PCR - DMAC priority control
  1000E030h 4h     D_SQWC - DMAC skip quadword
  1000E040h 4h     D_RBSR - DMAC ringbuffer size
  1000E050h 4h     D_RBOR - DMAC ringbuffer offset
  1000E060h 4h     D_STADR - DMAC stall address
  1000F520h 4h     D_ENABLER - DMAC disabled status
  1000F590h 4h     D_ENABLEW - DMAC disable
Interrupt Controller (INTC)
  1000F000h 4h     INTC_STAT - Interrupt status
  1000F010h 4h     INTC_MASK - Interrupt mask
Subsystem Interface (SIF)
  1000F200h 4h     MSCOM - EE->IOP communication
  1000F210h 4h     SMCOM - IOP->EE communication
  1000F220h 4h     MSFLAG - EE->IOP flags
  1000F230h 4h     SMFLAG - IOP->EE flags
  1000F240h 4h     Control register
Privileged GS registers
  12000000h 8h     PMODE - various PCRTC controls
  12000010h 8h     SMODE1
  12000020h 8h     SMODE2
  12000030h 8h     SRFSH
  12000040h 8h     SYNCH1
  12000050h 8h     SYNCH2
  12000060h 8h     SYNCV
  12000070h 8h     DISPFB1 - display buffer for output circuit 1
  12000080h 8h     DISPLAY1 - output circuit 1 control
  12000090h 8h     DISPFB2 - display buffer for output circuit 2
  120000A0h 8h     DISPLAY2 - output circuit 2 control
  120000B0h 8h     EXTBUF
  120000C0h 8h     EXTDATA
  120000D0h 8h     EXTWRITE
  120000E0h 8h     BGCOLOR - background color
  12001000h 8h     GS_CSR - control register
  12001010h 8h     GS_IMR - GS interrupt control
  12001040h 8h     BUSDIR - transfer direction
  12001080h 8h     SIGLBLID - signal

IOP Map
Subsystem Interface (SIF)
  1D000000h 4h     MSCOM - EE->IOP communication
  1D000010h 4h     SMCOM - IOP->EE communication
  1D000020h 4h     MSFLAG - EE->IOP flags
  1D000030h 4h     SMFLAG - IOP->EE flags
  1D000040h 4h     Control register
CDVD Drive
  1F402004h 1h     Current N command
  1F402005h 1h     N command status (R)
  1F402005h 1h     N command params (W)
  1F402006h 1h     Error
  1F402007h 1h     Send BREAK command
  1F402008h 1h     CDVD I_STAT - interrupt register
  1F40200Ah 1h     Drive status
  1F40200Fh 1h     Disk type
  1F402016h 1h     Current S command
  1F402017h 1h     S command status
  1F402018h 1h     S command params
Interrupt Control
  1F801070h 4h     I_STAT - Interrupt status
  1F801074h 4h     I_MASK - Interrupt mask
  1F801078h 1h     I_CTRL - Global interrupt disable
DMA registers
  1F80108xh        MDECin - channel 0
  1F80109xh        MDECout - channel 1
  1F8010Axh        SIF2 (GPU) - channel 2
  1F8010Bxh        CDVD - channel 3
  1F8010Cxh        SPU2 Core0 - channel 4
  1F8010Dxh        PIO - channel 5
  1F8010Exh        OTC - channel 6
  1F80150xh        SPU2 Core1 - channel 8
  1F80151xh        ??? - channel 9
  1F80152xh        SIF0 - channel 10
  1F80153xh        SIF1 - channel 11
  1F80154xh        SIO2in - channel 12
  1F80155xh        SIO2out - channel 13
  
  1F8010F0h 4h     DPCR - DMA priority control
  1F8010F4h 4h     DICR - DMA interrupt control
  1F801570h 4h     DPCR2 - DMA priority control 2
  1F801574h 4h     DICR2 - DMA priority control 2
IOP Timers
  1F80110xh        Timer 0
  1F80111xh        Timer 1
  1F80112xh        Timer 2
  1F80148xh        Timer 3
  1F80149xh        Timer 4
  1F8014Axh        Timer 5
Serial Interface (SIO2)
  1F808200h 40h    SEND3 buffer
  1F808240h 20h    SEND1/2 buffers
  1F808260h 1h     In FIFO
  1F808264h 1h     Out FIFO
  1F808268h 4h     SIO2 control
  1F80826Ch 4h     RECV1
  1F808270h 4h     RECV2
  1F808274h 4h     RECV3
Sound Processing Unit (SPU2)
  1F900000h 180h   Core0 Voice 0-23 registers
  1F900190h 4h     Key ON 0/1
  1F900194h 4h     Key OFF 0/1
  1F90019Ah 2h     Core attributes
  1F90019Ch 4h     Interrupt address H/L
  1F9001A8h 4h     DMA transfer address H/L
  1F9001ACh 2h     Internal transfer FIFO
  1F9001B0h 2h     AutoDMA status
  1F9001C0h 120h   Core0 Voice 0-23 start/loop/next addresses
  1F900340h 4h     ENDX 0/1
  1F900344h 2h     Status register
  
  ... above addresses repeat for Core1 starting at 1F900400h ...
  
  1F900760h 2h     Master Volume Left
  1F900762h 2h     Master Volume Right
  1F900764h 2h     Effect Volume Left
  1F900766h 2h     Effect Volume Right
  1F900768h 2h     Core1 External Input Volume Left
  1F90076Ah 2h     Core1 External Input Volume Right
 

Memory Allocation

ps2_netemu

Name Size page_log2 lpar2(netemu 4.81) lpar1(lv1 4.81)
ra_vu0_dmem 0x1000 (4 KB) 12 (4 KB) 0x3200000 0x7200000
ra_ee_spr_lo 0x2000 (8 KB) 12 (4 KB) 0x3201000 0x7201000
ra_ee_sprx 0x6000 (24 KB) 12 (4 KB) 0x3203000 0x7203000
ra_negmem 0x10000 (64 KB) 16 (64 KB) 0x3210000 0x7210000
ra_iop_spad 0x10000 (64 KB) 16 (64 KB) 0x3220000 0x7220000
ra_spu2_pcm 0x10000 (64 KB) 16 (64 KB) 0x3230000 0x7230000
ra_nulls 0x10000 (64 KB) 16 (64 KB) 0x3240000 0x7240000
ra_itrace 0x10000 (64 KB) 16 (64 KB) 0x3250000 0x7250000
ra_iop_ram 0x200000 (2 MB) 20 (1 MB) 0x3300000 0x7300000
ra_spu2_ram 0x200000 (2 MB) 20 (1 MB) 0x3500000 0x7500000
ra_vu0_code 0x400000 (4 MB) 20 (1 MB) 0x580000800000 0x900000 - 0xC00000
ra_vu0_data 0x400000 (4 MB) 20 (1 MB) 0x3700000 0x7700000
ra_ee_rom_pc 0x400000 (4 MB) 20 (1 MB) 0x580000C00000 0xD00000 - 0x1000000
ra_ps2_rom 0x400000 (4 MB) 20 (1 MB) 0x580001000000 0x1100000 - 0x1400000
ra_vrc_mem 0x1000000 (16 MB) 20 (1 MB) 0x600005000000 0x1500000 - 0x2400000
ra_sgs_xdr 0x1700000 (23 MB) 20 (1 MB) 0x64000C000000 0x2500000 - 0x3B00000
ra_ee_ram 0x2000000 (32 MB) 20 (1 MB) 0x64000E000000 0x3C00000 - 0x3F00000, 0x8000000 - 0x9B00000
ra_ee_ram_pc 0x2000000 (32 MB) 20 (1 MB) 0x640010000000 0x9C00000 - 0xBB00000
ra_trans_code 0x3000000 (48 MB) 20 (1 MB) 0x680024000000 0xBC00000 - 0xEB00000


Controller

ID Controller #Number Note
1 (1-A) 1
2 (2-A) 2
3 (1-B) 3
4 (2-B) 4
5 (1-C) 5 Gamepad LED #1 + #4
6 (2-C) 6 Gamepad LED #2 + #4
7 (1-D) 7 Gamepad LED #3 + #4

Peripheral support

ps2_emu.self / ps2_gxemu.self

  1. Hub
  2. Mouse
  3. Keyboard
  4. EyeToy
  5. Head Mount Display
  6. Mic
  7. Ascii Mic
  8. Socom USB Headset
  9. Usb Headset
  10. Sea Mic Controller
  11. Force Feedback device
  12. GT Force
  13. Momo Force
  14. Driving Force Pro
  15. G25/G27
  16. Momo Racing
  17. Flight Force
  18. Force 3D Pro
  19. Modem
  20. Guncon2
  21. Densya de GO! controller type 2
  22. Densya de GO! Sincansen senyou controller
  23. Capture Eye
  24. Flight Stick
  25. Flight Stick 2
  26. Pop Egg
  27. Trance Vibrator
  28. PSP
  29. Compact Flight Controller
  30. Flash Memory
  31. Buzz!
  32. Pachi-Slot Controller Kurouto
  33. Usb Adapter
  34. Guncon3
  35. Multi Train Controller
  36. Para Para Paradise controller

ps2_netemu.self

  1. BD Remote Control
  2. PLAYSTATION(R)3 Controller (Vendor ID 0x54C, Product ID 0x268),
  3. Motion Controller - Move (Vendor ID 0x54C, Product ID 0x3D5),
  4. Navigation Controller (Vendor ID 0x54C, Product ID 0x42F)
  5. "guncon3"


Unknown:

  1. Vendor ID 0xF0D (Hori), Product ID 0x4A
  2. Vendor ID 0x54C (Sony), Product ID 0x5AF

BIOS

ps2_netemu.self

Ps2_netemu use integrated PS2 bios included in ps2netemu.elf, not additional file like in ps1emu case. In 4.81 firmware BIOS is located from 0x820A00 to 0x9F09FF (0x820900 to 0x9F08FF in fw4.50). Bios version is to be Developement v2.20 from Japan region (22/01/2007), but it's of course not limited to booting only NTSC-J games.

Notable thing is that ps2_netemu use the same bios as ps2_gxemu, and ps2onps4. ps2_netemu not boot using ps2_emu bios because of failing RDRAM check.

File Offset in fw4.81 ps2_netemu Offset in exported bin Description File type (exportable)
RESET 0x820A00 0x00 Bootstrap code for the EE and IOP. BIN
ROMDIR 0x823180 0x2780 The ROMDIR part of the ROM image, which provides information on the location and name of files contained in the image. BIN
EXTINFO 0x8236C0 0x2CC0 Contains the "EXTINFO" for all files in the ROM image. BIN
SBIN 0x823D30 0x3330 Seems to be the pad controller library for the PS1 monitor. BIN
LOGO 0x82ACD0 0xA2D0 PS1 logo? BIN
IOPBTCONF 0x83F420 0x1EA20 Boot configuration file for the IOP, during the final phase of the IOP reset. If no UDNL module is specified, the IOP will only have a single IOP reset in the reboot process, with the modules listed in IOPBTCONF. BIN
IOPBTCON2 0x83F510 0x1EB10 Boot configuration file for the IOP, for the first phase of the IOP reset (before UDNL is loaded). BIN
SYSMEM 0x83F5E0 0x1EBE0 System Memory Manager. ELF
LOADCORE 0x840800 0x1FE00 The core of IOP module loading. Provides the lowest level of IOP module loading functions. Also handles the startup of the IOP. ELF
EXCEPMAN 0x842D80 0x22380 Exception manager. ELF
INTRMANP 0x843960 0x22F60 Interrupt Manager. According to wisi, it is for PS mode. ELF
INTRMANI 0x845370 0x24970 Interrupt Manager. According to wisi, it is for IOP mode. ELF
SSBUSC 0x8471B0 0x267B0 SSBUS Controller library. The SSBUS seems to be the bus that all peripherals get connected to. It seems to have the power to control the mapping of the device registers, as well as access timing. ELF
TIMEMANP 0x847920 0x26F20 Timer Manager (PS mode) ELF
TIMEMANI 0x848500 0x27B00 Timer Manager (IOP mode) ELF
DMACMAN 0x849130 0x28730 DMA Controller Manager. ELF
SYSCLIB 0x84C830 0x2BE30 System C Library. ELF
HEAPLIB 0x84EF90 0x2E590 Memory HEAP LIBrary (i.e. thvpool, thfpool) ELF
THREADLIB 0x84FC90 0x2F290 Multi_Thread_Manager ELF
VBLANK 0x858A20 0x38020 V-Blank management ELF
IOMAN 0x8597B0 0x38DB0 IO Manager ELF
MODLOAD 0x85B720 0x3AD20 IOP module loader. ELF
ROMDRV 0x85DA70 0x3D070 ROM driver. Provides access to the boot ROM (rom0). ELF
ADDDRV 0x85E960 0x3DF60 Adds support for the DVD ROM (rom1:), via ROMDRV. ELF
STDIO 0x85DDC0 0x3D3C0 Standard I/O library. ELF
SIFMAN 0x85F9B0 0x3EFB0 SIF manager. ELF
SIFINIT 0x860F50 0x40550 Initializes the SIF. ELF
EESYNC 0x861370 0x40970 For synchronizing with the EE, at the end of IOP resets. EESYNC from DNAS images are evil; they also perform a memory wipe of the region from 0x00084000 to .0x00100000. ELF
EENULL 0x861810 0x40E10 The idle thread (id #0) module, in ps2 loaded to 0x00081FC0. BIN
PS1ID 0x861850 0x40E50 Only found in newer boot ROMs BIN
LIBFI 0x861860 0x40E60 Not present in the boot ROM of the SCPH-10000 and SCPH-15000. BIN
PS1VERJ 0x861950 0x40F50 BIN
PS1VERA 0x861960 0x40F60 BIN
PS1VERE 0x861970 0x40F70 BIN
PS1VERC 0x861980 0x40F80 BIN
PS1VERH 0x861990 0x40F90 BIN
OSDSYS 0x8619A0 0x40FA0 The browser BIN
- 0x8619B0 0x40FB0 BIN
RDRAM 0x861A00 0x41000 Provides a RDRAM test for the EE at power-on. This is run from RESET. BIN
EELOADCNF 0x864750 0x43D50 Contains the IOP boot configuration file for EELOAD. BIN
SIFCMD 0x864900 0x43F00 SIF command module. Contains the SIF command and SIF RPC functions. ELF
REBOOT 0x866B40 0x46140 The reboot service. Receives IOP reset packets from the EE, from across the SIF. ELF
LOADFILE 0x867310 0x46910 The RPC server for MODLOAD ELF
EECONF 0x869A70 0x49070 Loads part of the system configuration from the MECHACON EEPROM. Also configures and resets some peripherals, depending on the model version. In slimlines, and possibly on PS3 EECONF will also load the MAC address. ELF
- 0x86A9F0 0x49FF0 BIN
IOPBOOT 0x86AA00 0x4A000 IOP bootup program BIN
- 0x86BB60 0x4B160 BIN
TBIN 0x86C200 0x4B800 The PS1 monitor program. Seems to be the PS1 BIOS. This is started by RESET, when the IOP is in PS1 mode. BIN
XSHA1 0x87A170 0x59770 sha1 - this only present in PS3. It is used as additional antipiracy check. It seems that it calculate disc main elf checksum and compares it with some database. Config related? ELF
XLOADFILE 0x87B140 0x5A740 Updated module ELF
SIO2MAN 0x87E1F0 0x5D7F0 SIO2 manager. Provides access to the SIO2 interface. ELF
- 0x87FE20 0x5F420 BIN
MCSERV 0x881D40 0x61340 RPC server for MCMAN. ELF
- 0x883A40 0x63040 BIN
KROMG 0x884A00 0x64000 BIN
- 0x8866C0 0x65CC0 BIN
KROM 0x886A00 0x66000 Kanji ROM? Not sure where this is used. BIN
- 0x8A0870 0x7FE70 BIN
ROMVER 0x8A0900 0x7FF00 ROM version. BIN
- 0x8A0910 0x7FF10 BIN
VERSTR 0x8A0930 0x7FF30 Version string. Probably PS1 ROM will use this because that this string is also present in PlayStation consoles. BIN
- 0x8A0990 0x7FF90 BIN
ROMGSCRT 0x8A0A00 0x80000 BIN
NCDVDMAN 0x8A3730 0x82D30 It seems to be a heavily stripped-down CDVDMAN module, with no support for some S-command functions like sceCdRI. ELF
SECRMAN 0x8B0170 0x8F770 Security Manager. Signing is NOT done with the one in ROM, but with a special version that comes with the utility discs. Looks like PS3 units have a different SECRMAN module from retail sets, similar to PS2 TOOL one. ELF
MCMAN 0x8B4630 0x93C30 Memory Card Manager. ELF
PADMAN 0x8C3AC0 0xA30C0 Pad manager. ELF
CDVDMAN 0x8CD210 0xAC810 The CD/DVD manager. ELF
CDVDFSV 0x8D55C0 0xB4BC0 The RPC server for CDVDMAN. ELF
FILEIO 0x8DD980 0xBCF80 RPC server for IOMAN. Sony has greatly changed the semantics and design of FILEIO after some point. Connecting an old FILEIO EE RPC client to a newer server will result in a severe IOP crash. ELF
CLEARSPU 0x8DFA80 0xBF080 Seems to clear/reset the SPU, but is known to cause crashes under some conditions. Not sure if it's buggy or not. Only used by the OSDSYS of the SCPH-10000 and SCPH-15000, probably retained for backward-compatibility. ELF
UDNL 0x8E16C0 0xC0CC0 It is responsible for selecting the modules and starting the IOP, during the final phase of the IOP reset where the desired modules are to be loaded into the IOP. ELF
IGREETING 0x8E35C0 0xC2BC0 Displays boot information (i.e. IOP boot type, EBOOTP, IBOOTP, switch positions for DSW602 and the type of DSW602 board installed ELF
EELOAD 0x8E4620 0xC3C20 The EE ELF loader, which is loaded by LoadExecPS2() to 0x00082000 in PS2 for loading ELFs. BIN
XCDVDMAN 0x8F37A0 0xD2DA0 cdvd_driver - Updated module ELF
XCDVDFSV 0x902530 0xE1B30 cdvd_ee_driver - Updated module ELF
OSDSND 0x910960 0xEFF60 OSD sound library. This is actually the tentative sound driver, which is called "librspu2" in the Sony SDK. ELF
PS2LOGO 0x93B5B0 0x11ABB0 Displays the PlayStation 2 logo from the inserted disc. For newer consoles, if the logo cannot be decrypted properly, it will fall back to the browser. Not actually required to boot games, but the Sony OSDSYS boots PS2 games through this program. ELF
XPARAM2 0x957F00 0x137500 Store IOP emulation settings/flags ELF
OSDSYS 0x95A400 0x139A00 The browser, in ps3 is stripped to parse xparam2. No real browser here. BIN
PIOPRP 0x998280 0x177880 Present in the PS3 ps2_(gx/soft/net)emu; contains version 3.1.0 of the IOP software (compared to version 1.3.4 on the root). BIN
KERNEL 0x9DC1E0 0x1BB7E0 The EE kernel BIN

Description source: https://gist.github.com/uyjulian/25291080f083987d3f3c134f593483c5

Virtual PS2 HDD

There are 2 different "PS2 game" contents that can be installed in PS3 HDD (CATEGORY's 2P and 2G ). 2P are games released from PSN as "PS2 Classic" in .PKG format, and 2G are a few real "PS2 DVD discs" that can be installed in the PS3 HDD, this installation is managed by the PS2_system_data.pkg.

This games can be installed in real PS2 (in the internall HDD of a PS2 fat)... later this same installation was used in the PSX... and when implemented in PS3 there was needed to use a virtual PS2 HDD image file keeping the same format than the original HDD used in PS2.

Game files (extracted from the real PS2 disc) are installed in a IMAGE.DAT file, this file is a 1:1 "raw copy" of a PS2 HDD.

This IMAGE.DAT is placed in the "install folder" (inside USRDIR folder) and his size can vary up to 10+GB

There are 2 different installations: the most common is used to store "game expansions" (e.g: used by additional content in SOCOM games)... the other type of installation is a "full install" and it seems the only game that uses it is "Final Fantasy XI" (main game installation when the game boots for first time + game expansions added later when needed in the same IMAGE.DAT)

PS2_system_data.pkg itself uses an IMAGE.DAT file (6.43 MB)

The structure of this "virtual PS2 HDD" uses an "APA header" and a "APA MBR" + several "APA partitions", some of them containing "PFS filesystems".

Error message trying to boot a CATEGORY "2G" game with hand-made SFO's and invalid IMAGE.DAT file:
The game partition for this game cannot be created because the installed game is corrupted.
To perform this operation, delete the game, and then reinstall the game using the disc.
  • Notes
    • List of PS2 disc games compatibles with PS3 HDD installation hardcoded in dev_flash/vsh/module/game_ext_plugin.sprx
    • Virtuall PS2 HDD support module dev_flash/vsh/module/libps2hdd.sprx ?

PS2 System Data (PSN HDD Tool package)

A direct link to the package can be found in NoPayStation database in DLCs

Content ID: IP9100-NPIA00001_00-PS2HDDSYSDAT0001
QA Digest: 2A876715D42678BB7A6E00C030C0121B
HASH: E1B0DBE46FC44190DC7A140681D8B9D4

http://manuals.playstation.net/document/en/ps3/current/game/hddinstall.html

Titles supporting HDD installation

  • Nobunaga's Ambition Online and Expansion Packs
  • Final Fantasy XI (disc1=SCUS97266 disc2=SCUS97269)and Expansion Discs
  • SOCOM II: U.S. NAVY SEALs and Related discs included with OPM Issue 87, OPM Issue 88, OPM Issue 89, OPM Issue 90
  • SOCOM 3: U.S. NAVY SEALs
  • SOCOM: U.S. NAVY SEALs Combined Assault
  • Front Mission Online
  • Official PlayStation Magazine Issue 87, 88, 89, 90 Discs

( non-official ps2hdd gameslist )

TitleID/DiscID in game_ext_plugin.sprx

Mainly Final Fantasy 11, Nobunaga Ambition Online, Socom IDs and the required HDD Gigabyte amount for install onto the internal hdd.

Speculation: flags are AND' with 0,1,2 (selected from sys_sm_get_hw_config according to ps2emu hardware flags? 0 = no hw?, 1 = gxemu?, 2=full hw? )

Flags DiscID Alternative? DiscID GigaByte Title 0 = VMC
1 = IMAGE.DAT
Internal Name? GigaByte
0xFFFF SLPS20200 SLPS25200 0x15 FINAL FANTASY XI 1 PP.SLPM-25200.MAGIC.APPLICATION 0x15
SLPM65705
SLPM65706
SLPM65953
SLPM66393
SLPM66394
SLPM66893
SLPM66894
SLPM55229
0x0001 SLPM65197 SLPM65197 0x07 信長の野望 Online 1 PP.SLPM-65197.MAGIC.APPLICATION 0x07
SLPM65783
SLPM66539
SLPM66954
0xFFFF SCUS97269 SCUS97269 0x15 FINAL FANTASY XI 1 PP.SCUS-97266.MAGIC.APPLICATION 0x15
SLUS21070
SLUS21404
SLUS21694
SLUS21704
0xFFFF SCUS97275 SCUS97275 0x02 SOCOM 0 PP.SCUS-97275..SOCOM_II 0x02
SCUS97474
SCUS97340
SCUS97341
SCUS97342
SCUS97442
SCUS97545

In PS2 Emulator same Title IDs are present with following information:

SLPS25200 FINAL FANTASY XI          : 0x100000000 (4 GB?)
SCUS97269 FINAL FANTASY XI          : 0x300000000 (12GB?)
SLPM65981 Front Mission Online      : 0x100000000 (4 GB?)
SLPM65197 Nobunagas Ambition Online : 0x200000000 (8 GB?)

Emulators management from GameOS

Mountpoints

 dev_ps2disc
 dev_ps2disc1 

ps2_netemu syscalls

0x0 - 0 = exec smth, 
      1 = 0x132 panic, 
      2 = 0x133 panic, 
      3 = 0x134 panic,
      4 = 0x135 panic, 
      else = 0x136 panic)
0xC - exec smth
0x5 - exec smth
0x6 - exec smth
0x10 - panic
Basically are hvsc syscalls (xoris     r11, r11, 0x8000)
 
0x80000000 - HV_Syscall_Reference#lv1_allocate_memory
0x80000001 - HV_Syscall_Reference#lv1_write_htab_entry
0x80000002 - HV_Syscall_Reference#lv1_construct_virtual_address_space
0x80000007 - HV_Syscall_Reference#lv1_select_virtual_address_space
0x80000009 - HV_Syscall_Reference#lv1_pause
0x8000000F - HV_Syscall_Reference#lv1_put_iopte
0x80000012 - HV_Syscall_Reference#lv1_construct_event_receive_port
0x8000001A - HV_Syscall_Reference#lv1_detect_pending_interrupts
0x8000001B - HV_Syscall_Reference#lv1_end_of_interrupt
0x8000001C - HV_Syscall_Reference#lv1_connect_irq_plug
0x80000039 - HV_Syscall_Reference#lv1_construct_logical_spe
0x8000003D - HV_Syscall_Reference#lv1_set_spe_interrupt_mask
0x80000042 - HV_Syscall_Reference#lv1_clear_spe_interrupt_status
0x80000043 - HV_Syscall_Reference#lv1_get_spe_interrupt_status
0x80000045 - HV_Syscall_Reference#lv1_get_logical_ppe_id
0x80000049 - HV_Syscall_Reference#lv1_set_interrupt_mask
0x8000004A - HV_Syscall_Reference#lv1_get_logical_partition_id
0x8000004E - HV_Syscall_Reference#lv1_get_spe_irq_outlet
0x8000005B - HV_Syscall_Reference#lv1_get_repository_node_value
0x8000005F - HV_Syscall_Reference#lv1_read_htab_entries
0x80000061 - HV_Syscall_Reference#lv1_set_vmx_graphics_mode
0x80000062 - HV_Syscall_Reference#lv1_set_thread_switch_control_register
0x80000074 - HV_Syscall_Reference#lv1_allocate_io_segment
0x80000076 - HV_Syscall_Reference#lv1_allocate_ioid
0x80000078 - HV_Syscall_Reference#lv1_construct_io_irq_outlet
0x8000007C - HV_Syscall_Reference#lv1_undocumented_function_124
0x8000007D - HV_Syscall_Reference#lv1_undocumented_function_125
0x8000007E - HV_Syscall_Reference#lv1_undocumented_function_126
0x80000088 - HV_Syscall_Reference#lv1_undocumented_function_136
0x8000008C - HV_Syscall_Reference#lv1_construct_lpm
0x8000008D - HV_Syscall_Reference#lv1_destruct_lpm
0x8000008E - HV_Syscall_Reference#lv1_start_lpm
0x8000008F - HV_Syscall_Reference#lv1_stop_lpm
0x80000090 - HV_Syscall_Reference#lv1_copy_lpm_trace_buffer
0x80000091 - HV_Syscall_Reference#lv1_add_lpm_event_bookmark
0x80000092 - HV_Syscall_Reference#lv1_delete_lpm_event_bookmark
0x80000093 - HV_Syscall_Reference#lv1_set_lpm_interrupt_mask
0x80000094 - HV_Syscall_Reference#lv1_get_lpm_interrupt_status
0x80000095 - HV_Syscall_Reference#lv1_set_lpm_general_control
0x80000096 - HV_Syscall_Reference#lv1_set_lpm_interval
0x80000097 - HV_Syscall_Reference#lv1_set_lpm_trigger_control
0x80000098 - HV_Syscall_Reference#lv1_set_lpm_counter_control
0x80000099 - HV_Syscall_Reference#lv1_set_lpm_group_control
0x8000009A - HV_Syscall_Reference#lv1_set_lpm_debug_bus_control
0x8000009B - HV_Syscall_Reference#lv1_set_lpm_counter
0x8000009C - HV_Syscall_Reference#lv1_set_lpm_signal
0x8000009D - HV_Syscall_Reference#lv1_set_lpm_spr_trigger
0x800000A3 - HV_Syscall_Reference#lv1_write_virtual_uart
0x800000A4 - HV_Syscall_Reference#lv1_set_virtual_uart_param
0x800000A5 - HV_Syscall_Reference#lv1_get_virtual_uart_param
0x800000A6 - HV_Syscall_Reference#lv1_configure_virtual_uart_irq
0x800000AA - HV_Syscall_Reference#lv1_open_device
0x800000AB - HV_Syscall_Reference#lv1_close_device
0x800000AC - HV_Syscall_Reference#lv1_map_device_mmio_region
0x800000AE - HV_Syscall_Reference#lv1_allocate_device_dma_region
0x800000AF - HV_Syscall_Reference#lv1_free_device_dma_region
0x800000B0 - HV_Syscall_Reference#lv1_map_device_dma_region
0x800000B1 - HV_Syscall_Reference#lv1_unmap_device_dma_region
0x800000B2 - HV_Syscall_Reference#lv1_read_pci_config
0x800000B3 - HV_Syscall_Reference#lv1_write_pci_config
0x800000C5 - HV_Syscall_Reference#lv1_connect_interrupt_event_receive_port
0x800000CF - HV_Syscall_Reference#lv1_enable_logical_spe
0x800000D2 - HV_Syscall_Reference#lv1_gpu_open
0x800000D4 - HV_Syscall_Reference#lv1_gpu_device_map
0x800000D6 - HV_Syscall_Reference#lv1_gpu_memory_allocate
0x800000D9 - HV_Syscall_Reference#lv1_gpu_context_allocate
0x800000DD - HV_Syscall_Reference#lv1_gpu_context_iomap
0x800000E1 - HV_Syscall_Reference#lv1_gpu_context_attribute
0x800000E3 - HV_Syscall_Reference#lv1_gpu_context_intr
0x800000E4 - HV_Syscall_Reference#lv1_gpu_attribute
0x800000F5 - HV_Syscall_Reference#lv1_storage_read
0x800000F6 - HV_Syscall_Reference#lv1_storage_write
0x800000F9 - HV_Syscall_Reference#lv1_storage_get_async_status

LPAR / AUTH ID's

Name Auth ID Self
(/dev_flash/ps2emu)
Notes
PS2_LPAR 0x1020000003000001 ps2_emu.self
*SCE_CELLOS_SYSTEM_MGR_PS2 0x107000001D000001
PS2_GX_LPAR 0x1020000003000001 ps2_gxemu.self
*SCE_CELLOS_SYSTEM_MGR_PS2_GX 0x107000001D000001
PS2_SW_LPAR 0x1020000003000001 ps2_softemu.self
*SCE_CELLOS_SYSTEM_MGR_PS2_SW 0x107000001D000001
PS2_NE_LPAR 0x1020000003000001 ps2_netemu.self
*SCE_CELLOS_SYSTEM_MGR_PS2_NE 0x107000001D000001

Getting compatibility hardware info

See: PS2_Compatibility#Software

ps2bootparam.dat

A file created at path: dev_hdd0/tmp/game/ps2bootparam.dat

Cobra core

taken from storage_ext.c

 patch_ps2emu_entry(ps2emu_type); 
  • sets proper ps2_(gx/soft)emu.self path for reboot
  • patches ss_storage service 0x5004 disc checks on ss_server3.self inside lv1
 (Change from Parameter li r3, 2 and li r3, 1E (Drive Authentification) to li r3, 0x29 (Reset Drive))
  • and the usual either replace read/ioctl for iso etc.

Game CONFIG

Some of the PS2 emulator types (such ps2_gxemu.self, ps2netemu.self) are able to load config commands that are applyed "by game ID". The concept of "game patches" is not technically correct because some of the commands does patching functions but others does other things (not patching), and other commands works as switches or sets a value that are enviromental settings for the emulator (not for the game) but because are applyed "by game" should be considered enviromental settings for that specific game, so for simplification purposes you can think in all this data as "game configs"

This "game config" data seems to work in the same way for all the PS2 emulator types but can be located in different places, some are hardcoded inside the emulators itself (inside the .self), and at the time the "PS2 classics" emulator (ps2_netemu.self) was developed this config can be loaded from an external file

In short, the "game configs" can modify the game image (by patching it) and can be used to configure the virtual PS2 (the emulated machine). And can be loaded from hardcoded data (inside the .self) or from an external file (this feature is supported only by ps2_netemu.self)

The config data consists in a list of concatenated values of 8 bytes lenght (uint32_t), and can be processed like this:

union{
 uint32_t command
 ...data...
}

Config Commands

ps2_netemu.self fw4.50 sub_12D7D8, fw4.81 sub_12E050
params are uint32_t unless noted.

At the time of writing this, most of the commands are completely or partially unknown.
If you want to read some speculation and brainstorming about them, please join the Discussion page

CMD ID Example Notes
0x00 Copy following title id for enforcing if available.
0x01 2x uint32_t Params ( addr, func_id 0-0x3B) - EE_ADD_HOOK
Most of 0x01 commands are strictly per game fixes, or at least per game engine. 
 [Grand Theft Auto 3 (EU)] uses 0x349790, 0x10 (somewhat floats related)
 [Max Payne] uses 0x52E9F4, 3 and 0x52EB78, 2 (set lwsync 0)
Maximum Amount of Usage: ?
(The command is used 3 times consecutively by SLUS-20565 (Champions of Norrath) and SLUS-21494 (Need for Speed Carbon)
game configs hardcoded inside ps2_gxemu.self)
Function ID Notes
0x00
0x01 FIFA 2000 use it as hook for EE kernel at 0x80001858 (DMAC related).
0x02

Max Payne sets some sync off?

0x03

Max Payne sets some sync on?

0x04 Used by Castle Shikigami II store 0 on 0x94A290 (EMU Memory)
0x05
0x06
0x07
0x08 Harry Potter - Quidditch World Cup US use it at offset 0x2BD45C (EE)
0x09 Harry Potter - Quidditch World Cup US use it at offset 0x2BD620 (EE)
0x0A
0x0B
0x0C Used by Piglet's Big Game
0x0D usleep(100)
0x0E Used 3 times in Need for Speed - Carbon [Collector's Edition] US
0x0F

GTA 3 (US)

using 0x348B40, 0x18E1F0, 0x348EC8 ( + 200000000 base )
0x348B40 = start CTheScripts::ClearSpaceForMissionEntity((CVector const &, CEntity *)) 
0x18E1F0 = start CCollision::ProcessColModels((CMatrix const &, CColModel &, CMatrix const &, CColModel &, CColPoint *, CColPoint *, float *))
0x348EC8 = Almost end (only loading values preserved on stack) of CTheScripts::ClearSpaceForMissionEntity((CVector const &, CEntity *)) 
0x10

GTA 3 (EU)

using 0x349790, 0x18E1F0, 0x349B18 ( + 200000000 base ) 
0x349790 = start CTheScripts::ClearSpaceForMissionEntity((CVector const &, CEntity *)) 
0x18E1F0 = start CCollision::ProcessColModels((CMatrix const &, CColModel &, CMatrix const &, CColModel &, CColPoint *, CColPoint *, float *))
0x349B18 = Almost end (only loading values preserved on stack) of CTheScripts::ClearSpaceForMissionEntity((CVector const &, CEntity *)) 
0x11

GTA 3 (EU different ver.)

using 0x3495C0, 0x18E1F0, 0x349948 ( + 200000000 base )
0x3495C0 = start CTheScripts::ClearSpaceForMissionEntity((CVector const &, CEntity *)) 
0x18E1F0 = start CCollision::ProcessColModels((CMatrix const &, CColModel &, CMatrix const &, CColModel &, CColPoint *, CColPoint *, float *))
0x349948 = Almost end (only loading values preserved on stack) of CTheScripts::ClearSpaceForMissionEntity((CVector const &, CEntity *)) 
0x12 Disney-Pixar's Finding Nemo use it
if condition met...
store 0 in [ 0x204FC500 + 200000000 base] 0x4FC500 EE memory
0x13
0x14
0x15
0x16
store 0x01114BA8 in [ 0x208EAB4C + 200000000 base]
store 0x010C9E40 in [ 0x208EAB6C + 200000000 base]
0x17
condition r18 == 0x8000
setting:
 stores 0x40490FDA somewhere 

Note: 0x40490FDA (3.14159250) is the highest float approximation to π in hexadecimal without going over the value.
Probably can improve FPU accuracy for some games.

0x18
condition [ 0x20183F04 + 200000000 base ] == 0x0C060F2C 
setting:
 stores 0 in address 0x20183F04, 0x20183F34, 0x20183F3C ( + 0x200000000 base )
 0x183F0C, sub_46334 (4.70)
 0x183F3C, sub_45DA4 (4.70)
 0x183D74, sub_47B50 (4.70)
0x19
0x1A
store 0 in [ 0x209FD560 + 200000000 base]
store 0 in [ 0x209F9550 + 200000000 base]
store 0 in [ 0x20A01570 + 200000000 base]
store 0 in [ 0x209F9540 + 200000000 base]
store 0 in [ 0x209F5540 + 200000000 base]
store 0 in [ 0x209F1530 + 200000000 base]
0x1B store 0 in [ 0x20552168 + 200000000 base]
0x1C store 1 in [ 0x20552168 + 200000000 base]
0x1D store 0 in [ 0x20556C08 + 200000000 base]
0x1E store 1 in [ 0x20556C08 + 200000000 base]
0x1F store 0 in [ 0x205243D8 + 200000000 base]
0x20 store 1 in [ 0x205243D8 + 200000000 base]
0x21 store 0 in [ 0x20524F88 + 200000000 base]
0x22 store 1 in [ 0x20524F88 + 200000000 base]
0x23 store 0 in [ 0x2047E7F8 + 200000000 base]
0x24 store 1 in [ 0x2047E7F8 + 200000000 base]
0x25 store 0 in [ 0x204802B8 + 200000000 base]
0x26 store 1 in [ 0x204802B8 + 200000000 base]
0x27 store 0 in [ 0x20586348 + 200000000 base]
0x28 store 1 in [ 0x20586348 + 200000000 base]
0x29 store 0 in [ 0x205868A8 + 200000000 base]
0x2A store 1 in [ 0x205868A8 + 200000000 base]
0x2B
0x2C Shin Onimusha - Dawn of Dreams Fix ingame IPU runtime - JPN/US release bug
0x2D Shin Onimusha - Dawn of Dreams Fix ingame IPU runtime - PAL release bug
0x2E
0x2F condition [ 0x37B0C4 + 200000000 base ] == 0 -> 00 10 0B 98
0x30 condition [ 0x37B704 + 200000000 base ] == 0 -> 00 10 0B 98
0x31 condition [ 0x37630C + 200000000 base ] == 0 -> 00 10 0B A8
0x32 condition [ 0x37BB0C + 200000000 base ] == 0 -> 00 10 0B A8
0x33
0x34 not filled
0x35
0x36
0x37
0x38
0x39
0x3A
0x3B GTA 3 (JP/AS) ? using 0x351210, 0x18F590, 0x351568 ( + 200000000 base )
0x02 1 Param, Config file revision ?
0x03 0 Param, sets something 0 (Fire Pro Wrestling Returns)
0x04 1 Param uint32_t index (i*0x80, special 0x12345: 0x91a280?)
0x05 read next command
0x06 0 Param, sets something 0x14F80 (85888'd)
0x07 1 Param uint32_t (default 1)
Delay VU xgkick by X cycles
0x08 8 Param uint32_t (read mask,read mask, original opcode, original opcode, write mask, write mask, replace opcode, replace opcode)
Maximum Amount of Usage: 3 times
Patch VU memory by mask 
0x09 uint32_t count, <list> (offset, original opcode, original opcode, replace opcode, replace opcode) - EE_INSN_REPLACE64
  [Dark Cloud] uses 1
  [Dead Or Alive 2 Hardcore] uses 1
Maximum List Count: 32
0x0A uint32_t count, <List> (offset, original opcode, replace opcode) - EE_INSN_REPLACE32
  [Deadly Strike] uses 1
  [Dragon Force] uses 2
Maximum List Count: 32
0x0B 1 Param uint32_t count, <List> {sector id, offset, sizeof present opcodes, replace opcodes, original opcodes} - MECHA_SET_PATCH
offset on disc = sector id * sector size + offset (-0xC for DVD, -0x18 for CD [raw 2352 sector size])
 [Dead Or Alive 2 Hardcore] uses 7
 [Gradius V] uses 1
 [Grand Theft Auto III] uses 1
 [Katamari Damacy] uses 1
 [Manhunt] uses 1
 [Odin Sphere] uses 2
 [Primal] uses 1
 [Psychonauts] uses 1
 [Syphon Filter The Omega Strain] uses 1
Maximum List Count: 47
0x0C 1 Param (uint16_t, uint16_t) --- 0/1/2,<0x63>
0x0D 1 Param, true/false
Default Init = 1?
0 == skip some code, 
1 == some code + checks
0x0E 1 Param offset --- Improves ADD/SUB accuracy for selected offset (incl. Floats)
 [Rygar] only has 0x147DA8 sub.s   $f12, $f20, $f12
Used in official configs: SCUS97501=0x3C458C, SCES53642=0x3C4854, SLUS21026=0x386864, SLUS20916=0x121F64, SLUS20437=0x11EDF0
Maximum Amount of Usage: 31 times
0x0F List <uint32_t Param, uint32_t Param> --- More accurate memory range (FPU mul/div/sub/add accuracy related)
 [Dark Cloud] uses 0x239334, 0x1FFFFFF
 [Grand Theft Auto SA] uses 0x1E46DC, 0x1E4AE8
Maximum List Count: 31 
0x10 List <uint32_t Param, uint32_t Param> --- More accurate memory range (COP2, mul/div/sub/add accuracy related) - MULDIV_Accurate_range
Maximum List Count: 31 
0x11 1x uint32_t Param. ADD/SUB accuracy related, all emulated ADD/SUB instruction variations check that value. Param seems to be VU memory offset (need confirmation).
Used in official configs: SLUS21172=0x208, SLUS20878=0x140,0x368,0x570
Maximum Amount of Usage: 31 times
0x12 <List> (uint32_t count,
 [Primal] uses 0xD
 [Rayman Arena] uses 0x11
 [Syphon Filter: The Omega Strain] uses 0x5
00 00 00 0?
00 00 00 00
type? count?
...  
Maximum List Count: 63 
0x13 1x uint64_t Param - Memory card timing related
Jak X: Combat Racing uses 0xf960 (63840)
Netsu Chu! Pro Yakyuu 2004 uses 0xf960 (63840)
Phantasy Star Universe uses 0x9bdc (39900)
WRC II Extreme uses 0x9bdc (39900)
Burnout Dominator uses 0x9bdc (39900)
Jissen Pachi-Slot Hisshouhou! Kemono-Oh uses 0x1d394 (119700)
Used in official configs: SCUS97429=0xF960(63840), SLPM66031=0x9BDC(39900), SLPS20131=0x1D394(119700)
0x14 0 Param, sets something 1
0x15 4 1 Param ( <1, >1 ), different settings/mode?
[Bloodrayne 2] uses 4
[GRIMgRiMoiRe] uses 4
[Mana Khemia 2] uses 4
[Odin Sphere] uses 4
[SMT Persona 3 FES] uses 4
0x16 = 0x05 (next id)
0x17 1 1 Param, true/false?
[Bully] uses 1
0x18 = 0x16 = 0x05 (next id)
0x19 0 Param, sets something 1 --- SB_SIO2 related?
[Grand Theft Auto III]
[Red Faction 2]
[Siren]
0x1A 0 Param, sets something 1
0x1B 0 Param, sets something 1
[Mana Khemia 2]
0x1C read uint32_t (use uint8_t) Param (default 3)
0x1D read uint32_t (use uint8_t) Param
0x1E read uint32_t (use uint8_t) Param
0x1F uint32_t Param (default 0x3E8?)
0x20 uint64_t Param (default 0x3C)
Config value is used as multiplier for some value, and result is used in vsync related runtimes.
Is worth to note that 0x3C is default multiplier even for PAL titles, so is not stricly related to framerate,
but to vsync counters (where 0x3C is still wrong anyway..). Result of multiply is also compared at some point to vsync delay value. 
0x21 1 1 Param:
0 = sets an option from 1 to 0 and another one to 0,
1 = sets an option from 1 to 0 and another one to 1,
2 = sets an option from 1 to 1 and another one to 0
 [Fatal Frame II] uses 0
 [Grand Theft Auto Vice City] uses 1
 [Grand Theft Auto III (EU)] uses 1
 [SMT Persona 3 FES] uses 0
0x22 0 Param, sets something 1
0x23 0 Param --- memcpy 0x100 Bytes and sets 0x14E00
0x24 uint64_t Param
0x25 = 0x18 = 0x16 = 0x05 (next id)
0x26 List <uint32_t Param,uint32_t Param> --- Improves ADD/SUB accuracy for selected memory range (incl. Floats) - FPU_Accurate_range
 [Bloodrayne 2] uses 0x340000, 0x350000
 [Gradius V] uses 0x3046E0, 0x0x305E44
Maximum List Count: 31 
Maximum Amount of Usage: ??
 The command is used 4 times consecutively by [Strawberry Shortcake: The Sweet Dreams]
  SLES-54309 (EU) and
  SLUS-21497 (US) game configs hardcoded inside ps2_gxemu.self
0x27 List <uint32_t Param,uint32_t Param> --- Improves COP2 operations accuracy for selected memory range - VU0 macromode accurate range
Maximum List Count: 31 
0x28 1x uint32_t Param (<=3)
0x29 2x uint32_t Param,
0x2A 0 Param, sets something 1 --- Allow online downloadable content (HDD)? Multitap? Local 2 player?
All-Star Baseball 2004
0x2B 0 Param, sets something 1 --- Allow disc eject/swap?
Dance Factory
0x2C 1 Param, uint32_t
Summoner uses 0x1
0x2D = 0x25 = 0x18 = 0x16 = 0x05 (next id)
0x2E 1 Param, uint32_t
0x2F 1 Param, uint32_t --- SPU2 related?
Indigo Prophecy/Fahrenheit uses 0x1 
0x30 (nothing)
0x31 (nothing)
0x32 (nothing)
0x33 (nothing)
0x34 (nothing)
0x35 0 Param --- Enables Force Flip Field, described in emu setting as "Fix for [Hang] for soft-lock"
0x36 (nothing)
0x37 (nothing)
0x38 (nothing)
0x39 (nothing)
0x3A (nothing)
0x3B (nothing)
0x3C (nothing)
0x3D 1 Param, uint32_t Config file revision
Firmware ps2_netemu Revision Max Supported Commands
3.70 15686 0x41
3.73 15936 0x41
3.74 15936 0x41
4.00 16195 0x41
4.01 16195 0x41
4.10 16361 0x41
4.11 16361 0x41
4.20 16604 0x43
4.21 16604 0x43
4.23 16604 0x43
4.25 16740 0x43
4.26 16740 0x43
4.30 16808 0x45
4.31 16808 0x45
4.40 16916 0x46
4.41 16916 0x46
4.45 17041 0x48
4.46 17041 0x48
4.50 17179 0x4A
4.55 17277 0x4D
4.60

4.70
4.75
4.76

17314 0x4D
4.78

4.80
4.81

17495 0x50
0x3E 0 Params --- Sets something 1
Default Init = 0
0 == do set some stuff, 
1 == skip
Similar to 0x0D with param 0. Affect the same code path, but skips more code. 
0x3F 1 Param, uint32_t
0x40 0 Param --- Sets something 1
Grand Theft Auto SA
Silent Hill Origins - unofficial fix
0x41 0 Param --- Sets something 1 (Disables some lwsync - speedhack?)
Dragon Force
God Hand
Gradius V
Katamari Damacy
0x42 EE Overlay patch. 2 main Params + patch data: uint32_t address, uint32_t count, opcode,opcode,opcode...
Address need to be in 0xFF000 - 0xFFFFC range.
Count is size of patch in 4 bytes opcodes. So 5 opcode patch = count 5.
Opcodes will be placed on selected address, we use only patch code, no need for original opcode.
Next opcode addresses are auto calculated (+4..) so we need to specify only patch start address.
Remember we need to jump to our new code, best way is command 0x0A with j (jump) opcode.
Also is important to add return jump if required. That one need to be added in our 0x42 patch.  
Maximum opcodes count seems to be 0x3FF (1023 opcodes).
0x43 1 Param --- Equal to 0x40, but with Parameter:
0 = Default
1 = (like 0x40)
param = 
-1 = failure?
0x44 0 Param --- Disables Smoothing and Smoothing option
0x45 0 Param --- Sets something 1
Phantasy Star Complete Collection
0x46 0 Param --- Enables L2H Improvement, [Performance] related setting for titles using L2H
SMT Digital Devil Saga 1
SMT Nocturne
Fatal Frame II
0x47 0 Param --- Enables XOR CSR - XOR System Status Register (0x12001000)?, [Graphics] related setting, should fix fullscreen line corruption
0x48 VSYNC Delay, 2x uint32_t Param
  • First param possible value are 1 = No IPU, 2 = IPU, 3 = Anytime.
  • Second param is delay (in ms?), and can be also negative value.
    • Emu has standard presets for second param.
      • Agressive = 0x3D090 (250000 decimal),
      • Normal = 0x186A0 (100000 decimal),
      • Conservative = 0x4E20 (20000 decimal),
      • But other values can be used.
[SMT Digital Devil Saga 1] uses 1, 0x3D090
[Fatal Frame II] uses 0x2, 0xFFFFE69C (-6500 decimal)
0x49 0 Param --- Sets something 0xB,0,0
0x4A 0 Param --- Sets something 0x15100
0x4B Redirect SAVEDATA by ID, 2 x uint32_t Params + ID: offset, int, char[12]
For proper config we need at least 2 (can be more if needed) 0x4B commands, one to enable redirect, one to disable.
First param is EE memory offset that when is hit enable/disable redirection.
Second param is partially unknown, seems to be size of next param to read * 4 (3 in known configs), or 0xFFFFFFFF for disable redirect command.
Third param is ID of SAVEDATA we want to use padded with 00 to match 12 bytes, or all 00 in disable redirect config.
Important note here is that config have own 00 00 00 00 terminator at the end. 
So after 12 bytes of ID we need to add 4 bytes of 00. That apply also to disable redirect version.
0x4C 2x uint32_t Params: offset,int (2 = current path?, 3 = new ISO.BIN.ENC path?, other= ?)
0x4D 1 uint32_t Param (can be -1) --- Sets something (same as 0x49 but) 0xC, Param, 0
0x4E (nothing)
0x4F (nothing)
0x50 0 Param --- Enables pressure sensitive controls

Config file examples (for netemu)

Official PS2 Classic

See: PS2 Official Configs

Official GXEMU/SOFTEMU extracted

See: PS2 Official Configs

Custom Configs

See: PS2 Custom Configs

Config data examples (hardcoded)

Inside ps2_emu.self

Embedded patches are based on Checksum/Hash of title. ps2_emu is only emulator version where patches are described inside self file in ascii. Known patch types described in ascii are: Patch data, new SPU2 params, and Setting mecha HACK to show GODZCD as GODZCDDA.

PS2 Title Hash Game Patch Type Data
SCUS_971.46 0x6B1ADE00D Disney's Treasure Planet Patch data - Fixes black screen at start, it apply to STREAM_D.IRX file in IOP folder. 0x147C (sector) , 0x580 (offset) (- 0xC on disc)
Replace opcodes
00 01 01 3C	lui	at,0x0100
80 BF 03 3C 	lui	v1,0xBF80
C8 10 63 8C	lw	v1,0x10C8(v1)
24 18 61 00	and	v1,at
FB FF 61 10	beq	v1,at, -0x10
00 00 00 00 	nop	

Original opcodes
FF FF 01 24	li	at,-0x1
04 00 61 14 	bne	at,v1, +0x14
00 80 01 3C	lui	at,0x8000
02 00 41 14	bne	at,v0, +0x0C
00 00 00 00	nop	
0D 00 06 00 	break   
SLUS_201.74 0x23D92589C5 Rumble Racing Patch data - fixes black screen after Playstation 2 logo. Patch apply to AUDIO.IRX file in MODULES folder 0x3AEDA (sector), 0x120 (offset)
Replace opcodes
06 00 80 14	bnez	a0, +0x1C
21 20 43 00 	addu	a0,v0,v1
21 10 A0 00	move	v0,a1
02 00 A0 14 	bnez	a1, +0x0C
00 00 00 00	nop	
01 00 05 24 	li	a1,0x1
EB FF 40 10	beqz	v0, -0x50
04 00 84 24 	addiu	a0,0x4
FC FF 90 24	addiu	s0,a0,-0x4
	
Original opcodes
07 00 80 14	bnez	a0, +0x20
21 80 43 00 	addu	s0,v0,v1
21 10 A0 00	move	v0,a1
02 00 A0 14	bnez	a1, +0x0C
00 00 00 00	nop	
01 00 05 24 	li	a1,0x1
FC FF 40 10	beqz	v0, -0x0C
00 00 00 00	nop	
04 00 04 26	addiu	a0,s0,0x4
	
SLUS_211.96 0x24D92589D5 Indigo Prophecy new SPU2 params 1
SLPM_661.93 0x608634992D Fahrenheit (NTSC-J) new SPU2 params 1
SLUS_212.96 0x5CA15DF14D Dance Factory Setting mecha HACK to show GODZCD as GODZCDDA

Inside ps2_gxemu.self/ps2_softemu.self

There are hundreds of configs hidden in ps2_gxemu, and ps2_softemu self files. Internal config structure is basing on custom hash based on Title ID, internal memory offset pointing to place where true patch instruction is, and count of used commands. When disc/iso is started emulator search for configs, and if config for selected ID exist, then emulator apply it by itself. Is not perfect way of applying patches, because some games use the same ID, but different content. Good example here is Star Wars Battlefront II SLUS-21240, where some versions of game can refuse to work because it apply bad patch.

PS2 Title Hash Game Patch Type Data

Known Emulation Bugs

This list known bugs inside emulator code that make emulation inaccurate. Since those are only EE side bugs for now, ps2_gxemu/ps2_netemu/ps_softemu share the same issues.

Bug Description Known Affected Games
Missing Emotion Engine Cache emulation Emulating that is literally not possible without making games run at 3 fps. Fixed by patches to game image, or EE code. Ice Age 2, DOA2: Extreme, Nascar 2009 (luckily fixed by instant VIF bug).
Branch delay slot violation not supported on EE Some games have Branch instruction inside Branch delay slots, this is not emulated correctly on EE (VU have proper emulation of that). This is patched in configs by rearangging MIPS code. WRC 3,4,Rally Evolved, one of Action Replay discs.
VIF is instant There is no correct timing, or even attempt to emulate that. Everyting done by VIF0/1 is done right when pushed Nascar 2009 is affected in possitive way, game don't have time to corrupt transfer. Probably many more games.
XGKick is instant Some games expect to XGKick happen few cycles in future, on PS3 is done instant. Fixed by config 0x07 which delay XGKick by selected value WRC series, Wakeboarding Unleashed, TriAce games, World of Outlaws - Sprint Cars, Ty - The Tazmanian Tiger, dot Hack - G.U. series, and more
COP2 instructions are instant Some games rely on fact that COP2 operations can take some time, on PS3 emulators they are done instantly due to lack of correctly emulated pipeline Patched by rearranging mips code FFX, FFX-2, Ghost in The Shell SAC, Ace Combat series, Sprint Cars 1/2, Black, Run Like Hell, Everblue 2, Dragon Quest - Shounen Yangus no Fushigi na Daibouken, and many more
VU0 is not running in sync with EE core Seems like old pcsx2 mVU approach is used where VU0 is running thousands of cycles ahead of EE. Partially resolved on emu using 0x12 command with 2/3 subcommands. 24 The Game, ATV Quad Power Racing 2, Twisted Metal Head-On, Primal, Ghosthunter, Rayman Arena, Rayman 3, All games using M-bit.
M-Bit not supported Emulator ignore VU0 M-Bit, that cause issues for games that need it to work correctly. This is done because there is no way to sync correctly running VU0 without sync with EE. Partially resolved on emu using 0x12 command with 2/3 subcommands. Totally Spies, Mike Tyson Heavyweight Boxing, My Street, Crash Twinsanity, Marvel Nemesis, Panzer Elite Action - Fields of Glory, TriAce games (speed optimizations only), Super Monkey Ball Adventure, most Eko Software games, and many more.
Emulator Fail to save correct flag instances while ending VU0 program on Ebit This cause few games to read bad flag status (not status flag!) on COP2. This is resolved on emu by forcing update of MAC flag on every STATUS flag read (by config 0x12), this cause slowdowns creating a lot of unnesessary operations. Driving Emotion Type-S, State of Emergency 2, The Getaway Black Monday.
Not updated status flag when VDIV/VSQRT/VRSQRT is done on COP2 Potential bad flag state can cause a lot of issues that are not related on first sight Yanya Caballista (already patched by custom config)
In corner cases emu select wrong block pipeline state while processing Flag VU opcodes. This can cause various issues, mostly SPS, missing graphic, specific slowdowns, etc. For now it was only confirmed that FSAND opcode don't ask for exact pipeline state, but looking at assembly of other opcode this rather affect all of them. Tales of Legendia, more..

TitleID/DiscID in ps2_netemu.self

There are 193 titleIDs listed inside ps2_netemu.self. More precisely, into XPARAM2.ELF file of PS2 Bios included in ps2_netemu.self. XPARAM2.ELF is called by OSDSYS, then ID check is performed. If title ID match to one of included in the table, different IOP emulation settings are applied. There are internal flags related to every title ID included inside file, still unknown what they do. Also some arguments, in plain text. File in real ps2 is introduced in SCPH-750XX models so exactly when DECKARD Power PC chip exchanged original IOP chip. This can explain why it is still in PS3 netemu bios. Because PS3 it is ppc that can need the same/similar flags.

Original PS2 bios include similar list file called XPARAM.ELF, but Title IDs there are not the same, although some of them exist on both lists.

Command Name
0x00 TITLE_MASK
0x01 SIO2_MASK
0x02 DEV9_MASK
0x03 USB_MASK
0x04 SIF_DMA_SYNC
0x05 SIF_DMA_LOAD
0x06 DMAC_CH10_INT_DELAY
0x07 MECHA_RECOGTIME
0x08 CPU_DELAY
0x09 DEV5_INT_SPEED
0x0A CDVD_READ_DELAY
0x0B SPU2_BEHAVIOR
ID Title Command Value Remarks
PBPX_952.01 DVD Utility Disc Version 1.00 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PBPX_952.02 DVD Utility Disc Version 1.01 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PBPX_952.03 DVD Utility Disc Version 1.01 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PBPX_952.06 DVD Player (Version 2.01) 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PBPX_952.07 DVD Player (Version 2.10) 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PBPX_952.08 DVD Player (Version 2.10) 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PBPX_952.09 DVD Player (Version 2.10) 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PBPX_952.10 DVD Utility Disc Version 2.10 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PBPX_952.11 DVD Utility Disc Version 1.00 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PBPX_952.21 DVD Player (Version 2.12) 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PBPX_952.22 DVD Player (Version 2.14) 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PBPX_952.24 DVD Player (Version 2.16) 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PBPX_952.28 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PBPX_952.35 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PBPX_952.39 Online Start Up Disc v3.0 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PBPX_955.01 Linux for PS2 Beta Release 1 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PBPX_955.07 Playstation 2 Linux Runtime Environment v1.0 (Disc 1) 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PBPX_955.09 Linux for PS2 Release 1.0 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PBPX_955.18 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PDPX_991.09 DVD Player (Version 3.04) 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PSXC_002.01 PSX Update Disc 1.10 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PSXC_002.02 PSX Update Disc 1.20 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PSXC_002.03 PSX Update Disc 1.31 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
PTPX_970.38 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
SCAJ_201.25 Tekken 5 0x0B 0x40000000 SPU2_BEHAVIOR
SCAJ_201.26 Tekken 5 0x0B 0x40000000 SPU2_BEHAVIOR
SCES_532.02 Tekken 5 0x0B 0x40000000 SPU2_BEHAVIOR
SCKA_200.49 Tekken 5 0x0B 0x40000000 SPU2_BEHAVIOR
SCPM_621.15 0x00 0x1000000 TITLE_MASK
SCPM_621.16 0x00 0x1000000 TITLE_MASK
SCPN_601.01 PlayStation BB Navigator (Version 0.10) 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
SCPN_601.30 PlayStation BB Navigator (Version 0.20) 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
SCPN_601.40 PlayStation BB Navigator (Version 0.30) 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
SCPN_601.50 PlayStation BB Navigator (Version 0.31) 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
SCPN_601.60 PlayStation BB Navigator (Version 0.32) 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
SCPS_110.01 I.Q. Remix 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
SCPS_110.10 Yoake no Mariko (Performance Pack Edition) 0x01 0x1800 SIO2_MASK
SCPS_110.18 Yoake no Mariko 0x01 0x1800 SIO2_MASK
SCPS_110.21 Yoake no Mariko 2nd Act (Limited Edition) 0x01 0x1800 SIO2_MASK
SCPS_110.22 Yoake no Mariko 2nd Act 0x01 0x1800 SIO2_MASK
SCPS_150.38 Lifeline 0x0A 0x80300 CDVD_READ_DELAY
SCPS_150.39 Lifeline 0x0A 0x80300 CDVD_READ_DELAY
SCPS_170.01 Gran Turismo 4 0x0B 0x10000000 SPU2_BEHAVIOR
SCPS_175.01 Linux (for PlayStation2) Release 1.0 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
SCPS_200.39 0x00 0x4000000 TITLE_MASK
SCUS_971.67 PaRappa the Rapper 2 0x04 0x2000 SIF_DMA_SYNC
SCUS_972.69 Final Fantasy XI [Disc 2] 0x02 0xB DEV9_MASK
SLES_500.48 Donald Duck: Quack Attack 0x01 0x800 SIO2_MASK
SLES_500.62 Orphen: Scion of Sorcery 0x08 0xC1C CPU_DELAY
SLES_503.64 City Crisis 0x0A 0x80BB8 CDVD_READ_DELAY
SLES_504.46 Shadow Man 2: The Second Coming 0x0A 0x80600 CDVD_READ_DELAY
SLES_505.40 Simpsons: Road Rage 0x01 0x800 SIO2_MASK
SLES_506.08 Shadow Man 2: The Second Coming 0x0A 0x80600 CDVD_READ_DELAY
SLES_506.28 Simpsons: Road Rage 0x01 0x800 SIO2_MASK
SLES_507.28 Tiger Woods PGA Tour 2002 0x0A 0x803E8 CDVD_READ_DELAY
SLES_507.29 0x0A 0x803E8 CDVD_READ_DELAY
SLES_512.82 Tiger Woods PGA Tour 2003 0x0A 0x803E8 CDVD_READ_DELAY
SLES_514.79 Def Jam Vendetta 0x01 0x802 SIO2_MASK
SLES_518.41 SpyHunter 2 0x01 0x800 SIO2_MASK
SLES_518.44 Time Crisis 3 0x01 0x800 SIO2_MASK
SLES_519.97 SWAT: Global Strike Team 0x01 0x800 SIO2_MASK
SLES_520.97 SWAT: Global Strike Force 0x01 0x800 SIO2_MASK
SLES_530.37 Super Monkey Ball Deluxe 0x01 0x802 SIO2_MASK
SLES_536.68 Micro Machines v4 0x01 0x801 SIO2_MASK
SLES_537.55 Castlevania: Curse of Darkness 0x04 0x10 SIF_DMA_SYNC
SLES_537.96 FIFA Street 2 0x01 0x1800 SIO2_MASK
SLPM_620.42 Kurogane no Houkou: Warship Commander 0x01 0x3000 SIO2_MASK
SLPM_620.62 Gitaroo Man One 0x0A 0x80540 CDVD_READ_DELAY
SLPM_621.05 Taikou Risshiden IV 0x09 0x2B47000A DEV5_INT_SPEED
SLPM_621.24 Ready 2 Rumble Boxing: Round 2 0x08 0x1388 CPU_DELAY
SLPM_621.25 Gauntlet: Dark Legacy 0x08 0xC1C CPU_DELAY
SLPM_621.25 Gauntlet: Dark Legacy 0x09 0x2B470005 DEV5_INT_SPEED
SLPM_621.35 Final Fantasy: XI (Beta Version) 0x00 0xA0000000 TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag
SLPM_621.54 DDRMAX Dance Dance Revolution 6thMix 0x08 0x1A5E CPU_DELAY
SLPM_622.39 Supercar Street Challenge 0x0A 0x80300 CDVD_READ_DELAY
SLPM_623.69 Karaoke Revolution: J-Pop Vol.1 0x08 0x1388 CPU_DELAY
SLPM_623.79 Karaoke Revolution: J-Pop Vol.2 0x08 0x1388 CPU_DELAY
SLPM_623.80 Karaoke Revolution: J-Pop Vol.3 0x08 0x1388 CPU_DELAY
SLPM_623.81 Karaoke Revolution: J-Pop Vol.4 0x08 0x1388 CPU_DELAY
SLPM_623.82 Karaoke Revolution: Love & Ballad 0x08 0x1388 CPU_DELAY
SLPM_623.83 Karaoke Revolution: Night Selection 2003 0x08 0x1388 CPU_DELAY
SLPM_624.14 Karaoke Revolution: Dreams & Memories 0x08 0x1388 CPU_DELAY
SLPM_624.37 Suisui Sweet: Amai Ai no Mitsukekata 0x0B 0x40000000 SPU2_BEHAVIOR
SLPM_624.50 Karaoke Revolution: Anime Song Selection 0x08 0x1388 CPU_DELAY
SLPM_624.51 Karaoke Revolution: J-Pop Vol.5 0x08 0x1388 CPU_DELAY
SLPM_624.54 Karaoke Revolution: J-Pop Vol.6 0x08 0x1388 CPU_DELAY
SLPM_624.55 Karaoke Revolution: J-Pop Vol.7 0x08 0x1388 CPU_DELAY
SLPM_624.56 Karaoke Revolution: J-Pop Vol.8 0x08 0x1388 CPU_DELAY
SLPM_624.57 Karaoke Revolution: Snow & Party 0x08 0x1388 CPU_DELAY
SLPM_624.64 Pop'n Taisen Pazurudame Online 0x08 0x1F40 CPU_DELAY
SLPM_624.79 Karaoke Revolution: J-Pop Vol.9 0x08 0x1388 CPU_DELAY
SLPM_624.91 Mega Man: The Power Battle 0x04 0x2000 SIF_DMA_SYNC
SLPM_624.92 Karaoke Revolution: Kids Song Selection 0x08 0x1388 CPU_DELAY
SLPM_625.28 Karaoke Revolution: Kazoku Idol Sengen (Bundle Edition) 0x08 0x1388 CPU_DELAY
SLPM_625.29 Karaoke Revolution: Kazoku Idol Sengen 0x08 0x1388 CPU_DELAY
SLPM_650.86 A Visual Mix: Ayumi Hamasaki Dome Tour 2001 (Disc 1) 0x08 0x1450 CPU_DELAY
SLPM_650.87 A Visual Mix: Ayumi Hamasaki Dome Tour 2001 (Disc 2) 0x08 0x1450 CPU_DELAY
SLPM_650.90 Spy Hunter 0x01 0x1800 SIO2_MASK
SLPM_651.97 Nobunaga's Ambition Online 0x02 0xB DEV9_MASK
SLPM_652.09 Star Ocean: Till the End of Time 0x0B 0x20014 SPU2_BEHAVIOR
SLPM_654.38 Star Ocean: Till the End of Time (Director's Cut) (Disc 1) 0x0B 0x20014 SPU2_BEHAVIOR
SLPM_654.39 Star Ocean: Till the End of Time (Director's Cut) (Disc 2) 0x0B 0x20014 SPU2_BEHAVIOR
SLPM_654.88 Grand Theft Auto: Vice City 0x0A 0x300 CDVD_READ_DELAY
SLPM_654.88 Grand Theft Auto: Vice City 0x09 0x36000200 DEV5_INT_SPEED
SLPM_656.33 I Love Baseball: Pro Yakyu wo Koyonaku 0x08 0xFA0 CPU_DELAY
SLPM_656.98 Love Songs: ADV Futaba Riho 14-sai Natsu 0x0A 0x80380 CDVD_READ_DELAY
SLPM_657.05 Final Fantasy XI: Chains of Promathia (Expansion Disc) 0x02 0xB DEV9_MASK
SLPM_657.06 Final Fantasy XI: Chains of Promathia (All-In-One Edition) 0x02 0xB DEV9_MASK
SLPM_657.19 Burnout 3: Takedown 0x01 0x1C00 SIO2_MASK
SLPM_657.83 Nobunaga no Yabou Online: Tappi no Shou 0x02 0xB DEV9_MASK
SLPM_658.94 Winning Post 6: 2005 Version 0x01 0x2400 SIO2_MASK
SLPM_659.34 Maple Colors 0x0A 0x80300 CDVD_READ_DELAY
SLPM_659.53 Final Fantasy: XI (Entry Disc 2005) 0x02 0xB DEV9_MASK
SLPM_659.84 Grand Theft Auto: San Andreas 0x0A 0x803E8 CDVD_READ_DELAY
SLPM_660.33 The Sword of Etheria 0x08 0xC1C CPU_DELAY
SLPM_660.33 The Sword of Etheria 0x00 0x2000000 TITLE_MASK
SLPM_660.48 The Sword of Etheria 0x08 0xC1C CPU_DELAY
SLPM_660.48 The Sword of Etheria 0x00 0x2000000 TITLE_MASK
SLPM_660.57 Taito Memories Vol.1 0x08 0xCE4 CPU_DELAY
SLPM_661.56 Marheaven: Arm Fight Dream 0x01 0x1800 SIO2_MASK
SLPM_661.75 Akumajo Dracula: Yami no Juin 0x08 0x60 CPU_DELAY
SLPM_661.75 Akumajo Dracula: Yami no Juin 0x0B 0x2001C SPU2_BEHAVIOR
SLPM_663.93 Final Fantasy XI: Treasures of Aht Urhgan (All-In-One Edition) 0x0A 0x803E8 CDVD_READ_DELAY
SLPM_663.93 Final Fantasy XI: Treasures of Aht Urhgan (All-In-One Edition) 0x09 0x2B47000A DEV5_INT_SPEED
SLPM_663.93 Final Fantasy XI: Treasures of Aht Urhgan (All-In-One Edition) 0x02 0xB DEV9_MASK
SLPM_663.94 Final Fantasy XI: Treasures of Aht Urhgan 0x02 0xB DEV9_MASK
SLPM_664.36 Aria the Natural 0x01 0x1800 SIO2_MASK
SLPM_664.36 Aria the Natural 0x00 0xA000000 TITLE_MASK
SLPM_665.39 Nobunaga no Yabou Online: Haten no Shou 0x02 0xB DEV9_MASK
SLPM_665.58 Tomb Raider: Legend 0x08 0x3E8 CPU_DELAY
SLPM_665.74 Detective Evangelion 0x00 0x2000000 TITLE_MASK
SLPM_680.07 Karaoke Revolution (Trial) 0x08 0x1388 CPU_DELAY
SLPM_680.10 0x08 0x1388 CPU_DELAY
SLPS_200.08 Morita Shogi 0x08 0x1388 CPU_DELAY
SLPS_200.20 FIFA 2000 World Championship 0x04 0x2001 SIF_DMA_SYNC
SLPS_200.37 Go Go Golf 0x09 0x2B47000A DEV5_INT_SPEED
SLPS_200.38 Grappler Baki: Baki Saidai no Tournament 0x08 0x1194 CPU_DELAY
SLPS_200.53 Tenshi no Present: Marle Oukoku Monogatari (Limited Edition) 0x0B 0x20000000 SPU2_BEHAVIOR
SLPS_200.66 Tenshi no Present: Marle Oukoku Monogatari 0x0B 0x20000000 SPU2_BEHAVIOR
SLPS_201.01 City Crisis 0x0A 0x80BB8 CDVD_READ_DELAY
SLPS_201.11 Magical Sports Pro Baseball 2001 0x09 0x2B47000A DEV5_INT_SPEED
SLPS_201.72 Koushien: Konpeki no Sora 0x09 0x2B47000A DEV5_INT_SPEED
SLPS_201.73 Hard Hitter 2 0x0A 0x80300 CDVD_READ_DELAY
SLPS_201.97 Surfing Air Show with RatBoy 0x09 0x2B47000A DEV5_INT_SPEED
SLPS_201.99 F1 2002 0x0B 0x20005 SPU2_BEHAVIOR
SLPS_202.00 Final Fantasy XI 0x02 0xB DEV9_MASK
SLPS_204.04 Rakushou! Pachi-Slot Sengen 2 0x0A 0x80300 CDVD_READ_DELAY
SLPS_204.29 Hissatsu Pachi-Slot Evolution: Ninja Hattori-Kun V 0x08 0x1B58 CPU_DELAY
SLPS_204.55 Simple 2000 Series Vol.94: The Aka-Champion - Come on Baby 0x0B 0x40000000 SPU2_BEHAVIOR
SLPS_250.08 Sorcerous Stabber Orphen 0x08 0xC1C CPU_DELAY
SLPS_250.71 A Visual Mix: Ayumi Hamasaki Dome Tour 2001 0x08 0x1450 CPU_DELAY
SLPS_250.72 A Visual Mix: Ayumi Hamasaki Dome Tour 2001 0x08 0x1450 CPU_DELAY
SLPS_250.81 Saishuu Densha 0x0A 0x803E8 CDVD_READ_DELAY
SLPS_251.36 Kuon no Kizuna Sairin Mikotonori 0x0A 0x805DC CDVD_READ_DELAY
SLPS_251.42 Tiger Woods PGA Tour 2002 0x0A 0x803E8 CDVD_READ_DELAY
SLPS_251.50 Only You 0x0B 0x40000000 SPU2_BEHAVIOR
SLPS_252.37 Only You 0x0B 0x40000000 SPU2_BEHAVIOR
SLPS_252.75 Def Jam: Vendetta 0x01 0x802 SIO2_MASK
SLPS_252.78 Memories Off: Mix 0x0A 0x80300 CDVD_READ_DELAY
SLPS_252.90 Time Crisis 3 0x01 0x800 SIO2_MASK
SLPS_253.15 One Piece: Grand Battle 3 0x01 0x1800 SIO2_MASK
SLPS_253.57 3-Nen B-Gumi Kinpachi Sensei: Densetsu no Kyoudan ni Tate! 0x01 0x1800 SIO2_MASK
SLPS_253.79 Tokyo Majin Gakuen: Kaihoujyou Kefurokou 0x0A 0x803E8 CDVD_READ_DELAY
SLPS_254.06 Hitman: Contracts 0x08 0xDAC CPU_DELAY
SLPS_254.18 Ace Combat 5: The Unsung War 0x0A 0x500000 CDVD_READ_DELAY
SLPS_255.10 Tekken 5 0x0B 0x40000000 SPU2_BEHAVIOR
SLPS_255.85 Monster Farm 5: Circus Caravan 0x07 5 MECHA_RECOGTIME
SLPS_255.86 Tales of the Abyss 0x0A 0x803E8 CDVD_READ_DELAY
SLPS_256.04 Ar tonelico Qoga: Knell of Ar Ciel 0x00 0xA000000 TITLE_MASK
SLPS_256.67 Daito Giken Premium Pachi-Slot Collection: Yoshimune 0x01 0x1800 SIO2_MASK
SLPS_256.98 Fatal Fury Battle Archives Volume 2 0x00 0xA000000 TITLE_MASK
SLPS_257.08 The Familiar of Zero (Limited Edition) 0x0A 0x803E8 CDVD_READ_DELAY
SLPS_257.09 The Familiar of Zero 0x0A 0x803E8 CDVD_READ_DELAY
SLPS_257.21 HimeHibi - Princess Days 0x0B 0x8000000 SPU2_BEHAVIOR
SLPS_257.22 Routes PE (Limited Edition) 0x08 0x3E8 CPU_DELAY
SLPS_257.27 Routes PE 0x08 0x3E8 CPU_DELAY
SLPS_732.49 Ar tonelico Qoga: Knell of Ar Ciel (Platinum) 0x00 0xA000000 TITLE_MASK
SLUS_200.11 Orphen: Ocion of Sorcery 0x08 0x1388 CPU_DELAY
SLUS_200.11 Orphen: Ocion of Sorcery 0x09 0x8000010 DEV5_INT_SPEED
SLUS_200.77 Donald Duck: Go'in Quackers 0x01 0x800 SIO2_MASK
SLUS_202.74 City Crisis 0x0A 0x80BB8 CDVD_READ_DELAY
SLUS_203.05 Simpsons: Road Rage 0x01 0x800 SIO2_MASK
SLUS_203.64 Tiger Woods PGA Tour 2002 0x0A 0x803E8 CDVD_READ_DELAY
SLUS_204.13 Shadowman 2 0x0A 0x80600 CDVD_READ_DELAY
SLUS_204.33 SWAT: Global Strike Team 0x01 0x800 SIO2_MASK
SLUS_204.88 Star Ocean: Til the end of Time [Disc 1] 0x08 0x1388 CPU_DELAY
SLUS_205.72 Tiger Woods PGA Tour 2003 0x0A 0x803E8 CDVD_READ_DELAY
SLUS_205.90 Spyhunter 2 0x01 0x800 SIO2_MASK
SLUS_206.35 Muppets Party Cruise 0x01 0x801 SIO2_MASK
SLUS_206.39 Def Jam Vendetta 0x01 0x800 SIO2_MASK
SLUS_206.86 Splashdown: Rides Gone Wild 0x0A 0x80400 CDVD_READ_DELAY
SLUS_208.38 All-Star Baseball 2005 0x01 0x802 SIO2_MASK
SLUS_208.51 Ace Combat 5: The Unsung War 0x0A 0x500000 CDVD_READ_DELAY
SLUS_208.91 Star Ocean: Til the end of Time [Disc 2] 0x08 0x1388 CPU_DELAY
SLUS_209.18 Super Monkey Ball: Deluxe 0x01 0x800 SIO2_MASK
SLUS_210.59 Tekken 5 0x0B 0x40000000 SPU2_BEHAVIOR
SLUS_210.70 Final Fantasy XI: Chains of Promathia 0x02 0xB DEV9_MASK
SLUS_210.89 Karaoke Revolution Vol.3 0x08 0x1388 CPU_DELAY
SLUS_213.31 Sonic Riders 0x01 0x800 SIO2_MASK
SLUS_213.39 Puzzle Challenge 0x01 0x800 SIO2_MASK
SLUS_214.04 Final Fantasy XI: Treasures of Aht Urhgan 0x02 0xB DEV9_MASK
SLUS_214.52 Valkyrie Profile 2: Silmeria 0x08 0x1388 CPU_DELAY

Other game patches (unofficial)

There are other unofficial ways to patch the PS2 games such the pnach format, or the widescreen patches that allows 16:9 screen output for some games by hex editing the ISO, or by applying ppf patches. Games work fine on PS3 with same compatibility like before patching. Also some 480p (aka progressive scan) patches work fine. http://ps2wide.net/

The problem of this methods is the patch is applyed over the ISO and is modifyed permanently, but this problem can be avoided in PS3 because that unofficial patches can be "ported" to the official config format to be used by ps2_netemu.self, by using the official config format the settings and patchs from the config file are applyed "on the fly" and the ISO is not modifyed

ps2_title_brute code

A script to calculate whatever this encode is that is used in ps2emu, gxemu and softemu from given input title id.

It contains code for bruting as well. Just call gen_sum with the title id in a specific format to get it.

title_ = "SLUS_200.73"

#patches = [0x6b1ade00dL, 0x23d92589c5L, 0x24d92589d5L, 0x608634992dL, 0x5ca15df14dL]
#patches = [0x37ae1cb18dL, 0x608634999dL, 0x06b1ade00dL, 0x5fc674d915L, 0x178e3c9165L, 0x3889349935L,0x18fe4ce145L,0xc126943985,0xe90ebc11b5,0x58be0ca165L]
patches = [ 0xCD1298155L, 0x12C93199A5L, 0x15C93199ADL, 0x24D92589A5L, 0x2CD12D8125L, 0x34C9359935L, 0x34C93599E5L, 0x34C93599E5L, 0x449961C9E5L, 0x4C9169C1CDL, 0x4C9169C1D5L, 0x4C9169C1DDL, 0x4C9169C1E5L, 0x4C9169C1F5L, 0x4C9169C1FDL, 0x4CB14DE12DL, 0x54A955F915L, 0x5CA15DF165L, 0x5CA15DF1FDL, 0x5CA15DF1FDL, 0x649965C94DL, 0x649965C955L, 0x649965C95DL, 0x649965C965L, 0x649965C96DL, 0x6BB149E15DL, 0x6C916DC165L, 0x6C916DC1A5L, 0x6C916DC1ADL, 0x6C916DC1B5L, 0x6C916DC1D5L, 0x6C916DC1DDL, 0x748975D9DDL, 0x7C817DD125L, 0x7C817DD165L, 0x7C817DD16DL, 0x7C817DD175L, 0x7C817DD1CDL, 0x84798529BDL, 0x8559A109ADL, 0x8579852915L, 0x8579852965L, 0x8D51A90145L, 0x8D51A901B5L, 0x8D51A901BDL, 0x8D718D21BDL, 0x9C619D31E5L, 0x9D41B911ADL, 0x9D619D31C5L, 0x9F29357805L, 0x9F293578E5L, 0xB549B51915L, 0xB549B51925L, 0xB549B5195DL, 0xB549B519A5L, 0xB549B519ADL, 0xBC61793025L, 0xBD41BD1105L, 0xC439C569F5L, 0xC7716D20D5L, 0xC7716D20D5L, 0xCA11E941F5L, 0xCF7965285DL, 0xCF7965285DL, 0xD20911582DL, 0xD7617D308DL, 0xE339C1695DL, 0xE794CCB06DL, 0xEA3129608DL, 0xEC11ED4115L, 0xEF594508D5L, 0xF409F559ADL, 0xF7415D10E5L, 0xF7415D10E5L]

def gen_sum(title):
        var_30 = []
        for i in range(0x1A):
                var_30.append(0)
        r9=5
        r31=0
        #Title 2 decimal
        while r9 != 0xB:
                r11 = r9 + 1
                if r9 == 8:
                        pass
                else:
                        r5 = ord(title[r9:r9+1])
                        r7 = r31 * 0xA
                        r6 = r7 & 0xFFFFFFFF
                        r4 = r5 + r6
                        r9 = r4 - 0x30
                        r31 = r9 & 0xFFFFFFFF
                r9 = r11
        #print r31
        r10 = ord(title[3:4]) # S
        r7 = (r31 >> 10) & 0x7F
        r11 = ord(title[1:2]) # L
        r8 = ord(title[2:3])  # U
        r6 = (r10 >> 1) & 0x3F
        r12 = ord(title[0:1]) # S
        r4 = (r11 >> 3) & 0xF
        r5 = (r8 >> 2) & 0x1F
        r3 = (r12 >> 4) & 7
        r9 = r10 << 7
        r0 = r8 << 6
        r10 = r11 << 5
        r8 = r12 << 4
        r12 = r31 << 3
        r11 = r10 | r5
        r9 = r9 | r7
        r0 = r0 | r6
        var_30[2] = r11 & 0xFF
        r7 = r8 | r4
        var_30[0] = (r9 & 0xFF)
        r10 = r12 | r3
        var_30[1] = (r0 & 0xFF)
        r12 = (r31 >> 2) & 0x3FFFFFF8
        var_30[3] = (r7 & 0xFF)
        r8 = 5
        var_30[4] = (r10 & 0xFF)
        var_30[0x19] = (r12 & 0xFF)
        var_30[0x18] = (r8 & 0xFF)
        var_30 = [int(v) for v in var_30]
        #print [hex(v) for v in var_30]
        r5 = var_30
        r6 = 0
        r4 = 0
        while r6 < 5:
                r12 = r5[r6:r6+1][0]
                r7 = r6 + 1
                r0 = var_30[0x19]
                r3 = r6 + 0x10
                r9 = r12 ^ r0
                r31 = r3
                r5[r6] = r9
                r6 = r7
                r5[r31] = r4
        #print [hex(v) for v in r5]
        r9 = 0
        r10 = 0
        while r10 < 5:
                r11 = r10 + 1
                r6 = r5[r10:r10+1][0]
                r4 = r9 << 8
                r10 = r11
                r9 = r4 | r6
        return r9
'''
print hex(gen_sum(title_))

a1='A'
a2='A'
a3='A'
a4='A'
while a1 <= 'Z':
        a2='A'
        a3='A'
        a4='A'
        while a2 <= 'Z':
                a3='A'
                a4='A'
                while a3 <= 'Z':
                        a4='A'
                        while a4 <= 'Z':
                                #print "%s%s%s%s" % (a1,a2,a3,a4)
                                for i in range(99999):
                                        t = "%s%s%s%s_" % (a1,a2,a3,a4) + '{4}{3}{2}.{1}{0}'.format(i%10,(i/10)%10,(i/100)%10,(i/1000)%10,(i/10000)%10)
                                        if gen_sum(t) in patches:
                                                print t
                                                print True
                                a4=chr(ord(a4)+1)
                                print "%s%s%s%s" % (a1,a2,a3,a4)
                        a3=chr(ord(a3)+1)
                        print "%s%s%s%s" % (a1,a2,a3,a4)
                a2=chr(ord(a2)+1)
        a1=chr(ord(a1)+1)
'''

print hex(gen_sum("SLUS_213.86"))
'''
for i in range(99999):
        t = "SLUS_" + '{4}{3}{2}.{1}{0}'.format(i%10,(i/10)%10,(i/100)%10,(i/1000)%10,(i/10000)%10)
        if gen_sum(t) in patches:
                print "%s %x" % (t, gen_sum(t))

'''


External References


CPU-GPU intensive games + games only playable in software render on PCSX2: