PS2 Emulation
Description
Emulation of Playstation 2 is currently handled by 3 kind of emulators. CECH-A/B models use ps2_emu.self able to use built-in PS2 hardware (EE/GS/Rambus memory), and have best compatibility. CECH-C/E use ps2_gxemu, this emulator use physical Graphic Synthesizer found in this ps3 model, but Emotion Engine is fully emulated here, also there is no Rambus memory. All other models emulate PS2 thru fully software based ps2_netemu used for ps2 classics, and hacked now to use decrypted ISO files. Earlier before Sony provided ps2 classics on PS Store there was another soft only emulator strongly based on ps2_gxemu. It was called ps2_softemu, and had support for original PS2 CDVD. Only emulator not able to run physical discs is ps2_netemu.
Emulators are self files, but not typical one. Emulators are not truly PS3 Game OS elf executables, but Guest OS'es running on LV1 of PS3. This mean that LV2, or more friendly Game OS is unloaded before emulator is loaded. This also mean that while emulators are running we can't call any LV2 function. Also LV1 syscalls are limited to call from all emulators, but can be fully unlocked.
All emulators use built-in stripped developement version of PS2 BIOS with disabled debug functions that can affect some games. This is done because some games print debug info on screen when found that are run on dev bios. Bios between ps2_emu, and ps2_gxemu/ps2_netemu are different. Ps2_emu BIOS is able to run only on ps2emu version of emulator due to RDRAM check.
PS3 models without Emotion Engine unit use "SPE-compatible SIMD graphics-rounding mode for VMX/Altivec Instructions" for FPU, and VU0 emulated floats calculations. This is set on emulator init by HV call 97 with param 1. VU1 actually run at SPE core so no compatibility mode need (or can) to be set. SPE compatible mode for PPE mean that rounding mode is set as round to zero, denormals are treated as zero, and there are no infinities or NaNs. So literally what PS2 VU was originally. Although SPE, and PPE SPE compatibility mode can still be inaccurate comparing to PS2. Good example here are TriAce games, or Castlevania COD where SPE calculation is wrong by 1 bit making games unplayable without patch. This is due to some PS2 math algo specific inaccuracies in FPU/VU implementation that are not present on any other hardware.
Note:
- not available in early Tool/DECR and Debug/DEX firmwares. But available in AV TOOL firmware since 1.00
- Emulation is based on a SCPH-50000/SCPH-20401 Playstation 2 Model.
- Introduction to PlayStation2 Architecture.pdf
- ps2tek docs - https://psi-rockin.github.io/ps2tek/
PS2 emulators workload comparison
PS2 (GS+EE) | |||
---|---|---|---|
Core | Job | Source | Notes |
SPU0 | Spu2 | SPU Assembly | Spu2 emulator |
SPU1 | Sif | SPU Assembly | Some kind of bridge to IOP, since SIF is part of EE hardware. |
SPU2 | Timer | SPU Assembly | IOP timers. |
SPU3-6 | - | - | Unknown, emulator seems to not use them |
SPU7 | - | - | Unavailable: Factory disabled SPU |
PPU:0 | PS2-Devices | C++ and PPU ASM | |
PPU:1 | IOP | PPU ASM | Interpreter, dmas, iop hw regs, etc. |
PS2-EE | Emotion Engine | Hardware CXD2953AGB | Only in CECHAxx and CECHBxx PS3 models with COK-001 motherboard |
PS2-GS | Graphic Synthesizer | ||
PS2_GX | |||
Core | Job | Source | Notes |
SPU0 | IOP | SPU ASM | I/O Processor (originally PS1 main processor) |
SPU1 | PS2-SPU2 | SPU ASM | Sound processing unit 2 |
SPU2 | IPU | SPU ASM | Image Processing Unit |
SPU3 | VU1 | SPU ASM | Vector Unit 1 |
SPU4 | EEDMA | SPU ASM | EE DMA plus VIF1 handler |
SPU5 | GSGIF | SPU ASM | GIF (GS Interface, very limited since GS is on board) |
SPU6 | ? | ? | Emulator never access it directly but can be possibly used for MagicGate. Emulator sends/receives MG data thru virtual uart port 10. |
SPU7 | - | - | Unavailable: Factory disabled SPU |
PPU:0 | PS2-Devices | C++ and PPU ASM | |
PPU:1 | Emotion Engine | C++ and PPU ASM | |
PS2-GS | Graphic Synthesizer | Hardware CXD2972GB | Only in CECHCxx PS3 models with COK-002 motherboard |
PS2 Software | |||
Core | Job | Source | Notes |
SPU0 | IOP | SPU ASM | I/O Processor (originally PS1 main processor) |
SPU1 | SPU2 | SPU ASM | Sound Processing Unit 2 |
SPU2 | VU1 | SPU ASM | Vector Unit 1 |
SPU3 | EEDMA | SPU ASM | Emotion Engine DMA Controller |
SPU4 | GSEGIF | SPU ASM | GIF |
SPU5 | GSE | SPU ASM | |
SPU6 | IPU | SPU ASM | Image Processing Unit |
SPU7 | - | - | Unavailable: Factory disabled SPU |
PPU:0 | PS2-Devices | C++ and PPU ASM | |
PPU:1 | Emotion Engine | C++ and PPU ASM | |
PS2 Netemu | |||
Core | Job | Source | Notes |
SPU0 | IOP | SPU ASM | I/O Processor (originally PS1 main processor) |
SPU1 | SPU2 | SPU ASM | Sound processing unit 2 (originally SPU from PS1) |
SPU2 | VU1 | SPU ASM | Running VU1 code translated previously on PPU side. |
SPU3 | EEDMA | SPU ASM | Partial DMAC, mostly channels 1/2, and VU1 CODE r/w. Also process VIF1 commands (incl. Unpacks). |
SPU4 | FE | SPU ASM | GIF unit, processing GIF tags, handling GS internal registers, etc. |
SPU5 | BE | SPU ASM | |
SPU6 | IPU | SPU ASM | EE Image Processing Unit |
SPU7 | BE | PPU/SPU ASM | Factory disabled SPU. Emulator set name for JOB, but never try to start/set it as active. Although a lot of code in emulator is ready to use it. |
PPU:0 | - | - | |
PPU:1 | - | - |
PS2 Emulators types and versions
PS2_EMU | |||
---|---|---|---|
FW version | TOC | Notes | |
1.00 AV | 0x7C3150 | ||
1.02 | 0x7C31F0 | ||
1.10 | 0x7C2168 | ||
1.11 | 0x7C23C8 | ||
1.30 | 0x8442E8 | ||
1.30 AV | 0x8442E8 | ||
1.31 | 0x844C98 | ||
1.32 | 0x845CA0 | ||
1.50 | 0x848728 | ||
1.90 | 0x4D7ED8 | ||
3.66 - 3.74 | 0x4E9A20 | ||
4.00 - 4.01 | 0x4EADB8 | ||
4.10 - 4.11 | 0x4EAD28 | ||
4.20 - 4.21 | 0x4EAE30 | ||
4.23 | 0x4EACE0 | ||
4.25 | 0x4EAE30 | Reverted to 4.20 - 4.21 version? | |
4.78 - 4.82 | 0x4EB8C0 | ||
PS2_GXEMU | |||
FW version | TOC | Notes | |
1.50 | 0x5BDFC8 | ||
1.90 | 0x666C78 | ||
3.66 - 3.74 | 0x6766B8 | ||
4.00 - 4.11 | 0x677990 | ||
3.66 - 3.74 | 0x677AA8 | ||
4.78 - 4.82 | 0x678548 | ||
PS2_SOFTEMU | |||
FW version | TOC | Notes | |
1.90 | 0x5C7B10 | ||
2.50 | 0x5C7ED8 | ||
3.41 | 0x5C8C00 | ||
3.66 - 3.71 | 0x5C8EC0 | ||
3.72 - 4.01 | 0x5C8E40 | ||
PS2_NETEMU | |||
FW version | TOC | Notes | |
3.73 - 3.74 | 0x7D8B00 | ||
4.00 - 4.01 | 0x7DA200 | ||
4.10 - 4.11 | 0x7DA180 | ||
4.20 - 4.25 | 0x7DA500 | ||
4.78 - 4.83 | 0x751280 |
General observations regarding PS2 Classics emulator (ps2_netemu)
- Virtual memory cards are per title based, but apparently run through the current memory card system. The module used to manage memory cards is: vmc_savedata_plugin.sprx - Using a regular memory card that has been renamed result in a "The save data is corrupt (8XXXXXXX) error"
- Loads an epilepsy warning before PS2 logo (PS button menu appears during epilepsy warning if controller is synced)
- Does not support online functionality of PS2 titles (network configuration utility inside Full Spectrum Warrior claims no network adaptor has been found, same with Syphon Filter: The Omega Strain).
- Only file that is needed in the folder for PS2 Classics is "iso.bin.enc". Removing the manuals/DXT files will cause the game to boot IMMEDIATELY to the PS2 logo upon switching to 720p/starting PS2 LPAR.
folder/file layout
(in this example GTA San Andreas Classic)
[NPUD20946] [USRDIR] [CONTENT] 001.dxt 002.dxt 003.dxt 004.dxt 005.dxt 006.dxt 007.dxt 008.dxt 009.dxt 010.dxt 011.dxt 012.dxt 013.dxt 014.dxt 015.dxt 016.dxt 017.dxt Others.dxt Manual.idx [SAVEDATA] SCEVMC0.VME SCEVMC1.VME CONFIG ISO.BIN.EDAT ISO.BIN.ENC PS3LOGO.DAT PARAM.SFO ICON0.PNG PIC0.PNG PIC1.PNG PIC2.PNG
Virtual PS2 (emulated machine) usage and features
Video Modes
Note: Real PS2 : http://users.neoscientists.org/~blue/ps2videomodes.txt
Video Modes ----.-----------.---------------.-----------.-----------. No | Name | Resolution | fV(Hz) | fH(kHz) | ----+-----------+---------------+-----------+-----------| 0 | NTSC-NI | 640x240(224) | 59.940 | 15.734 | 1 | NTSC-I | 640x480(448) | 59.820 | 15.734 | 2 | PAL-NI | 640x288(256) | 50.000 | 15.625 | 3 | PAL-I | 640x576(512) | 49.760 | 15.625 | 4 | VESA-1A | 640x480 | 59.940 | 31.469 | 5 | VESA-1C | 640x480 | 75.000 | 37.500 | 6 | VESA-2B | 800x600 | 60.317 | 37.879 | 7 | VESA-2D | 800x600 | 75.000 | 46.875 | 8 | VESA-3B | 1024x768 | 60.004 | 48.363 | 9 | VESA-3D | 1024x768 | 75.029 | 60.023 | 10 | VESA-4A | 1280x1024 | 60.020 | 63.981 | 11 | VESA-4B | 1280x1024 | 75.025 | 79.976 | 12 | DTV-480P | 720x480 | 59.940 | 31.469 | 13 | DTV-1080I | 1920x1080 | 60.000 | 33.750 | 14 | DTV-720P | 1280x720 | ?? | ?? | ----^-----------^---------------^-----------^-----------'
Memory Mapping
ps2netemu
Mapping ELF @ 0x200000000
Name | ea | lpar2(netemu 4.81) | size | flags | lpar1(lv1 4.81) |
---|---|---|---|---|---|
text | 0x0 | 0x3D00000 | 0x300000( 3 MB) | 0x8000000000000003 0000000000000003 | 0x7D00000 |
ro_work | 0x300000 | 0x300000 | 0x500000( 5 MB) | 0x0000000000000003 0000000000000003 | 0x4300000 |
rw_work | 0x800000 | 0x800000 | 0x2A00000( 42 MB) | 0x0000000000000001 0000000000000003 | 0x4800000 |
negmem | 0x1FFF0000 | 0x3210000 | 0x10000( 64 KB) | 0x0000000000000001 0000000000000000 | 0x7210000 |
ee_ram | 0x100000000 | 0x64000E000000 | 0x2000000( 32 MB) | 0x0000000000000001 0000000000000000 | 0x3C00000 - 0x3F00000, 0x8000000 - 0x9B00000 |
ee_jit_code | 0xD00000000 | 0x680024000000 | 0x3000000( 48 MB) | 0x8000000000000001 0000000000000003 | 0xBC00000 - 0xEB00000 |
vu0_jit_code | 0xD08000000 | 0x580000800000 | 0x400000( 4 MB) | 0x8000000000000001 0000000000000003 | 0x900000 - 0xC00000 |
vu0_jit_data | 0xD0C000000 | 0x3700000 | 0x400000( 4 MB) | 0x0000000000000002 0000000000000003 | 0x7700000 |
eeram_jit_lut | 0xE00000000 | 0x640010000000 | 0x2000000( 32 MB) | 0x0000000000000001 0000000000000003 | 0x9C00000 - 0xBB00000 |
eerom_jit_lut | 0xE0FC00000 | 0x580000C00000 | 0x400000( 4 MB) | 0x0000000000000001 0000000000000003 | 0xD00000 - 0x1000000 |
ee_dbg_ram | 0x90FFF8000 | 0x64000E078000 | 0x8000( 32 KB) | 0x0000000000000001 0000000000000000 | |
iop_ram | 0x400000000 | 0x3300000 | 0x200000( 2 MB) | 0x0000000000000001 0000000000000000 | 0x7300000 |
iop_rom | 0x50FC00000 | 0x580001000000 | 0x400000( 4 MB) | 0x0000000000000001 0000000000000002 | 0x1100000 - 0x1400000 |
iop_spad | 0x50F800000 | 0x3220000 | 0x10000( 64 KB) | 0x0000000000000001 0000000000000002 | 0x7220000 |
spu2_ram | 0x600000000 | 0x3500000 | 0x200000( 2 MB) | 0x0000000000000001 0000000000000000 | 0x7500000 |
spu2_ram2 | 0x600200000 | 0x3500000 | 0x200000( 2 MB) | 0x0000000000000001 0000000000000000 | 0x7500000 |
spu2_pcm | 0x1000000000 | 0x3230000 | 0x10000( 64 KB) | 0x0000000000000001 0000000000000000 | 0x7230000 |
ee_spr_lo | 0x700000000 | 0x3201000 | 0x2000( 8 KB) | 0x0000000000000001 0000000000000000 | 0x7201000 |
ee_spr | 0x800000000 | 0x3203000 | 0x6000( 24 KB) | 0x0000000000000001 0000000000000000 | 0x7203000 |
ee_vu0_dmem0 | 0x301004000 | 0x3200000 | 0x1000( 4 KB) | 0x0000000000000001 0000000000000001 | 0x7200000 |
ee_vu0_dmem1 | 0x301005000 | 0x3200000 | 0x1000( 4 KB) | 0x0000000000000001 0000000000000001 | 0x7200000 |
ee_vu0_dmem2 | 0x301006000 | 0x3200000 | 0x1000( 4 KB) | 0x0000000000000001 0000000000000001 | 0x7200000 |
ee_vu0_dmem3 | 0x301007000 | 0x3200000 | 0x1000( 4 KB) | 0x0000000000000001 0000000000000001 | 0x7200000 |
ee_rom | 0x30FC00000 | 0x580001000000 | 0x400000( 4 MB) | 0x0000000000000001 0000000000000001 | 0x1100000 - 0x1400000 |
vrc | 0xC00000000 | 0x600005000000 | 0x1000000( 16 MB) | 0x0000000000000001 0000000000000000 | 0x1500000 - 0x2400000 |
/dev/zero | 0x4000000000 | 0x3240000 | 0x10000( 64 KB) | 0x0000000000000001 0000000000000001 | 0x7240000 |
dma_vu0_dmem0 | 0x4001004000 | 0x3200000 | 0x1000( 4 KB) | 0x0000000000000001 0000000000000001 | 0x7200000 |
dma_vu0_dmem1 | 0x4001005000 | 0x3200000 | 0x1000( 4 KB) | 0x0000000000000001 0000000000000001 | 0x7200000 |
dma_vu0_dmem2 | 0x4001006000 | 0x3200000 | 0x1000( 4 KB) | 0x0000000000000001 0000000000000001 | 0x7200000 |
dma_vu0_dmem3 | 0x4001007000 | 0x3200000 | 0x1000( 4 KB) | 0x0000000000000001 0000000000000001 | 0x7200000 |
imm_vu0_dmem0 | 0x30000000 | 0x3200000 | 0x1000( 4 KB) | 0x0000000000000001 0000000000000001 | 0x7200000 |
imm_vu0_dmem1 | 0x30001000 | 0x3200000 | 0x1000( 4 KB) | 0x0000000000000001 0000000000000001 | 0x7200000 |
imm_vu0_dmem2 | 0x30002000 | 0x3200000 | 0x1000( 4 KB) | 0x0000000000000001 0000000000000001 | 0x7200000 |
imm_vu0_dmem3 | 0x30003000 | 0x3200000 | 0x1000( 4 KB) | 0x0000000000000001 0000000000000001 | 0x7200000 |
SGSXdr | 0x1904000000 | 0x64000C000000 | 0x1700000( 23 MB) | 0x0000000000000001 0000000000000000 | 0x2500000 - 0x3B00000 |
iopTrace | 0x1400000000 | 0x3250000 | 0x10000( 64 KB) | 0x0000000000000001 0000000000000000 | 0x7250000 |
PS2 Memory and Hardware Mapped Registers Layout
EE Virtual/Physical Memory Map KUSEG: 00000000h-7FFFFFFFh User segment KSEG0: 80000000h-9FFFFFFFh Kernel segment 0 KSEG1: A0000000h-BFFFFFFFh Kernel segment 1 KSSEG: C0000000h-DFFFFFFFh Supervisor segment KSEG3: E0000000h-FFFFFFFFh Kernel segment 3 Virtual Physical 00000000h 00000000h 32 MB Main RAM (first 1 MB reserved for kernel) 20000000h 00000000h 32 MB Main RAM, uncached 30100000h 00100000h 31 MB Main RAM, uncached and accelerated 10000000h 10000000h 64 KB I/O registers 11000000h 11000000h 4 KB VU0 code memory 11004000h 11004000h 4 KB VU0 data memory 11008000h 11008000h 16 KB VU1 code memory 1100C000h 1100C000h 16 KB VU1 data memory 12000000h 12000000h 8 KB GS privileged registers 1C000000h 1C000000h 2 MB IOP RAM 1FC00000h 1FC00000h 4 MB BIOS, uncached (rom0) 9FC00000h 1FC00000h 4 MB BIOS, cached (rom09) BFC00000h 1FC00000h 4 MB BIOS, uncached (rom0b) 70000000h --------- 16 KB Scratchpad RAM (only accessible via virtual addressing) IOP Physical Memory Map KUSEG: 00000000h-7FFFFFFFh User segment KSEG0: 80000000h-9FFFFFFFh Kernel segment 0 KSEG1: A0000000h-BFFFFFFFh Kernel segment 1 Physical 00000000h 2 MB Main RAM (same as on PSX) 1D000000h SIF registers 1F800000h 64 KB Various I/O registers 1F900000h 1 KB SPU2 registers 1FC00000h 4 MB BIOS (rom0) - Same as EE BIOS FFFE0000h (KSEG2) Cache control Additional Memory 4 MB GS VRAM (used for framebuffer, textures, zbuffer, etc) 2 MB SPU2 work RAM - quadrupled from PSX's SPU 8 MB Memory card Hardware Mapped Registers EE Map EE Timers 100000xxh Timer 0 100008xxh Timer 1 100010xxh Timer 2 100018xxh Timer 3 Image Processing Unit (IPU) 10002000h 8h IPU Command 10002010h 4h IPU Control 10002020h 4h IPU bit pointer control 10002030h 8h Top of bitstream 10007000h 10h Out FIFO (read) 10007010h 10h In FIFO (write) Graphics Interface (GIF) 10003000h 4h GIF_CTRL - Control register 10003010h 4h GIF_MODE - Mode setting 10003020h 4h GIF_STAT - Status 10003040h 4h GIF_TAG0 - Bits 0-31 of tag before 10003050h 4h GIF_TAG1 - Bits 32-63 of tag before 10003060h 4h GIF_TAG2 - Bits 64-95 of tag before 10003070h 4h GIF_TAG3 - Bits 96-127 of tag before 10003080h 4h GIF_CNT - Transfer status counter 10003090h 4h GIF_P3CNT - PATH3 transfer status counter 100030A0h 4h GIF_P3TAG - Bits 0-31 of PATH3 tag when interrupted 10006000h 10h GIF FIFO DMA Controller (DMAC) 100080xxh VIF0 - channel 0 100090xxh VIF1 - channel 1 1000A0xxh GIF - channel 2 1000B0xxh IPU_FROM - channel 3 1000B4xxh IPU_TO - channel 4 1000C0xxh SIF0 - channel 5 1000C4xxh SIF1 - channel 6 1000C8xxh SIF2 - channel 7 1000D0xxh SPR_FROM - channel 8 1000D4xxh SPR_TO - channel 9 1000E000h 4h D_CTRL - DMAC control 1000E010h 4h D_STAT - DMAC interrupt status 1000E020h 4h D_PCR - DMAC priority control 1000E030h 4h D_SQWC - DMAC skip quadword 1000E040h 4h D_RBSR - DMAC ringbuffer size 1000E050h 4h D_RBOR - DMAC ringbuffer offset 1000E060h 4h D_STADR - DMAC stall address 1000F520h 4h D_ENABLER - DMAC disabled status 1000F590h 4h D_ENABLEW - DMAC disable Interrupt Controller (INTC) 1000F000h 4h INTC_STAT - Interrupt status 1000F010h 4h INTC_MASK - Interrupt mask Subsystem Interface (SIF) 1000F200h 4h MSCOM - EE->IOP communication 1000F210h 4h SMCOM - IOP->EE communication 1000F220h 4h MSFLAG - EE->IOP flags 1000F230h 4h SMFLAG - IOP->EE flags 1000F240h 4h Control register Privileged GS registers 12000000h 8h PMODE - various PCRTC controls 12000010h 8h SMODE1 12000020h 8h SMODE2 12000030h 8h SRFSH 12000040h 8h SYNCH1 12000050h 8h SYNCH2 12000060h 8h SYNCV 12000070h 8h DISPFB1 - display buffer for output circuit 1 12000080h 8h DISPLAY1 - output circuit 1 control 12000090h 8h DISPFB2 - display buffer for output circuit 2 120000A0h 8h DISPLAY2 - output circuit 2 control 120000B0h 8h EXTBUF 120000C0h 8h EXTDATA 120000D0h 8h EXTWRITE 120000E0h 8h BGCOLOR - background color 12001000h 8h GS_CSR - control register 12001010h 8h GS_IMR - GS interrupt control 12001040h 8h BUSDIR - transfer direction 12001080h 8h SIGLBLID - signal IOP Map Subsystem Interface (SIF) 1D000000h 4h MSCOM - EE->IOP communication 1D000010h 4h SMCOM - IOP->EE communication 1D000020h 4h MSFLAG - EE->IOP flags 1D000030h 4h SMFLAG - IOP->EE flags 1D000040h 4h Control register CDVD Drive 1F402004h 1h Current N command 1F402005h 1h N command status (R) 1F402005h 1h N command params (W) 1F402006h 1h Error 1F402007h 1h Send BREAK command 1F402008h 1h CDVD I_STAT - interrupt register 1F40200Ah 1h Drive status 1F40200Fh 1h Disk type 1F402016h 1h Current S command 1F402017h 1h S command status 1F402018h 1h S command params Interrupt Control 1F801070h 4h I_STAT - Interrupt status 1F801074h 4h I_MASK - Interrupt mask 1F801078h 1h I_CTRL - Global interrupt disable DMA registers 1F80108xh MDECin - channel 0 1F80109xh MDECout - channel 1 1F8010Axh SIF2 (GPU) - channel 2 1F8010Bxh CDVD - channel 3 1F8010Cxh SPU2 Core0 - channel 4 1F8010Dxh PIO - channel 5 1F8010Exh OTC - channel 6 1F80150xh SPU2 Core1 - channel 8 1F80151xh ??? - channel 9 1F80152xh SIF0 - channel 10 1F80153xh SIF1 - channel 11 1F80154xh SIO2in - channel 12 1F80155xh SIO2out - channel 13 1F8010F0h 4h DPCR - DMA priority control 1F8010F4h 4h DICR - DMA interrupt control 1F801570h 4h DPCR2 - DMA priority control 2 1F801574h 4h DICR2 - DMA priority control 2 IOP Timers 1F80110xh Timer 0 1F80111xh Timer 1 1F80112xh Timer 2 1F80148xh Timer 3 1F80149xh Timer 4 1F8014Axh Timer 5 Serial Interface (SIO2) 1F808200h 40h SEND3 buffer 1F808240h 20h SEND1/2 buffers 1F808260h 1h In FIFO 1F808264h 1h Out FIFO 1F808268h 4h SIO2 control 1F80826Ch 4h RECV1 1F808270h 4h RECV2 1F808274h 4h RECV3 Sound Processing Unit (SPU2) 1F900000h 180h Core0 Voice 0-23 registers 1F900190h 4h Key ON 0/1 1F900194h 4h Key OFF 0/1 1F90019Ah 2h Core attributes 1F90019Ch 4h Interrupt address H/L 1F9001A8h 4h DMA transfer address H/L 1F9001ACh 2h Internal transfer FIFO 1F9001B0h 2h AutoDMA status 1F9001C0h 120h Core0 Voice 0-23 start/loop/next addresses 1F900340h 4h ENDX 0/1 1F900344h 2h Status register ... above addresses repeat for Core1 starting at 1F900400h ... 1F900760h 2h Master Volume Left 1F900762h 2h Master Volume Right 1F900764h 2h Effect Volume Left 1F900766h 2h Effect Volume Right 1F900768h 2h Core1 External Input Volume Left 1F90076Ah 2h Core1 External Input Volume Right
Memory Allocation
ps2_netemu
Name | Size | page_log2 | lpar2(netemu 4.81) | lpar1(lv1 4.81) |
---|---|---|---|---|
ra_vu0_dmem | 0x1000 (4 KB) | 12 (4 KB) | 0x3200000 | 0x7200000 |
ra_ee_spr_lo | 0x2000 (8 KB) | 12 (4 KB) | 0x3201000 | 0x7201000 |
ra_ee_sprx | 0x6000 (24 KB) | 12 (4 KB) | 0x3203000 | 0x7203000 |
ra_negmem | 0x10000 (64 KB) | 16 (64 KB) | 0x3210000 | 0x7210000 |
ra_iop_spad | 0x10000 (64 KB) | 16 (64 KB) | 0x3220000 | 0x7220000 |
ra_spu2_pcm | 0x10000 (64 KB) | 16 (64 KB) | 0x3230000 | 0x7230000 |
ra_nulls | 0x10000 (64 KB) | 16 (64 KB) | 0x3240000 | 0x7240000 |
ra_itrace | 0x10000 (64 KB) | 16 (64 KB) | 0x3250000 | 0x7250000 |
ra_iop_ram | 0x200000 (2 MB) | 20 (1 MB) | 0x3300000 | 0x7300000 |
ra_spu2_ram | 0x200000 (2 MB) | 20 (1 MB) | 0x3500000 | 0x7500000 |
ra_vu0_code | 0x400000 (4 MB) | 20 (1 MB) | 0x580000800000 | 0x900000 - 0xC00000 |
ra_vu0_data | 0x400000 (4 MB) | 20 (1 MB) | 0x3700000 | 0x7700000 |
ra_ee_rom_pc | 0x400000 (4 MB) | 20 (1 MB) | 0x580000C00000 | 0xD00000 - 0x1000000 |
ra_ps2_rom | 0x400000 (4 MB) | 20 (1 MB) | 0x580001000000 | 0x1100000 - 0x1400000 |
ra_vrc_mem | 0x1000000 (16 MB) | 20 (1 MB) | 0x600005000000 | 0x1500000 - 0x2400000 |
ra_sgs_xdr | 0x1700000 (23 MB) | 20 (1 MB) | 0x64000C000000 | 0x2500000 - 0x3B00000 |
ra_ee_ram | 0x2000000 (32 MB) | 20 (1 MB) | 0x64000E000000 | 0x3C00000 - 0x3F00000, 0x8000000 - 0x9B00000 |
ra_ee_ram_pc | 0x2000000 (32 MB) | 20 (1 MB) | 0x640010000000 | 0x9C00000 - 0xBB00000 |
ra_trans_code | 0x3000000 (48 MB) | 20 (1 MB) | 0x680024000000 | 0xBC00000 - 0xEB00000 |
Controller
ID | Controller #Number | Note |
---|---|---|
1 (1-A) | 1 | |
2 (2-A) | 2 | |
3 (1-B) | 3 | |
4 (2-B) | 4 | |
5 (1-C) | 5 | Gamepad LED #1 + #4 |
6 (2-C) | 6 | Gamepad LED #2 + #4 |
7 (1-D) | 7 | Gamepad LED #3 + #4 |
Peripheral support
ps2_emu.self / ps2_gxemu.self
- Hub
- Mouse
- Keyboard
- EyeToy
- Head Mount Display
- Mic
- Ascii Mic
- Socom USB Headset
- Usb Headset
- Sea Mic Controller
- Force Feedback device
- GT Force
- Momo Force
- Driving Force Pro
- G25/G27
- Momo Racing
- Flight Force
- Force 3D Pro
- Modem
- Guncon2
- Densya de GO! controller type 2
- Densya de GO! Sincansen senyou controller
- Capture Eye
- Flight Stick
- Flight Stick 2
- Pop Egg
- Trance Vibrator
- PSP
- Compact Flight Controller
- Flash Memory
- Buzz!
- Pachi-Slot Controller Kurouto
- Usb Adapter
- Guncon3
- Multi Train Controller
- Para Para Paradise controller
ps2_netemu.self
- BD Remote Control
- PLAYSTATION(R)3 Controller (Vendor ID 0x54C, Product ID 0x268),
- Motion Controller - Move (Vendor ID 0x54C, Product ID 0x3D5),
- Navigation Controller (Vendor ID 0x54C, Product ID 0x42F)
- "guncon3"
Unknown:
- Vendor ID 0xF0D (Hori), Product ID 0x4A
- Vendor ID 0x54C (Sony), Product ID 0x5AF
BIOS
ps2_netemu.self
Ps2_netemu use integrated PS2 bios included in ps2netemu.elf, not additional file like in ps1emu case. In 4.81 firmware BIOS is located from 0x820A00 to 0x9F09FF (0x820900 to 0x9F08FF in fw4.50). Bios version is to be Developement v2.20 from Japan region (22/01/2007), but it's of course not limited to booting only NTSC-J games.
Notable thing is that ps2_netemu use the same bios as ps2_gxemu, and ps2onps4. ps2_netemu not boot using ps2_emu bios because of failing RDRAM check.
File | Offset in fw4.81 ps2_netemu | Offset in exported bin | Description | File type (exportable) |
---|---|---|---|---|
RESET | 0x820A00 | 0x00 | Bootstrap code for the EE and IOP. | BIN |
ROMDIR | 0x823180 | 0x2780 | The ROMDIR part of the ROM image, which provides information on the location and name of files contained in the image. | BIN |
EXTINFO | 0x8236C0 | 0x2CC0 | Contains the "EXTINFO" for all files in the ROM image. | BIN |
SBIN | 0x823D30 | 0x3330 | Seems to be the pad controller library for the PS1 monitor. | BIN |
LOGO | 0x82ACD0 | 0xA2D0 | PS1 logo? | BIN |
IOPBTCONF | 0x83F420 | 0x1EA20 | Boot configuration file for the IOP, during the final phase of the IOP reset. If no UDNL module is specified, the IOP will only have a single IOP reset in the reboot process, with the modules listed in IOPBTCONF. | BIN |
IOPBTCON2 | 0x83F510 | 0x1EB10 | Boot configuration file for the IOP, for the first phase of the IOP reset (before UDNL is loaded). | BIN |
SYSMEM | 0x83F5E0 | 0x1EBE0 | System Memory Manager. | ELF |
LOADCORE | 0x840800 | 0x1FE00 | The core of IOP module loading. Provides the lowest level of IOP module loading functions. Also handles the startup of the IOP. | ELF |
EXCEPMAN | 0x842D80 | 0x22380 | Exception manager. | ELF |
INTRMANP | 0x843960 | 0x22F60 | Interrupt Manager. According to wisi, it is for PS mode. | ELF |
INTRMANI | 0x845370 | 0x24970 | Interrupt Manager. According to wisi, it is for IOP mode. | ELF |
SSBUSC | 0x8471B0 | 0x267B0 | SSBUS Controller library. The SSBUS seems to be the bus that all peripherals get connected to. It seems to have the power to control the mapping of the device registers, as well as access timing. | ELF |
TIMEMANP | 0x847920 | 0x26F20 | Timer Manager (PS mode) | ELF |
TIMEMANI | 0x848500 | 0x27B00 | Timer Manager (IOP mode) | ELF |
DMACMAN | 0x849130 | 0x28730 | DMA Controller Manager. | ELF |
SYSCLIB | 0x84C830 | 0x2BE30 | System C Library. | ELF |
HEAPLIB | 0x84EF90 | 0x2E590 | Memory HEAP LIBrary (i.e. thvpool, thfpool) | ELF |
THREADLIB | 0x84FC90 | 0x2F290 | Multi_Thread_Manager | ELF |
VBLANK | 0x858A20 | 0x38020 | V-Blank management | ELF |
IOMAN | 0x8597B0 | 0x38DB0 | IO Manager | ELF |
MODLOAD | 0x85B720 | 0x3AD20 | IOP module loader. | ELF |
ROMDRV | 0x85DA70 | 0x3D070 | ROM driver. Provides access to the boot ROM (rom0). | ELF |
ADDDRV | 0x85E960 | 0x3DF60 | Adds support for the DVD ROM (rom1:), via ROMDRV. | ELF |
STDIO | 0x85DDC0 | 0x3D3C0 | Standard I/O library. | ELF |
SIFMAN | 0x85F9B0 | 0x3EFB0 | SIF manager. | ELF |
SIFINIT | 0x860F50 | 0x40550 | Initializes the SIF. | ELF |
EESYNC | 0x861370 | 0x40970 | For synchronizing with the EE, at the end of IOP resets. EESYNC from DNAS images are evil; they also perform a memory wipe of the region from 0x00084000 to .0x00100000. | ELF |
EENULL | 0x861810 | 0x40E10 | The idle thread (id #0) module, in ps2 loaded to 0x00081FC0. | BIN |
PS1ID | 0x861850 | 0x40E50 | Only found in newer boot ROMs | BIN |
LIBFI | 0x861860 | 0x40E60 | Not present in the boot ROM of the SCPH-10000 and SCPH-15000. | BIN |
PS1VERJ | 0x861950 | 0x40F50 | BIN | |
PS1VERA | 0x861960 | 0x40F60 | BIN | |
PS1VERE | 0x861970 | 0x40F70 | BIN | |
PS1VERC | 0x861980 | 0x40F80 | BIN | |
PS1VERH | 0x861990 | 0x40F90 | BIN | |
OSDSYS | 0x8619A0 | 0x40FA0 | The browser | BIN |
- | 0x8619B0 | 0x40FB0 | BIN | |
RDRAM | 0x861A00 | 0x41000 | Provides a RDRAM test for the EE at power-on. This is run from RESET. | BIN |
EELOADCNF | 0x864750 | 0x43D50 | Contains the IOP boot configuration file for EELOAD. | BIN |
SIFCMD | 0x864900 | 0x43F00 | SIF command module. Contains the SIF command and SIF RPC functions. | ELF |
REBOOT | 0x866B40 | 0x46140 | The reboot service. Receives IOP reset packets from the EE, from across the SIF. | ELF |
LOADFILE | 0x867310 | 0x46910 | The RPC server for MODLOAD | ELF |
EECONF | 0x869A70 | 0x49070 | Loads part of the system configuration from the MECHACON EEPROM. Also configures and resets some peripherals, depending on the model version. In slimlines, and possibly on PS3 EECONF will also load the MAC address. | ELF |
- | 0x86A9F0 | 0x49FF0 | BIN | |
IOPBOOT | 0x86AA00 | 0x4A000 | IOP bootup program | BIN |
- | 0x86BB60 | 0x4B160 | BIN | |
TBIN | 0x86C200 | 0x4B800 | The PS1 monitor program. Seems to be the PS1 BIOS. This is started by RESET, when the IOP is in PS1 mode. | BIN |
XSHA1 | 0x87A170 | 0x59770 | sha1 - this only present in PS3. It is used as additional antipiracy check. It seems that it calculate disc main elf checksum and compares it with some database. Config related? | ELF |
XLOADFILE | 0x87B140 | 0x5A740 | Updated module | ELF |
SIO2MAN | 0x87E1F0 | 0x5D7F0 | SIO2 manager. Provides access to the SIO2 interface. | ELF |
- | 0x87FE20 | 0x5F420 | BIN | |
MCSERV | 0x881D40 | 0x61340 | RPC server for MCMAN. | ELF |
- | 0x883A40 | 0x63040 | BIN | |
KROMG | 0x884A00 | 0x64000 | BIN | |
- | 0x8866C0 | 0x65CC0 | BIN | |
KROM | 0x886A00 | 0x66000 | Kanji ROM? Not sure where this is used. | BIN |
- | 0x8A0870 | 0x7FE70 | BIN | |
ROMVER | 0x8A0900 | 0x7FF00 | ROM version. | BIN |
- | 0x8A0910 | 0x7FF10 | BIN | |
VERSTR | 0x8A0930 | 0x7FF30 | Version string. Probably PS1 ROM will use this because that this string is also present in PlayStation consoles. | BIN |
- | 0x8A0990 | 0x7FF90 | BIN | |
ROMGSCRT | 0x8A0A00 | 0x80000 | BIN | |
NCDVDMAN | 0x8A3730 | 0x82D30 | It seems to be a heavily stripped-down CDVDMAN module, with no support for some S-command functions like sceCdRI. | ELF |
SECRMAN | 0x8B0170 | 0x8F770 | Security Manager. Signing is NOT done with the one in ROM, but with a special version that comes with the utility discs. Looks like PS3 units have a different SECRMAN module from retail sets, similar to PS2 TOOL one. | ELF |
MCMAN | 0x8B4630 | 0x93C30 | Memory Card Manager. | ELF |
PADMAN | 0x8C3AC0 | 0xA30C0 | Pad manager. | ELF |
CDVDMAN | 0x8CD210 | 0xAC810 | The CD/DVD manager. | ELF |
CDVDFSV | 0x8D55C0 | 0xB4BC0 | The RPC server for CDVDMAN. | ELF |
FILEIO | 0x8DD980 | 0xBCF80 | RPC server for IOMAN. Sony has greatly changed the semantics and design of FILEIO after some point. Connecting an old FILEIO EE RPC client to a newer server will result in a severe IOP crash. | ELF |
CLEARSPU | 0x8DFA80 | 0xBF080 | Seems to clear/reset the SPU, but is known to cause crashes under some conditions. Not sure if it's buggy or not. Only used by the OSDSYS of the SCPH-10000 and SCPH-15000, probably retained for backward-compatibility. | ELF |
UDNL | 0x8E16C0 | 0xC0CC0 | It is responsible for selecting the modules and starting the IOP, during the final phase of the IOP reset where the desired modules are to be loaded into the IOP. | ELF |
IGREETING | 0x8E35C0 | 0xC2BC0 | Displays boot information (i.e. IOP boot type, EBOOTP, IBOOTP, switch positions for DSW602 and the type of DSW602 board installed | ELF |
EELOAD | 0x8E4620 | 0xC3C20 | The EE ELF loader, which is loaded by LoadExecPS2() to 0x00082000 in PS2 for loading ELFs. | BIN |
XCDVDMAN | 0x8F37A0 | 0xD2DA0 | cdvd_driver - Updated module | ELF |
XCDVDFSV | 0x902530 | 0xE1B30 | cdvd_ee_driver - Updated module | ELF |
OSDSND | 0x910960 | 0xEFF60 | OSD sound library. This is actually the tentative sound driver, which is called "librspu2" in the Sony SDK. | ELF |
PS2LOGO | 0x93B5B0 | 0x11ABB0 | Displays the PlayStation 2 logo from the inserted disc. For newer consoles, if the logo cannot be decrypted properly, it will fall back to the browser. Not actually required to boot games, but the Sony OSDSYS boots PS2 games through this program. | ELF |
XPARAM2 | 0x957F00 | 0x137500 | Store IOP emulation settings/flags | ELF |
OSDSYS | 0x95A400 | 0x139A00 | The browser, in ps3 is stripped to parse xparam2. No real browser here. | BIN |
PIOPRP | 0x998280 | 0x177880 | Present in the PS3 ps2_(gx/soft/net)emu; contains version 3.1.0 of the IOP software (compared to version 1.3.4 on the root). | BIN |
KERNEL | 0x9DC1E0 | 0x1BB7E0 | The EE kernel | BIN |
Description source: https://gist.github.com/uyjulian/25291080f083987d3f3c134f593483c5
Virtual PS2 HDD
There are 2 different "PS2 game" contents that can be installed in PS3 HDD (CATEGORY's 2P and 2G ). 2P are games released from PSN as "PS2 Classic" in .PKG format, and 2G are a few real "PS2 DVD discs" that can be installed in the PS3 HDD, this installation is managed by the PS2_system_data.pkg.
This games can be installed in real PS2 (in the internall HDD of a PS2 fat)... later this same installation was used in the PSX... and when implemented in PS3 there was needed to use a virtual PS2 HDD image file keeping the same format than the original HDD used in PS2.
Game files (extracted from the real PS2 disc) are installed in a IMAGE.DAT file, this file is a 1:1 "raw copy" of a PS2 HDD.
This IMAGE.DAT is placed in the "install folder" (inside USRDIR folder) and his size can vary up to 10+GB
There are 2 different installations: the most common is used to store "game expansions" (e.g: used by additional content in SOCOM games)... the other type of installation is a "full install" and it seems the only game that uses it is "Final Fantasy XI" (main game installation when the game boots for first time + game expansions added later when needed in the same IMAGE.DAT)
PS2_system_data.pkg itself uses an IMAGE.DAT file (6.43 MB)
The structure of this "virtual PS2 HDD" uses an "APA header" and a "APA MBR" + several "APA partitions", some of them containing "PFS filesystems".
Error message trying to boot a CATEGORY "2G" game with hand-made SFO's and invalid IMAGE.DAT file: The game partition for this game cannot be created because the installed game is corrupted. To perform this operation, delete the game, and then reinstall the game using the disc.
- Notes
- List of PS2 disc games compatibles with PS3 HDD installation hardcoded in dev_flash/vsh/module/game_ext_plugin.sprx
- Virtuall PS2 HDD support module dev_flash/vsh/module/libps2hdd.sprx ?
PS2 System Data (PSN HDD Tool package)
A direct link to the package can be found in NoPayStation database in DLCs
Content ID: IP9100-NPIA00001_00-PS2HDDSYSDAT0001 QA Digest: 2A876715D42678BB7A6E00C030C0121B HASH: E1B0DBE46FC44190DC7A140681D8B9D4
http://manuals.playstation.net/document/en/ps3/current/game/hddinstall.html
Titles supporting HDD installation
- Nobunaga's Ambition Online and Expansion Packs
- Final Fantasy XI (disc1=SCUS97266 disc2=SCUS97269)and Expansion Discs
- SOCOM II: U.S. NAVY SEALs and Related discs included with OPM Issue 87, OPM Issue 88, OPM Issue 89, OPM Issue 90
- SOCOM 3: U.S. NAVY SEALs
- SOCOM: U.S. NAVY SEALs Combined Assault
- Front Mission Online
- Official PlayStation Magazine Issue 87, 88, 89, 90 Discs
( non-official ps2hdd gameslist )
TitleID/DiscID in game_ext_plugin.sprx
Mainly Final Fantasy 11, Nobunaga Ambition Online, Socom IDs and the required HDD Gigabyte amount for install onto the internal hdd.
Speculation: flags are AND' with 0,1,2 (selected from sys_sm_get_hw_config according to ps2emu hardware flags? 0 = no hw?, 1 = gxemu?, 2=full hw? )
Flags | DiscID | Alternative? DiscID | GigaByte | Title | 0 = VMC 1 = IMAGE.DAT |
Internal Name? | GigaByte |
---|---|---|---|---|---|---|---|
0xFFFF | SLPS20200 | SLPS25200 | 0x15 | FINAL FANTASY XI | 1 | PP.SLPM-25200.MAGIC.APPLICATION | 0x15 |
SLPM65705 | |||||||
SLPM65706 | |||||||
SLPM65953 | |||||||
SLPM66393 | |||||||
SLPM66394 | |||||||
SLPM66893 | |||||||
SLPM66894 | |||||||
SLPM55229 | |||||||
0x0001 | SLPM65197 | SLPM65197 | 0x07 | 信長の野望 Online | 1 | PP.SLPM-65197.MAGIC.APPLICATION | 0x07 |
SLPM65783 | |||||||
SLPM66539 | |||||||
SLPM66954 | |||||||
0xFFFF | SCUS97269 | SCUS97269 | 0x15 | FINAL FANTASY XI | 1 | PP.SCUS-97266.MAGIC.APPLICATION | 0x15 |
SLUS21070 | |||||||
SLUS21404 | |||||||
SLUS21694 | |||||||
SLUS21704 | |||||||
0xFFFF | SCUS97275 | SCUS97275 | 0x02 | SOCOM | 0 | PP.SCUS-97275..SOCOM_II | 0x02 |
SCUS97474 | |||||||
SCUS97340 | |||||||
SCUS97341 | |||||||
SCUS97342 | |||||||
SCUS97442 | |||||||
SCUS97545 |
In PS2 Emulator same Title IDs are present with following information:
SLPS25200 FINAL FANTASY XI : 0x100000000 (4 GB?) SCUS97269 FINAL FANTASY XI : 0x300000000 (12GB?) SLPM65981 Front Mission Online : 0x100000000 (4 GB?) SLPM65197 Nobunagas Ambition Online : 0x200000000 (8 GB?)
Emulators management from GameOS
Mountpoints
dev_ps2disc dev_ps2disc1
ps2_netemu syscalls
0x0 - 0 = exec smth, 1 = 0x132 panic, 2 = 0x133 panic, 3 = 0x134 panic, 4 = 0x135 panic, else = 0x136 panic) 0xC - exec smth 0x5 - exec smth 0x6 - exec smth 0x10 - panic
Basically are hvsc syscalls (xoris r11, r11, 0x8000) 0x80000000 - HV_Syscall_Reference#lv1_allocate_memory 0x80000001 - HV_Syscall_Reference#lv1_write_htab_entry 0x80000002 - HV_Syscall_Reference#lv1_construct_virtual_address_space 0x80000007 - HV_Syscall_Reference#lv1_select_virtual_address_space 0x80000009 - HV_Syscall_Reference#lv1_pause 0x8000000F - HV_Syscall_Reference#lv1_put_iopte 0x80000012 - HV_Syscall_Reference#lv1_construct_event_receive_port 0x8000001A - HV_Syscall_Reference#lv1_detect_pending_interrupts 0x8000001B - HV_Syscall_Reference#lv1_end_of_interrupt 0x8000001C - HV_Syscall_Reference#lv1_connect_irq_plug 0x80000039 - HV_Syscall_Reference#lv1_construct_logical_spe 0x8000003D - HV_Syscall_Reference#lv1_set_spe_interrupt_mask 0x80000042 - HV_Syscall_Reference#lv1_clear_spe_interrupt_status 0x80000043 - HV_Syscall_Reference#lv1_get_spe_interrupt_status 0x80000045 - HV_Syscall_Reference#lv1_get_logical_ppe_id 0x80000049 - HV_Syscall_Reference#lv1_set_interrupt_mask 0x8000004A - HV_Syscall_Reference#lv1_get_logical_partition_id 0x8000004E - HV_Syscall_Reference#lv1_get_spe_irq_outlet 0x8000005B - HV_Syscall_Reference#lv1_get_repository_node_value 0x8000005F - HV_Syscall_Reference#lv1_read_htab_entries 0x80000061 - HV_Syscall_Reference#lv1_set_vmx_graphics_mode 0x80000062 - HV_Syscall_Reference#lv1_set_thread_switch_control_register 0x80000074 - HV_Syscall_Reference#lv1_allocate_io_segment 0x80000076 - HV_Syscall_Reference#lv1_allocate_ioid 0x80000078 - HV_Syscall_Reference#lv1_construct_io_irq_outlet 0x8000007C - HV_Syscall_Reference#lv1_undocumented_function_124 0x8000007D - HV_Syscall_Reference#lv1_undocumented_function_125 0x8000007E - HV_Syscall_Reference#lv1_undocumented_function_126 0x80000088 - HV_Syscall_Reference#lv1_undocumented_function_136 0x8000008C - HV_Syscall_Reference#lv1_construct_lpm 0x8000008D - HV_Syscall_Reference#lv1_destruct_lpm 0x8000008E - HV_Syscall_Reference#lv1_start_lpm 0x8000008F - HV_Syscall_Reference#lv1_stop_lpm 0x80000090 - HV_Syscall_Reference#lv1_copy_lpm_trace_buffer 0x80000091 - HV_Syscall_Reference#lv1_add_lpm_event_bookmark 0x80000092 - HV_Syscall_Reference#lv1_delete_lpm_event_bookmark 0x80000093 - HV_Syscall_Reference#lv1_set_lpm_interrupt_mask 0x80000094 - HV_Syscall_Reference#lv1_get_lpm_interrupt_status 0x80000095 - HV_Syscall_Reference#lv1_set_lpm_general_control 0x80000096 - HV_Syscall_Reference#lv1_set_lpm_interval 0x80000097 - HV_Syscall_Reference#lv1_set_lpm_trigger_control 0x80000098 - HV_Syscall_Reference#lv1_set_lpm_counter_control 0x80000099 - HV_Syscall_Reference#lv1_set_lpm_group_control 0x8000009A - HV_Syscall_Reference#lv1_set_lpm_debug_bus_control 0x8000009B - HV_Syscall_Reference#lv1_set_lpm_counter 0x8000009C - HV_Syscall_Reference#lv1_set_lpm_signal 0x8000009D - HV_Syscall_Reference#lv1_set_lpm_spr_trigger 0x800000A3 - HV_Syscall_Reference#lv1_write_virtual_uart 0x800000A4 - HV_Syscall_Reference#lv1_set_virtual_uart_param 0x800000A5 - HV_Syscall_Reference#lv1_get_virtual_uart_param 0x800000A6 - HV_Syscall_Reference#lv1_configure_virtual_uart_irq 0x800000AA - HV_Syscall_Reference#lv1_open_device 0x800000AB - HV_Syscall_Reference#lv1_close_device 0x800000AC - HV_Syscall_Reference#lv1_map_device_mmio_region 0x800000AE - HV_Syscall_Reference#lv1_allocate_device_dma_region 0x800000AF - HV_Syscall_Reference#lv1_free_device_dma_region 0x800000B0 - HV_Syscall_Reference#lv1_map_device_dma_region 0x800000B1 - HV_Syscall_Reference#lv1_unmap_device_dma_region 0x800000B2 - HV_Syscall_Reference#lv1_read_pci_config 0x800000B3 - HV_Syscall_Reference#lv1_write_pci_config 0x800000C5 - HV_Syscall_Reference#lv1_connect_interrupt_event_receive_port 0x800000CF - HV_Syscall_Reference#lv1_enable_logical_spe 0x800000D2 - HV_Syscall_Reference#lv1_gpu_open 0x800000D4 - HV_Syscall_Reference#lv1_gpu_device_map 0x800000D6 - HV_Syscall_Reference#lv1_gpu_memory_allocate 0x800000D9 - HV_Syscall_Reference#lv1_gpu_context_allocate 0x800000DD - HV_Syscall_Reference#lv1_gpu_context_iomap 0x800000E1 - HV_Syscall_Reference#lv1_gpu_context_attribute 0x800000E3 - HV_Syscall_Reference#lv1_gpu_context_intr 0x800000E4 - HV_Syscall_Reference#lv1_gpu_attribute 0x800000F5 - HV_Syscall_Reference#lv1_storage_read 0x800000F6 - HV_Syscall_Reference#lv1_storage_write 0x800000F9 - HV_Syscall_Reference#lv1_storage_get_async_status
LPAR / AUTH ID's
Name | Auth ID | Self (/dev_flash/ps2emu) |
Notes |
---|---|---|---|
PS2_LPAR | 0x1020000003000001 | ps2_emu.self | |
*SCE_CELLOS_SYSTEM_MGR_PS2 | 0x107000001D000001 | ||
PS2_GX_LPAR | 0x1020000003000001 | ps2_gxemu.self | |
*SCE_CELLOS_SYSTEM_MGR_PS2_GX | 0x107000001D000001 | ||
PS2_SW_LPAR | 0x1020000003000001 | ps2_softemu.self | |
*SCE_CELLOS_SYSTEM_MGR_PS2_SW | 0x107000001D000001 | ||
PS2_NE_LPAR | 0x1020000003000001 | ps2_netemu.self | |
*SCE_CELLOS_SYSTEM_MGR_PS2_NE | 0x107000001D000001 |
Getting compatibility hardware info
See: PS2_Compatibility#Software
ps2bootparam.dat
A file created at path: dev_hdd0/tmp/game/ps2bootparam.dat
- See: ps2bootparam.dat
Cobra core
taken from storage_ext.c
patch_ps2emu_entry(ps2emu_type);
- sets proper ps2_(gx/soft)emu.self path for reboot
- patches ss_storage service 0x5004 disc checks on ss_server3.self inside lv1
(Change from Parameter li r3, 2 and li r3, 1E (Drive Authentification) to li r3, 0x29 (Reset Drive))
- and the usual either replace read/ioctl for iso etc.
Game CONFIG
Some of the PS2 emulator types (such ps2_gxemu.self, ps2netemu.self) are able to load config commands that are applyed "by game ID". The concept of "game patches" is not technically correct because some of the commands does patching functions but others does other things (not patching), and other commands works as switches or sets a value that are enviromental settings for the emulator (not for the game) but because are applyed "by game" should be considered enviromental settings for that specific game, so for simplification purposes you can think in all this data as "game configs"
This "game config" data seems to work in the same way for all the PS2 emulator types but can be located in different places, some are hardcoded inside the emulators itself (inside the .self), and at the time the "PS2 classics" emulator (ps2_netemu.self) was developed this config can be loaded from an external file
In short, the "game configs" can modify the game image (by patching it) and can be used to configure the virtual PS2 (the emulated machine). And can be loaded from hardcoded data (inside the .self) or from an external file (this feature is supported only by ps2_netemu.self)
The config data consists in a list of concatenated values of 8 bytes lenght (uint32_t), and can be processed like this:
union{ uint32_t command ...data... }
Config Commands
ps2_netemu.self fw4.50 sub_12D7D8, fw4.81 sub_12E050 params are uint32_t unless noted.
At the time of writing this, most of the commands are completely or partially unknown.
If you want to read some speculation and brainstorming about them, please join the Discussion page
CMD ID | Example | Notes | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
0x00 | Copy following title id for enforcing if available. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x01 | 2x uint32_t Params ( addr, func_id 0-0x3B) - EE_ADD_HOOK
Most of 0x01 commands are strictly per game fixes, or at least per game engine. [Grand Theft Auto 3 (EU)] uses 0x349790, 0x10 (somewhat floats related) [Max Payne] uses 0x52E9F4, 3 and 0x52EB78, 2 (set lwsync 0) Maximum Amount of Usage: ? (The command is used 3 times consecutively by SLUS-20565 (Champions of Norrath) and SLUS-21494 (Need for Speed Carbon) game configs hardcoded inside ps2_gxemu.self)
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x02 | 1 Param, Config file revision ? | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x03 | 0 Param, sets something 0 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x04 | 1 Param uint32_t index (i*0x80, special 0x12345: 0x91a280?) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x05 | read next command | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x06 | 0 Param, sets something 0x14F80 (85888'd) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x07 | 1 Param uint32_t (default 1)
Delay VU xgkick by X cycles | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x08 | 8 Param uint32_t (read mask,read mask, original opcode, original opcode, write mask, write mask, replace opcode, replace opcode)
Maximum Amount of Usage: 3 times Patch VU memory by mask | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x09 | uint32_t count, <list> (offset, original opcode, original opcode, replace opcode, replace opcode) - EE_INSN_REPLACE64
[Dark Cloud] uses 1 [Dead Or Alive 2 Hardcore] uses 1 Maximum List Count: 32 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x0A | uint32_t count, <List> (offset, original opcode, replace opcode) - EE_INSN_REPLACE32 --- command present only in the ps2_netemu
[Deadly Strike] uses 1 [Dragon Force] uses 2 Maximum List Count: 32 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x0B | 1 Param uint32_t count, <List> {sector id, offset, sizeof present opcodes, replace opcodes, original opcodes} - MECHA_SET_PATCH
offset on disc = sector id * sector size + offset (-0xC for DVD [not always applied, see Psychonauts or SRS: Street Racing Syndicate configs], +0x18 for CD [raw 2352 sector size]) [Dead Or Alive 2 Hardcore] uses 7 [Gradius V] uses 1 [Grand Theft Auto III] uses 1 [Katamari Damacy] uses 1 [Manhunt] uses 1 [Odin Sphere] uses 2 [Primal] uses 1 [Psychonauts] uses 1 [Syphon Filter The Omega Strain] uses 1 Maximum List Count: 47 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x0C | 1 Param (uint16_t, uint16_t) --- 0/1/2,<0x63> | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x0D | 1 Param, true/false
Default Init = 1? 0 == skip some code, 1 == some code + checks | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x0E | 1 Param offset --- Improves ADD/SUB accuracy for selected offset (incl. Floats)
[Rygar] only has 0x147DA8 sub.s $f12, $f20, $f12 Used in official configs: SCUS97501=0x3C458C, SCES53642=0x3C4854, SLUS21026=0x386864, SLUS20916=0x121F64, SLUS20437=0x11EDF0 Maximum Amount of Usage: 31 times | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x0F | List <uint32_t Param, uint32_t Param> --- More accurate memory range (FPU mul/div/sub/add accuracy related)
[Dark Cloud] uses 0x239334, 0x1FFFFFF [Grand Theft Auto SA] uses 0x1E46DC, 0x1E4AE8 Maximum List Count: 31 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x10 | List <uint32_t Param, uint32_t Param> --- More accurate memory range (COP2, mul/div/sub/add accuracy related) - MULDIV_Accurate_range
Maximum List Count: 31 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x11 | 1x uint32_t Param. ADD/SUB accuracy related, all emulated ADD/SUB instruction variations check that value. Param seems to be VU memory offset (need confirmation).
Used in official configs: SLUS21172=0x208, SLUS20878=0x140,0x368,0x570 Maximum Amount of Usage: 31 times | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x12 | <List> (uint32_t count,
[Primal] uses 0xD [Rayman Arena] uses 0x11 [Syphon Filter: The Omega Strain] uses 0x5 00 00 00 0? 00 00 00 00 type? count? ... Maximum List Count: 63 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x13 | 1x uint64_t Param --- Memory card timing related
Jak X: Combat Racing uses 0xf960 (63840) Netsu Chu! Pro Yakyuu 2004 uses 0xf960 (63840) Phantasy Star Universe uses 0x9bdc (39900) WRC II Extreme uses 0x9bdc (39900) Burnout Dominator uses 0x9bdc (39900) Jissen Pachi-Slot Hisshouhou! Kemono-Oh uses 0x1d394 (119700) Used in official configs: SCUS97429=0xF960(63840), SLPM66031=0x9BDC(39900), SLPS20131=0x1D394(119700) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x14 | 0 Param, sets something 1 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x15 | 4 | 1 Param ( <1, >1 ), different settings/mode?
[Bloodrayne 2] uses 4 [GRIMgRiMoiRe] uses 4 [Mana Khemia 2] uses 4 [Odin Sphere] uses 4 [SMT Persona 3 FES] uses 4 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x16 | = 0x05 (next id) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x17 | 1 | 1 Param, true/false?
[Bully] uses 1 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x18 | = 0x16 = 0x05 (next id) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x19 | 0 Param, sets something 1 --- SB_SIO2 related?
[Grand Theft Auto III] [Red Faction 2] [Siren] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x1A | 0 Param, sets something 1 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x1B | 0 Param, sets something 1
[Mana Khemia 2] | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x1C | read uint32_t (use uint8_t) Param (default 3) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x1D | read uint32_t (use uint8_t) Param | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x1E | read uint32_t (use uint8_t) Param | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x1F | uint32_t Param (default 0x3E8?) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x20 | uint64_t Param (default 0x3C)
Config value is used as multiplier for some value, and result is used in vsync related runtimes. Is worth to note that 0x3C is default multiplier even for PAL titles, so is not stricly related to framerate, but to vsync counters (where 0x3C is still wrong anyway..). Result of multiply is also compared at some point to vsync delay value. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x21 | 1 | 1 Param:
0 = sets an option from 1 to 0 and another one to 0, 1 = sets an option from 1 to 0 and another one to 1, 2 = sets an option from 1 to 1 and another one to 0 [Fatal Frame II] uses 0 [Grand Theft Auto Vice City] uses 1 [Grand Theft Auto III (EU)] uses 1 [SMT Persona 3 FES] uses 0 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x22 | 0 Param, sets something 1 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x23 | 0 Param --- memcpy 0x100 Bytes and sets 0x14E00 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x24 | uint64_t Param | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x25 | = 0x18 = 0x16 = 0x05 (next id) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x26 | List <uint32_t Param,uint32_t Param> --- Improves ADD/SUB accuracy for selected memory range (incl. Floats) - FPU_Accurate_range
[Bloodrayne 2] uses 0x340000, 0x350000 [Gradius V] uses 0x3046E0, 0x0x305E44 Maximum List Count: 31 Maximum Amount of Usage: ?? The command is used 4 times consecutively by [Strawberry Shortcake: The Sweet Dreams] SLES-54309 (EU) and SLUS-21497 (US) game configs hardcoded inside ps2_gxemu.self | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x27 | List <uint32_t Param,uint32_t Param> --- Improves COP2 operations accuracy for selected memory range - VU0 macromode accurate range
Maximum List Count: 31 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x28 | 1x uint32_t Param (<=3) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x29 | 2x uint32_t Param, | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x2A | 0 Param, sets something 1 --- Allow online downloadable content (HDD)? Multitap? Local 2 player?
All-Star Baseball 2004 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x2B | 0 Param, sets something 1 --- Allow disc eject/swap?
Dance Factory | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x2C | 1 Param, uint32_t
Summoner uses 0x1 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x2D | = 0x25 = 0x18 = 0x16 = 0x05 (next id) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x2E | 1 Param, uint32_t | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x2F | 1 Param, uint32_t --- SPU2 related?
Indigo Prophecy/Fahrenheit uses 0x1 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x30 | (nothing) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x31 | (nothing) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x32 | (nothing) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x33 | (nothing) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x34 | (nothing) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x35 | 0 Param --- Enables Force Flip Field, described in emu setting as "Fix for [Hang] for soft-lock" | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x36 | (nothing) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x37 | (nothing) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x38 | (nothing) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x39 | (nothing) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x3A | (nothing) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x3B | (nothing) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x3C | (nothing) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x3D | 1 Param, uint32_t Config file revision
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x3E | 0 Params --- Sets something 1
Default Init = 0 0 == do set some stuff, 1 == skip Similar to 0x0D with param 0. Affect the same code path, but skips more code. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x3F | 1 Param, uint32_t | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x40 | 0 Param --- Sets something 1
Grand Theft Auto SA Silent Hill Origins - unofficial fix | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x41 | 0 Param --- Sets something 1 (Disables some lwsync - speedhack?)
Dragon Force God Hand Gradius V Katamari Damacy | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x42 | EE Overlay patch. 2 main Params + patch data: uint32_t address, uint32_t count, opcode,opcode,opcode...
Address need to be in 0xFF000 - 0xFFFFC range. Count is size of patch in 4 bytes opcodes. So 5 opcode patch = count 5. Opcodes will be placed on selected address, we use only patch code, no need for original opcode. Next opcode addresses are auto calculated (+4..) so we need to specify only patch start address. Remember we need to jump to our new code, best way is command 0x0A with j (jump) opcode. Also is important to add return jump if required. That one need to be added in our 0x42 patch. Maximum opcodes count seems to be 0x3FF (1023 opcodes). | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x43 | 1 Param --- Equal to 0x40, but with Parameter:
0 = Default 1 = (like 0x40) param = -1 = failure? | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x44 | 0 Param --- Disables Smoothing and Smoothing option | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x45 | 0 Param --- Sets something 1
Phantasy Star Complete Collection | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x46 | 0 Param --- Enables L2H Improvement, [Performance] related setting for titles using L2H
SMT Digital Devil Saga 1 SMT Nocturne Fatal Frame II | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x47 | 0 Param --- Enables XOR CSR - XOR System Status Register (0x12001000)?, [Graphics] related setting, should fix fullscreen line corruption | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x48 | VSYNC Delay, 2x uint32_t Param
[SMT Digital Devil Saga 1] uses 1, 0x3D090 [Fatal Frame II] uses 0x2, 0xFFFFE69C (-6500 decimal) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x49 | 0 Param --- Sets something 0xB,0,0 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x4A | 0 Param --- Sets something 0x15100
Applies to the Snowblind Engine games. Fixes the rest of flickering textures. Meant to be used in conjunction with the GX/SOFT Snowblind Engine's specific commands (double 0x01 and 0x23 combo). | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x4B | Redirect SAVEDATA by ID, 2 x uint32_t Params + ID: offset, int, char[12]
For proper config we need at least 2 (can be more if needed) 0x4B commands, one to enable redirect, one to disable. First param is EE memory offset that when is hit enable/disable redirection. Second param is partially unknown, seems to be size of next param to read * 4 (3 in known configs), or 0xFFFFFFFF for disable redirect command. Third param is ID of SAVEDATA we want to use padded with 00 to match 12 bytes, or all 00 in disable redirect config. Important note here is that config have own 00 00 00 00 terminator at the end. So after 12 bytes of ID we need to add 4 bytes of 00. That apply also to disable redirect version. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x4C | 2x uint32_t Params: offset,int (2 = current path?, 3 = new ISO.BIN.ENC path?, other= ?) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x4D | 1 uint32_t Param (can be -1) --- Sets something (same as 0x49 but) 0xC, Param, 0 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x4E | (nothing) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x4F | (nothing) | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
0x50 | 0 Param --- Enables pressure sensitive controls |
Config file examples (for netemu)
Official PS2 Classic
See: PS2 Official Configs
Official GXEMU/SOFTEMU extracted
See: PS2 Official Configs
Custom Configs
See: PS2 Custom Configs
Config data examples (hardcoded)
Inside ps2_emu.self
Embedded patches are based on Checksum/Hash of title. ps2_emu is only emulator version where patches are described inside self file in ascii. Known patch types described in ascii are: Patch data, new SPU2 params, and Setting mecha HACK to show GODZCD as GODZCDDA.
PS2 Title | Hash | Game | Patch Type | Data |
---|---|---|---|---|
SCUS_971.46 | 0x6B1ADE00D | Disney's Treasure Planet | Patch data - Fixes black screen at start, it apply to STREAM_D.IRX file in IOP folder. | 0x147C (sector) , 0x580 (offset) (- 0xC on disc)
Replace opcodes 00 01 01 3C lui at,0x0100 80 BF 03 3C lui v1,0xBF80 C8 10 63 8C lw v1,0x10C8(v1) 24 18 61 00 and v1,at FB FF 61 10 beq v1,at, -0x10 00 00 00 00 nop Original opcodes FF FF 01 24 li at,-0x1 04 00 61 14 bne at,v1, +0x14 00 80 01 3C lui at,0x8000 02 00 41 14 bne at,v0, +0x0C 00 00 00 00 nop 0D 00 06 00 break |
SLUS_201.74 | 0x23D92589C5 | Rumble Racing | Patch data - fixes black screen after Playstation 2 logo. Patch apply to AUDIO.IRX file in MODULES folder | 0x3AEDA (sector), 0x120 (offset)
Replace opcodes 06 00 80 14 bnez a0, +0x1C 21 20 43 00 addu a0,v0,v1 21 10 A0 00 move v0,a1 02 00 A0 14 bnez a1, +0x0C 00 00 00 00 nop 01 00 05 24 li a1,0x1 EB FF 40 10 beqz v0, -0x50 04 00 84 24 addiu a0,0x4 FC FF 90 24 addiu s0,a0,-0x4 Original opcodes 07 00 80 14 bnez a0, +0x20 21 80 43 00 addu s0,v0,v1 21 10 A0 00 move v0,a1 02 00 A0 14 bnez a1, +0x0C 00 00 00 00 nop 01 00 05 24 li a1,0x1 FC FF 40 10 beqz v0, -0x0C 00 00 00 00 nop 04 00 04 26 addiu a0,s0,0x4 |
SLUS_211.96 | 0x24D92589D5 | Indigo Prophecy | new SPU2 params | 1 |
SLPM_661.93 | 0x608634992D | Fahrenheit (NTSC-J) | new SPU2 params | 1 |
SLUS_212.96 | 0x5CA15DF14D | Dance Factory | Setting mecha HACK to show GODZCD as GODZCDDA |
Inside ps2_gxemu.self/ps2_softemu.self
There are hundreds of configs hidden in ps2_gxemu, and ps2_softemu self files. Internal config structure is basing on custom hash based on Title ID, internal memory offset pointing to place where true patch instruction is, and count of used commands. When disc/iso is started emulator search for configs, and if config for selected ID exist, then emulator apply it by itself. Is not perfect way of applying patches, because some games use the same ID, but different content. Good example here is Star Wars Battlefront II SLUS-21240, where some versions of game can refuse to work because it apply bad patch.
PS2 Title | Hash | Game | Patch Type | Data |
---|---|---|---|---|
Known Emulation Bugs
This list known bugs inside emulator code that make emulation inaccurate. Since those are only EE side bugs for now, ps2_gxemu/ps2_netemu/ps_softemu share the same issues.
Bug | Description | Known Affected Games |
---|---|---|
Missing Emotion Engine Cache emulation | Emulating that is literally not possible without making games run at 3 fps. Fixed by patches to game image, or EE code. | Ice Age 2, DOA2: Extreme, Nascar 2009 (luckily fixed by instant VIF bug). |
Branch delay slot violation not supported on EE | Some games have Branch instruction inside Branch delay slots, this is not emulated correctly on EE (VU have proper emulation of that). This is patched in configs by rearangging MIPS code. | WRC 3,4,Rally Evolved, one of Action Replay discs. |
VIF is instant | There is no correct timing, or even attempt to emulate that. Everyting done by VIF0/1 is done right when pushed | Nascar 2009 is affected in possitive way, game don't have time to corrupt transfer. Probably many more games. |
XGKick is instant | Some games expect to XGKick happen few cycles in future, on PS3 is done instant. Fixed by config 0x07 which delay XGKick by selected value | WRC series, Wakeboarding Unleashed, TriAce games, World of Outlaws - Sprint Cars, Ty - The Tazmanian Tiger, dot Hack - G.U. series, and more |
COP2 instructions are instant | Some games rely on fact that COP2 operations can take some time, on PS3 emulators they are done instantly due to lack of correctly emulated pipeline Patched by rearranging mips code | FFX, FFX-2, Ghost in The Shell SAC, Ace Combat series, Sprint Cars 1/2, Black, Run Like Hell, Everblue 2, Dragon Quest - Shounen Yangus no Fushigi na Daibouken, and many more |
VU0 is not running in sync with EE core | Seems like old pcsx2 mVU approach is used where VU0 is running thousands of cycles ahead of EE. Partially resolved on emu using 0x12 command with 2/3 subcommands. | 24 The Game, ATV Quad Power Racing 2, Twisted Metal Head-On, Primal, Ghosthunter, Rayman Arena, Rayman 3, All games using M-bit. |
M-Bit not supported | Emulator ignore VU0 M-Bit, that cause issues for games that need it to work correctly. This is done because there is no way to sync correctly running VU0 without sync with EE. Partially resolved on emu using 0x12 command with 2/3 subcommands. | Totally Spies! Totally Party, Mike Tyson Heavyweight Boxing, My Street, Crash Twinsanity, Marvel Nemesis, Panzer Elite Action - Fields of Glory, TriAce games (speed optimizations only), Super Monkey Ball Adventure, most Eko Software games, and many more. |
Emulator Fail to save correct flag instances while ending VU0 program on Ebit | This cause few games to read bad flag status (not status flag!) on COP2. This is resolved on emu by forcing update of MAC flag on every STATUS flag read (by config 0x12), this cause slowdowns creating a lot of unnesessary operations. | Driving Emotion Type-S, State of Emergency 2, The Getaway Black Monday. |
Not updated status flag when VDIV/VSQRT/VRSQRT is done on COP2 | Potential bad flag state can cause a lot of issues that are not related on first sight | Yanya Caballista (already patched by custom config) |
In corner cases emu select wrong block pipeline state while processing Flag VU opcodes. | This can cause various issues, mostly SPS, missing graphic, specific slowdowns, etc. For now it was only confirmed that FSAND opcode don't ask for exact pipeline state, but looking at assembly of other opcode this rather affect all of them. | Tales of Legendia, more.. |
TitleID/DiscID in ps2_netemu.self
There are 193 titleIDs listed inside ps2_netemu.self. More precisely, into XPARAM2.ELF file of PS2 Bios included in ps2_netemu.self. XPARAM2.ELF is called by OSDSYS, then ID check is performed. If title ID match to one of included in the table, different IOP emulation settings are applied. There are internal flags related to every title ID included inside file, still unknown what they do. Also some arguments, in plain text. File in real ps2 is introduced in SCPH-750XX models so exactly when DECKARD Power PC chip exchanged original IOP chip. This can explain why it is still in PS3 netemu bios. Because PS3 it is ppc that can need the same/similar flags.
Original PS2 bios include similar list file called XPARAM.ELF, but Title IDs there are not the same, although some of them exist on both lists.
Command | Name |
---|---|
0x00 | TITLE_MASK |
0x01 | SIO2_MASK |
0x02 | DEV9_MASK |
0x03 | USB_MASK |
0x04 | SIF_DMA_SYNC |
0x05 | SIF_DMA_LOAD |
0x06 | DMAC_CH10_INT_DELAY |
0x07 | MECHA_RECOGTIME |
0x08 | CPU_DELAY |
0x09 | DEV5_INT_SPEED |
0x0A | CDVD_READ_DELAY |
0x0B | SPU2_BEHAVIOR |
ID | Title | Command | Value | Remarks |
---|---|---|---|---|
PBPX_952.01 | DVD Utility Disc Version 1.00 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PBPX_952.02 | DVD Utility Disc Version 1.01 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PBPX_952.03 | DVD Utility Disc Version 1.01 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PBPX_952.06 | DVD Player (Version 2.01) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PBPX_952.07 | DVD Player (Version 2.10) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PBPX_952.08 | DVD Player (Version 2.10) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PBPX_952.09 | DVD Player (Version 2.10) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PBPX_952.10 | DVD Utility Disc Version 2.10 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PBPX_952.11 | DVD Utility Disc Version 1.00 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PBPX_952.21 | DVD Player (Version 2.12) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PBPX_952.22 | DVD Player (Version 2.14) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PBPX_952.24 | DVD Player (Version 2.16) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PBPX_952.28 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag | |
PBPX_952.35 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag | |
PBPX_952.39 | Online Start Up Disc v3.0 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PBPX_955.01 | Linux for PS2 Beta Release 1 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PBPX_955.07 | Playstation 2 Linux Runtime Environment v1.0 (Disc 1) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PBPX_955.09 | Linux for PS2 Release 1.0 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PBPX_955.18 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag | |
PDPX_991.09 | DVD Player (Version 3.04) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PSXC_002.01 | PSX Update Disc 1.10 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PSXC_002.02 | PSX Update Disc 1.20 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PSXC_002.03 | PSX Update Disc 1.31 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
PTPX_970.38 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag | |
SCAJ_201.25 | Tekken 5 | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
SCAJ_201.26 | Tekken 5 | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
SCES_532.02 | Tekken 5 | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
SCKA_200.49 | Tekken 5 | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
SCPM_621.15 | 0x00 | 0x1000000 | TITLE_MASK | |
SCPM_621.16 | 0x00 | 0x1000000 | TITLE_MASK | |
SCPN_601.01 | PlayStation BB Navigator (Version 0.10) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
SCPN_601.30 | PlayStation BB Navigator (Version 0.20) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
SCPN_601.40 | PlayStation BB Navigator (Version 0.30) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
SCPN_601.50 | PlayStation BB Navigator (Version 0.31) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
SCPN_601.60 | PlayStation BB Navigator (Version 0.32) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
SCPS_110.01 | I.Q. Remix | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
SCPS_110.10 | Yoake no Mariko (Performance Pack Edition) | 0x01 | 0x1800 | SIO2_MASK |
SCPS_110.18 | Yoake no Mariko | 0x01 | 0x1800 | SIO2_MASK |
SCPS_110.21 | Yoake no Mariko 2nd Act (Limited Edition) | 0x01 | 0x1800 | SIO2_MASK |
SCPS_110.22 | Yoake no Mariko 2nd Act | 0x01 | 0x1800 | SIO2_MASK |
SCPS_150.38 | Lifeline | 0x0A | 0x80300 | CDVD_READ_DELAY |
SCPS_150.39 | Lifeline | 0x0A | 0x80300 | CDVD_READ_DELAY |
SCPS_170.01 | Gran Turismo 4 | 0x0B | 0x10000000 | SPU2_BEHAVIOR |
SCPS_175.01 | Linux (for PlayStation2) Release 1.0 | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
SCPS_200.39 | 0x00 | 0x4000000 | TITLE_MASK | |
SCUS_971.67 | PaRappa the Rapper 2 | 0x04 | 0x2000 | SIF_DMA_SYNC |
SCUS_972.69 | Final Fantasy XI [Disc 2] | 0x02 | 0xB | DEV9_MASK |
SLES_500.48 | Donald Duck: Quack Attack | 0x01 | 0x800 | SIO2_MASK |
SLES_500.62 | Orphen: Scion of Sorcery | 0x08 | 0xC1C | CPU_DELAY |
SLES_503.64 | City Crisis | 0x0A | 0x80BB8 | CDVD_READ_DELAY |
SLES_504.46 | Shadow Man 2: The Second Coming | 0x0A | 0x80600 | CDVD_READ_DELAY |
SLES_505.40 | Simpsons: Road Rage | 0x01 | 0x800 | SIO2_MASK |
SLES_506.08 | Shadow Man 2: The Second Coming | 0x0A | 0x80600 | CDVD_READ_DELAY |
SLES_506.28 | Simpsons: Road Rage | 0x01 | 0x800 | SIO2_MASK |
SLES_507.28 | Tiger Woods PGA Tour 2002 | 0x0A | 0x803E8 | CDVD_READ_DELAY |
SLES_507.29 | 0x0A | 0x803E8 | CDVD_READ_DELAY | |
SLES_512.82 | Tiger Woods PGA Tour 2003 | 0x0A | 0x803E8 | CDVD_READ_DELAY |
SLES_514.79 | Def Jam Vendetta | 0x01 | 0x802 | SIO2_MASK |
SLES_518.41 | SpyHunter 2 | 0x01 | 0x800 | SIO2_MASK |
SLES_518.44 | Time Crisis 3 | 0x01 | 0x800 | SIO2_MASK |
SLES_519.97 | SWAT: Global Strike Team | 0x01 | 0x800 | SIO2_MASK |
SLES_520.97 | SWAT: Global Strike Force | 0x01 | 0x800 | SIO2_MASK |
SLES_530.37 | Super Monkey Ball Deluxe | 0x01 | 0x802 | SIO2_MASK |
SLES_536.68 | Micro Machines v4 | 0x01 | 0x801 | SIO2_MASK |
SLES_537.55 | Castlevania: Curse of Darkness | 0x04 | 0x10 | SIF_DMA_SYNC |
SLES_537.96 | FIFA Street 2 | 0x01 | 0x1800 | SIO2_MASK |
SLPM_620.42 | Kurogane no Houkou: Warship Commander | 0x01 | 0x3000 | SIO2_MASK |
SLPM_620.62 | Gitaroo Man One | 0x0A | 0x80540 | CDVD_READ_DELAY |
SLPM_621.05 | Taikou Risshiden IV | 0x09 | 0x2B47000A | DEV5_INT_SPEED |
SLPM_621.24 | Ready 2 Rumble Boxing: Round 2 | 0x08 | 0x1388 | CPU_DELAY |
SLPM_621.25 | Gauntlet: Dark Legacy | 0x08 | 0xC1C | CPU_DELAY |
SLPM_621.25 | Gauntlet: Dark Legacy | 0x09 | 0x2B470005 | DEV5_INT_SPEED |
SLPM_621.35 | Final Fantasy: XI (Beta Version) | 0x00 | 0xA0000000 | TITLE_MASK, 0xA0000000 = Blacklist, boot after removing flag |
SLPM_621.54 | DDRMAX Dance Dance Revolution 6thMix | 0x08 | 0x1A5E | CPU_DELAY |
SLPM_622.39 | Supercar Street Challenge | 0x0A | 0x80300 | CDVD_READ_DELAY |
SLPM_623.69 | Karaoke Revolution: J-Pop Vol.1 | 0x08 | 0x1388 | CPU_DELAY |
SLPM_623.79 | Karaoke Revolution: J-Pop Vol.2 | 0x08 | 0x1388 | CPU_DELAY |
SLPM_623.80 | Karaoke Revolution: J-Pop Vol.3 | 0x08 | 0x1388 | CPU_DELAY |
SLPM_623.81 | Karaoke Revolution: J-Pop Vol.4 | 0x08 | 0x1388 | CPU_DELAY |
SLPM_623.82 | Karaoke Revolution: Love & Ballad | 0x08 | 0x1388 | CPU_DELAY |
SLPM_623.83 | Karaoke Revolution: Night Selection 2003 | 0x08 | 0x1388 | CPU_DELAY |
SLPM_624.14 | Karaoke Revolution: Dreams & Memories | 0x08 | 0x1388 | CPU_DELAY |
SLPM_624.37 | Suisui Sweet: Amai Ai no Mitsukekata | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
SLPM_624.50 | Karaoke Revolution: Anime Song Selection | 0x08 | 0x1388 | CPU_DELAY |
SLPM_624.51 | Karaoke Revolution: J-Pop Vol.5 | 0x08 | 0x1388 | CPU_DELAY |
SLPM_624.54 | Karaoke Revolution: J-Pop Vol.6 | 0x08 | 0x1388 | CPU_DELAY |
SLPM_624.55 | Karaoke Revolution: J-Pop Vol.7 | 0x08 | 0x1388 | CPU_DELAY |
SLPM_624.56 | Karaoke Revolution: J-Pop Vol.8 | 0x08 | 0x1388 | CPU_DELAY |
SLPM_624.57 | Karaoke Revolution: Snow & Party | 0x08 | 0x1388 | CPU_DELAY |
SLPM_624.64 | Pop'n Taisen Pazurudame Online | 0x08 | 0x1F40 | CPU_DELAY |
SLPM_624.79 | Karaoke Revolution: J-Pop Vol.9 | 0x08 | 0x1388 | CPU_DELAY |
SLPM_624.91 | Mega Man: The Power Battle | 0x04 | 0x2000 | SIF_DMA_SYNC |
SLPM_624.92 | Karaoke Revolution: Kids Song Selection | 0x08 | 0x1388 | CPU_DELAY |
SLPM_625.28 | Karaoke Revolution: Kazoku Idol Sengen (Bundle Edition) | 0x08 | 0x1388 | CPU_DELAY |
SLPM_625.29 | Karaoke Revolution: Kazoku Idol Sengen | 0x08 | 0x1388 | CPU_DELAY |
SLPM_650.86 | A Visual Mix: Ayumi Hamasaki Dome Tour 2001 (Disc 1) | 0x08 | 0x1450 | CPU_DELAY |
SLPM_650.87 | A Visual Mix: Ayumi Hamasaki Dome Tour 2001 (Disc 2) | 0x08 | 0x1450 | CPU_DELAY |
SLPM_650.90 | Spy Hunter | 0x01 | 0x1800 | SIO2_MASK |
SLPM_651.97 | Nobunaga's Ambition Online | 0x02 | 0xB | DEV9_MASK |
SLPM_652.09 | Star Ocean: Till the End of Time | 0x0B | 0x20014 | SPU2_BEHAVIOR |
SLPM_654.38 | Star Ocean: Till the End of Time (Director's Cut) (Disc 1) | 0x0B | 0x20014 | SPU2_BEHAVIOR |
SLPM_654.39 | Star Ocean: Till the End of Time (Director's Cut) (Disc 2) | 0x0B | 0x20014 | SPU2_BEHAVIOR |
SLPM_654.88 | Grand Theft Auto: Vice City | 0x0A | 0x300 | CDVD_READ_DELAY |
SLPM_654.88 | Grand Theft Auto: Vice City | 0x09 | 0x36000200 | DEV5_INT_SPEED |
SLPM_656.33 | I Love Baseball: Pro Yakyu wo Koyonaku | 0x08 | 0xFA0 | CPU_DELAY |
SLPM_656.98 | Love Songs: ADV Futaba Riho 14-sai Natsu | 0x0A | 0x80380 | CDVD_READ_DELAY |
SLPM_657.05 | Final Fantasy XI: Chains of Promathia (Expansion Disc) | 0x02 | 0xB | DEV9_MASK |
SLPM_657.06 | Final Fantasy XI: Chains of Promathia (All-In-One Edition) | 0x02 | 0xB | DEV9_MASK |
SLPM_657.19 | Burnout 3: Takedown | 0x01 | 0x1C00 | SIO2_MASK |
SLPM_657.83 | Nobunaga no Yabou Online: Tappi no Shou | 0x02 | 0xB | DEV9_MASK |
SLPM_658.94 | Winning Post 6: 2005 Version | 0x01 | 0x2400 | SIO2_MASK |
SLPM_659.34 | Maple Colors | 0x0A | 0x80300 | CDVD_READ_DELAY |
SLPM_659.53 | Final Fantasy: XI (Entry Disc 2005) | 0x02 | 0xB | DEV9_MASK |
SLPM_659.84 | Grand Theft Auto: San Andreas | 0x0A | 0x803E8 | CDVD_READ_DELAY |
SLPM_660.33 | The Sword of Etheria | 0x08 | 0xC1C | CPU_DELAY |
SLPM_660.33 | The Sword of Etheria | 0x00 | 0x2000000 | TITLE_MASK |
SLPM_660.48 | The Sword of Etheria | 0x08 | 0xC1C | CPU_DELAY |
SLPM_660.48 | The Sword of Etheria | 0x00 | 0x2000000 | TITLE_MASK |
SLPM_660.57 | Taito Memories Vol.1 | 0x08 | 0xCE4 | CPU_DELAY |
SLPM_661.56 | Marheaven: Arm Fight Dream | 0x01 | 0x1800 | SIO2_MASK |
SLPM_661.75 | Akumajo Dracula: Yami no Juin | 0x08 | 0x60 | CPU_DELAY |
SLPM_661.75 | Akumajo Dracula: Yami no Juin | 0x0B | 0x2001C | SPU2_BEHAVIOR |
SLPM_663.93 | Final Fantasy XI: Treasures of Aht Urhgan (All-In-One Edition) | 0x0A | 0x803E8 | CDVD_READ_DELAY |
SLPM_663.93 | Final Fantasy XI: Treasures of Aht Urhgan (All-In-One Edition) | 0x09 | 0x2B47000A | DEV5_INT_SPEED |
SLPM_663.93 | Final Fantasy XI: Treasures of Aht Urhgan (All-In-One Edition) | 0x02 | 0xB | DEV9_MASK |
SLPM_663.94 | Final Fantasy XI: Treasures of Aht Urhgan | 0x02 | 0xB | DEV9_MASK |
SLPM_664.36 | Aria the Natural | 0x01 | 0x1800 | SIO2_MASK |
SLPM_664.36 | Aria the Natural | 0x00 | 0xA000000 | TITLE_MASK |
SLPM_665.39 | Nobunaga no Yabou Online: Haten no Shou | 0x02 | 0xB | DEV9_MASK |
SLPM_665.58 | Tomb Raider: Legend | 0x08 | 0x3E8 | CPU_DELAY |
SLPM_665.74 | Detective Evangelion | 0x00 | 0x2000000 | TITLE_MASK |
SLPM_680.07 | Karaoke Revolution (Trial) | 0x08 | 0x1388 | CPU_DELAY |
SLPM_680.10 | 0x08 | 0x1388 | CPU_DELAY | |
SLPS_200.08 | Morita Shogi | 0x08 | 0x1388 | CPU_DELAY |
SLPS_200.20 | FIFA 2000 World Championship | 0x04 | 0x2001 | SIF_DMA_SYNC |
SLPS_200.37 | Go Go Golf | 0x09 | 0x2B47000A | DEV5_INT_SPEED |
SLPS_200.38 | Grappler Baki: Baki Saidai no Tournament | 0x08 | 0x1194 | CPU_DELAY |
SLPS_200.53 | Tenshi no Present: Marle Oukoku Monogatari (Limited Edition) | 0x0B | 0x20000000 | SPU2_BEHAVIOR |
SLPS_200.66 | Tenshi no Present: Marle Oukoku Monogatari | 0x0B | 0x20000000 | SPU2_BEHAVIOR |
SLPS_201.01 | City Crisis | 0x0A | 0x80BB8 | CDVD_READ_DELAY |
SLPS_201.11 | Magical Sports Pro Baseball 2001 | 0x09 | 0x2B47000A | DEV5_INT_SPEED |
SLPS_201.72 | Koushien: Konpeki no Sora | 0x09 | 0x2B47000A | DEV5_INT_SPEED |
SLPS_201.73 | Hard Hitter 2 | 0x0A | 0x80300 | CDVD_READ_DELAY |
SLPS_201.97 | Surfing Air Show with RatBoy | 0x09 | 0x2B47000A | DEV5_INT_SPEED |
SLPS_201.99 | F1 2002 | 0x0B | 0x20005 | SPU2_BEHAVIOR |
SLPS_202.00 | Final Fantasy XI | 0x02 | 0xB | DEV9_MASK |
SLPS_204.04 | Rakushou! Pachi-Slot Sengen 2 | 0x0A | 0x80300 | CDVD_READ_DELAY |
SLPS_204.29 | Hissatsu Pachi-Slot Evolution: Ninja Hattori-Kun V | 0x08 | 0x1B58 | CPU_DELAY |
SLPS_204.55 | Simple 2000 Series Vol.94: The Aka-Champion - Come on Baby | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
SLPS_250.08 | Sorcerous Stabber Orphen | 0x08 | 0xC1C | CPU_DELAY |
SLPS_250.71 | A Visual Mix: Ayumi Hamasaki Dome Tour 2001 | 0x08 | 0x1450 | CPU_DELAY |
SLPS_250.72 | A Visual Mix: Ayumi Hamasaki Dome Tour 2001 | 0x08 | 0x1450 | CPU_DELAY |
SLPS_250.81 | Saishuu Densha | 0x0A | 0x803E8 | CDVD_READ_DELAY |
SLPS_251.36 | Kuon no Kizuna Sairin Mikotonori | 0x0A | 0x805DC | CDVD_READ_DELAY |
SLPS_251.42 | Tiger Woods PGA Tour 2002 | 0x0A | 0x803E8 | CDVD_READ_DELAY |
SLPS_251.50 | Only You | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
SLPS_252.37 | Only You | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
SLPS_252.75 | Def Jam: Vendetta | 0x01 | 0x802 | SIO2_MASK |
SLPS_252.78 | Memories Off: Mix | 0x0A | 0x80300 | CDVD_READ_DELAY |
SLPS_252.90 | Time Crisis 3 | 0x01 | 0x800 | SIO2_MASK |
SLPS_253.15 | One Piece: Grand Battle 3 | 0x01 | 0x1800 | SIO2_MASK |
SLPS_253.57 | 3-Nen B-Gumi Kinpachi Sensei: Densetsu no Kyoudan ni Tate! | 0x01 | 0x1800 | SIO2_MASK |
SLPS_253.79 | Tokyo Majin Gakuen: Kaihoujyou Kefurokou | 0x0A | 0x803E8 | CDVD_READ_DELAY |
SLPS_254.06 | Hitman: Contracts | 0x08 | 0xDAC | CPU_DELAY |
SLPS_254.18 | Ace Combat 5: The Unsung War | 0x0A | 0x500000 | CDVD_READ_DELAY |
SLPS_255.10 | Tekken 5 | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
SLPS_255.85 | Monster Farm 5: Circus Caravan | 0x07 | 5 | MECHA_RECOGTIME |
SLPS_255.86 | Tales of the Abyss | 0x0A | 0x803E8 | CDVD_READ_DELAY |
SLPS_256.04 | Ar tonelico Qoga: Knell of Ar Ciel | 0x00 | 0xA000000 | TITLE_MASK |
SLPS_256.67 | Daito Giken Premium Pachi-Slot Collection: Yoshimune | 0x01 | 0x1800 | SIO2_MASK |
SLPS_256.98 | Fatal Fury Battle Archives Volume 2 | 0x00 | 0xA000000 | TITLE_MASK |
SLPS_257.08 | The Familiar of Zero (Limited Edition) | 0x0A | 0x803E8 | CDVD_READ_DELAY |
SLPS_257.09 | The Familiar of Zero | 0x0A | 0x803E8 | CDVD_READ_DELAY |
SLPS_257.21 | HimeHibi - Princess Days | 0x0B | 0x8000000 | SPU2_BEHAVIOR |
SLPS_257.22 | Routes PE (Limited Edition) | 0x08 | 0x3E8 | CPU_DELAY |
SLPS_257.27 | Routes PE | 0x08 | 0x3E8 | CPU_DELAY |
SLPS_732.49 | Ar tonelico Qoga: Knell of Ar Ciel (Platinum) | 0x00 | 0xA000000 | TITLE_MASK |
SLUS_200.11 | Orphen: Ocion of Sorcery | 0x08 | 0x1388 | CPU_DELAY |
SLUS_200.11 | Orphen: Ocion of Sorcery | 0x09 | 0x8000010 | DEV5_INT_SPEED |
SLUS_200.77 | Donald Duck: Go'in Quackers | 0x01 | 0x800 | SIO2_MASK |
SLUS_202.74 | City Crisis | 0x0A | 0x80BB8 | CDVD_READ_DELAY |
SLUS_203.05 | Simpsons: Road Rage | 0x01 | 0x800 | SIO2_MASK |
SLUS_203.64 | Tiger Woods PGA Tour 2002 | 0x0A | 0x803E8 | CDVD_READ_DELAY |
SLUS_204.13 | Shadowman 2 | 0x0A | 0x80600 | CDVD_READ_DELAY |
SLUS_204.33 | SWAT: Global Strike Team | 0x01 | 0x800 | SIO2_MASK |
SLUS_204.88 | Star Ocean: Til the end of Time [Disc 1] | 0x08 | 0x1388 | CPU_DELAY |
SLUS_205.72 | Tiger Woods PGA Tour 2003 | 0x0A | 0x803E8 | CDVD_READ_DELAY |
SLUS_205.90 | Spyhunter 2 | 0x01 | 0x800 | SIO2_MASK |
SLUS_206.35 | Muppets Party Cruise | 0x01 | 0x801 | SIO2_MASK |
SLUS_206.39 | Def Jam Vendetta | 0x01 | 0x800 | SIO2_MASK |
SLUS_206.86 | Splashdown: Rides Gone Wild | 0x0A | 0x80400 | CDVD_READ_DELAY |
SLUS_208.38 | All-Star Baseball 2005 | 0x01 | 0x802 | SIO2_MASK |
SLUS_208.51 | Ace Combat 5: The Unsung War | 0x0A | 0x500000 | CDVD_READ_DELAY |
SLUS_208.91 | Star Ocean: Til the end of Time [Disc 2] | 0x08 | 0x1388 | CPU_DELAY |
SLUS_209.18 | Super Monkey Ball: Deluxe | 0x01 | 0x800 | SIO2_MASK |
SLUS_210.59 | Tekken 5 | 0x0B | 0x40000000 | SPU2_BEHAVIOR |
SLUS_210.70 | Final Fantasy XI: Chains of Promathia | 0x02 | 0xB | DEV9_MASK |
SLUS_210.89 | Karaoke Revolution Vol.3 | 0x08 | 0x1388 | CPU_DELAY |
SLUS_213.31 | Sonic Riders | 0x01 | 0x800 | SIO2_MASK |
SLUS_213.39 | Puzzle Challenge | 0x01 | 0x800 | SIO2_MASK |
SLUS_214.04 | Final Fantasy XI: Treasures of Aht Urhgan | 0x02 | 0xB | DEV9_MASK |
SLUS_214.52 | Valkyrie Profile 2: Silmeria | 0x08 | 0x1388 | CPU_DELAY |
Other game patches (unofficial)
There are other unofficial ways to patch the PS2 games such the pnach format, or the widescreen patches that allows 16:9 screen output for some games by hex editing the ISO, or by applying ppf patches. Games work fine on PS3 with same compatibility like before patching. Also some 480p (aka progressive scan) patches work fine. http://ps2wide.net/
The problem of this methods is the patch is applyed over the ISO and is modifyed permanently, but this problem can be avoided in PS3 because that unofficial patches can be "ported" to the official config format to be used by ps2_netemu.self, by using the official config format the settings and patchs from the config file are applyed "on the fly" and the ISO is not modifyed
ps2_title_brute code
A script to calculate whatever this encode is that is used in ps2emu, gxemu and softemu from given input title id.
It contains code for bruting as well. Just call gen_sum with the title id in a specific format to get it.
title_ = "SLUS_200.73"
#patches = [0x6b1ade00dL, 0x23d92589c5L, 0x24d92589d5L, 0x608634992dL, 0x5ca15df14dL]
#patches = [0x37ae1cb18dL, 0x608634999dL, 0x06b1ade00dL, 0x5fc674d915L, 0x178e3c9165L, 0x3889349935L,0x18fe4ce145L,0xc126943985,0xe90ebc11b5,0x58be0ca165L]
patches = [ 0xCD1298155L, 0x12C93199A5L, 0x15C93199ADL, 0x24D92589A5L, 0x2CD12D8125L, 0x34C9359935L, 0x34C93599E5L, 0x34C93599E5L, 0x449961C9E5L, 0x4C9169C1CDL, 0x4C9169C1D5L, 0x4C9169C1DDL, 0x4C9169C1E5L, 0x4C9169C1F5L, 0x4C9169C1FDL, 0x4CB14DE12DL, 0x54A955F915L, 0x5CA15DF165L, 0x5CA15DF1FDL, 0x5CA15DF1FDL, 0x649965C94DL, 0x649965C955L, 0x649965C95DL, 0x649965C965L, 0x649965C96DL, 0x6BB149E15DL, 0x6C916DC165L, 0x6C916DC1A5L, 0x6C916DC1ADL, 0x6C916DC1B5L, 0x6C916DC1D5L, 0x6C916DC1DDL, 0x748975D9DDL, 0x7C817DD125L, 0x7C817DD165L, 0x7C817DD16DL, 0x7C817DD175L, 0x7C817DD1CDL, 0x84798529BDL, 0x8559A109ADL, 0x8579852915L, 0x8579852965L, 0x8D51A90145L, 0x8D51A901B5L, 0x8D51A901BDL, 0x8D718D21BDL, 0x9C619D31E5L, 0x9D41B911ADL, 0x9D619D31C5L, 0x9F29357805L, 0x9F293578E5L, 0xB549B51915L, 0xB549B51925L, 0xB549B5195DL, 0xB549B519A5L, 0xB549B519ADL, 0xBC61793025L, 0xBD41BD1105L, 0xC439C569F5L, 0xC7716D20D5L, 0xC7716D20D5L, 0xCA11E941F5L, 0xCF7965285DL, 0xCF7965285DL, 0xD20911582DL, 0xD7617D308DL, 0xE339C1695DL, 0xE794CCB06DL, 0xEA3129608DL, 0xEC11ED4115L, 0xEF594508D5L, 0xF409F559ADL, 0xF7415D10E5L, 0xF7415D10E5L]
def gen_sum(title):
var_30 = []
for i in range(0x1A):
var_30.append(0)
r9=5
r31=0
#Title 2 decimal
while r9 != 0xB:
r11 = r9 + 1
if r9 == 8:
pass
else:
r5 = ord(title[r9:r9+1])
r7 = r31 * 0xA
r6 = r7 & 0xFFFFFFFF
r4 = r5 + r6
r9 = r4 - 0x30
r31 = r9 & 0xFFFFFFFF
r9 = r11
#print r31
r10 = ord(title[3:4]) # S
r7 = (r31 >> 10) & 0x7F
r11 = ord(title[1:2]) # L
r8 = ord(title[2:3]) # U
r6 = (r10 >> 1) & 0x3F
r12 = ord(title[0:1]) # S
r4 = (r11 >> 3) & 0xF
r5 = (r8 >> 2) & 0x1F
r3 = (r12 >> 4) & 7
r9 = r10 << 7
r0 = r8 << 6
r10 = r11 << 5
r8 = r12 << 4
r12 = r31 << 3
r11 = r10 | r5
r9 = r9 | r7
r0 = r0 | r6
var_30[2] = r11 & 0xFF
r7 = r8 | r4
var_30[0] = (r9 & 0xFF)
r10 = r12 | r3
var_30[1] = (r0 & 0xFF)
r12 = (r31 >> 2) & 0x3FFFFFF8
var_30[3] = (r7 & 0xFF)
r8 = 5
var_30[4] = (r10 & 0xFF)
var_30[0x19] = (r12 & 0xFF)
var_30[0x18] = (r8 & 0xFF)
var_30 = [int(v) for v in var_30]
#print [hex(v) for v in var_30]
r5 = var_30
r6 = 0
r4 = 0
while r6 < 5:
r12 = r5[r6:r6+1][0]
r7 = r6 + 1
r0 = var_30[0x19]
r3 = r6 + 0x10
r9 = r12 ^ r0
r31 = r3
r5[r6] = r9
r6 = r7
r5[r31] = r4
#print [hex(v) for v in r5]
r9 = 0
r10 = 0
while r10 < 5:
r11 = r10 + 1
r6 = r5[r10:r10+1][0]
r4 = r9 << 8
r10 = r11
r9 = r4 | r6
return r9
'''
print hex(gen_sum(title_))
a1='A'
a2='A'
a3='A'
a4='A'
while a1 <= 'Z':
a2='A'
a3='A'
a4='A'
while a2 <= 'Z':
a3='A'
a4='A'
while a3 <= 'Z':
a4='A'
while a4 <= 'Z':
#print "%s%s%s%s" % (a1,a2,a3,a4)
for i in range(99999):
t = "%s%s%s%s_" % (a1,a2,a3,a4) + '{4}{3}{2}.{1}{0}'.format(i%10,(i/10)%10,(i/100)%10,(i/1000)%10,(i/10000)%10)
if gen_sum(t) in patches:
print t
print True
a4=chr(ord(a4)+1)
print "%s%s%s%s" % (a1,a2,a3,a4)
a3=chr(ord(a3)+1)
print "%s%s%s%s" % (a1,a2,a3,a4)
a2=chr(ord(a2)+1)
a1=chr(ord(a1)+1)
'''
print hex(gen_sum("SLUS_213.86"))
'''
for i in range(99999):
t = "SLUS_" + '{4}{3}{2}.{1}{0}'.format(i%10,(i/10)%10,(i/100)%10,(i/1000)%10,(i/10000)%10)
if gen_sum(t) in patches:
print "%s %x" % (t, gen_sum(t))
'''
External References
- Digital Foundry vs. PS2 Classics on PS3
- PS2 Classics Algorithm By flatz
- C port
- Alternative Compatibility List (outdated)
- How to properly convert Final Fantasy XII: IZJS For ps2classics
- Wikipedia list of officially released PS2 Classics
CPU-GPU intensive games + games only playable in software render on PCSX2:
- http://wiki.pcsx2.net/index.php/Category:GPU_intensive_games
- http://wiki.pcsx2.net/index.php/Category:CPU_intensive_games
- http://wiki.pcsx2.net/index.php/Category:Software_rendering_only_games