September 27, 2011 // 2:29 pm
- Today PlayStation 3 hacker schevens
has detailed how to run PlayStation 1 (PSX / PSOne) game backups on PS3 3.55 CFW for Custom Firmware users.
Currently the method works on Kmeaw and Rebug CFW from the multiMAN File Manager instead of the PS3 XMB (they only get recognized as "PS2 DISK" there), the PS1 games are region-free and a Using PSX Eboots (to Save CD's) Guide
is also available along with a Guide to Dumping, Burning and Playing PS1 Backups on PS3
To quote: Hi there, I am ScHeVeNs a German PS3 Developer, I have found a way, to boot any burned PS1 Backup Game, its not very hard to make...
- PS3 with 3.55 CFW (maybe also a 3.41 machine, but not tested in moment!) (I use Rebug 3.55.2 for that)
- multiMAN latest version!
- PS1 Backup on burned Disk
- Start your PS3
- Insert your burned PS1 copy
- Start multiMAN
- Go to filemanager mode
- Search for: dev_flash\ps1emu,
- Press X on ps1_emu.self
- Tada, your PS1 backup will now boot and you see the PSLogo Bootscreen.
Maybe this works also on PS2 Games Backups but i have a PS3 slim... and can not test this!
Have fun with this... And give $ony a slap in her... face.
this is living!!!
has discovered how to get Save Game to work along with an alternate method for undetected PS1 backup game discs as follows:
- Turn on you PS3 console
- DON'T open multiMAN
- In the GAME column look for “Memory Card Utility (PS/PS2)”
- Create a PS1 memory card
- Set it to Slot 1 (Press Triangle while selecting the Memory Card, then Assign it)
- Now, run multiMAN
- Insert your backup disc
- Load it
- Memory Card is in Slot 1, no need to mess with it anymore.
Alternate method for undetected PS1 backup game discs:
- Kmeaw FW 3.55
- multiMAN v02.07.06
- A PS1 backup (CD-R) that IS detected in multiMAN XMMB as a PS1 game (not file manager).
- The PS1 backup (CD-R) that is NOT detected.
- While in multiMAN, make sure no disc is inserted (just in case).
- Insert the backup disc that gets detected by multiMAN as a PS1 disc.
- Press and choose Load.
- Wait for the game to start normally, to make sure wait until something from the game is on screen.
- Press the "PS" button
- 2 screens will come up, we don't want the regular XMB screen so press "PS" again
- While the lower menu is up Press the Eject button on your console (don't turn it off or anything, lets just get the disc out)
- Remove the disc, and insert the disc that does NOT get detected.
- Wait at least 10 seconds.
- Select "Reset the game" from the menu and hit "yes".
- Done!, the PlayStation boot logo should appear and the game should be loaded!
In summary from I <3 Sony
(via jailbreakscene.com/main/2011/09/boot-playstation-1-psx-backups-on-ps3-running-custom-firmware-v3-55/) on How to Save PS1 Games:
Create a PS1 memory card under Memory Card Utility (PS/PS2) and set it to Slot 1. Now, multiMAN will be able to access and save to this slot.
Note: Be sure to NOT run multiMAN before creating Slot 1 or it may not work. Also if you are unable to to boot a PS1 game via multiMAN and have an original (pressed) Breaker Pro Disc available you can load it from the XMMB, then simply eject and swap the disc for your PS1 game backup to load it.
Next up, Nas_Plug
(aka Nas Plugi
) has posted a PSISOIMG0000 public key (below) and 45677c07a0670619f589e763c2c8391638dde4af on the PS3 Dev wiki (ps3devwiki.com/index.php?title=Keys&curid=3&diff=14470&oldid=14271#PSISOIMG0000) talk page (ps3devwiki.com/wiki/User:Nas_plugi) while tommydanger
(via lan.st/showpost.php?&p=1243&postcount=1) posted the following PSX EBOOT details, to quote:
[Register or Login to view code]
Hi, I thought I would share my findings about the PSX Eboots. (official ones) It's by far not complete, there is still many unknown. (at least to me
) (I haven't found a place with a proper discussion about it yet
) But I hope with the help of others we are able to reverse engineer the format much quicker. Feel free to correct me If I got something wrong.
- 16 Byte file with the "keys" required to run the game?
If you try to run the game without the keys.bin present it gives you CA000005 error on 3.02 OE-B. I don't know if this is a custom error code from Dax?! Used for XOR encryption -> memory card?!
- According to Dax bunch of pngs which hold the manual Encrypted
Infact if you try to enter the manual with no document.dat present, it states that there is no user manual.
You can however switch document.dat, it doesn't seem to be tied to the eboot (I could open Cool Boarders 2 manual even though I was playing Hot Shots Golf)
16 byte header which is the same on every document.dat. Starting with magic key 0"PGD", 0 Byte is followed by PGD followed by 2 4bytes which MSB is 1 and other 0 then followed by 4 0 Bytes to finish of the header.
00 50 47 44 01 00 00 00 01 00 00 00 00 00 00 00
- Contains the compressed ISO image of the psx game. 40Byte header, just like any other pbp.
Contains offset to:
- icon0 (icon you'll see in the xmb)
- pic0 (semi transparent png which is always in front of pic1)
- pic1 (full res background)
Psar offset points to "PSISOIMG0000" followed by 4 Bytes of unknown purpose. (Maybe some offset?) 16 bytes header, however only the last 4 bytes differ from eboot to eboot.
Resident Evil Directors Cut [JP]
50 53 49 53 4F 49 4D 47 30 30 30 30 00 B3 82 16
Cool Boarders [US]
50 53 49 53 4F 49 4D 47 30 30 30 30 C0 DD 7D 11
Hot Shots Golf 2 [US]
50 53 49 53 4F 49 4D 47 30 30 30 30 40 C2 F6 08
Immediately after the PSISOIMG0000 header there are some 0 bytes, which size vary from eboot to eboot (Note, there are some 0 bytes before the PSISOIMG0000 label too) After the 0 bytes there's a PGD header of unknown purpose
At the very bottom of every PSX Eboot you can find a PNG image. (I still have to figure the offset to it out) This is simply the image you will see when you execute your PSX Eboot. On a non PSX Eboot you would see the gameboot.pmf. I think it can be changed without breaking the eboot.
Then after the PNG image, theres another PGD header also of unkown purpose. After it -> EOF. (Maybe the 2 PGD files in it are responsible for the way the manual works.
e.g When you browse through the manual and say exit it at page 15 and then you reenter the manual or reenter after you exited the game it's still at page 15. I tested it on document.dat, leaving it on page 15 and then on page 20, nothing changed, file is still the same. So there must be some indicator that keeps track of which page you browsed the last, maybe these two PGD's have something to do with it?!)
- It saves at ms0:/PSP/SAVEDATA/GAMEID
- Ordinary param.sfo
- Png which was extracted from the eboot
- Always 1024 bytes. Purpose yet to be revealed
- Always 131104 bytes. Most likely imitates the PlayStation memory card file system Encrypted (xor keys.bin?!)
Yeah that's it for now, tell me what you think.
Finally, from Ada Love Lace
: I ll try to give some details:
For eboot.pbp from Tommydanger: Keys.bin is required when it s on PSP and need at least LCFW. It s probably unique per user account and per game, meaning the keys.bin for FF7 US will not work with the FF7 UE.
It's not really important because either you can run the game as iso (and so, the need of keys.bin is patched, and this way of patching have changed according to the cfw on PSP, but to resume the same key.bin, originally for hot shot golf, was used for others games)
This file is not required on PS3 but can be added on the folder CONTENT if you want to prepare your ps1 game to be exported (ps3 to psp copy) or added later on PSP directly. The iso bin edat can be see as more secure equivalent of this keys.bin file but on PS3.
Document.dat (manual of the game) as already said, it s not tied to the eboot.pbp but to the type of it (so document.dat for ps1 don t work on MINIS, and MINIS document.dat might have 2 different versions with the pgd algo)
Manual of the game will also appear in different way, since PS1 game don t have xmb in game. Minis s manual will appear when you press home button (you can trigger this on other hdd game category by changing your psn game to MN on param.sfo... but manual will not load)
The idea is to use this xmb function (as described, bunch of png read by the "pdf viewer" of ps3) on homebrew/ps3 games and to have custom manual. Config.bin is probably use to load the number disc according to the save data (when you start one game directly at disc 2)
Save games on PS3/PSP are not completely documented on the PS3 wiki but it's not really important because we can do without the missing part (the only really important part will be on header of .psv so you can use modified save data on higher ofw)
The other part of the article "so far we have" is not something i can understand (or only the fact the key is static)
The last part, "What we can do with this?:" if we have more advance, i m sure lot of tools/homebrews will be ready to use from other scene (yaroze or psp) May be one thing is to post on the wiki decrypted iso bin edat if you have them.
Team N0drm also is not so far, according to them "no thanks to you leeches we got around the need for that SDK update and pwned latest EDAT format! "...MINIS2.edat being used recently for psp remastered.
To resume, keys.bin (and i suspect the value can be also on iso.bin edat but will ask sandungas about it), eboot.pbp format, document.dat, config.bin are less or more documented, even the pgd algo) and not really important, even this new key for PSISOIMG0000 might not be so important.
The .edat file is probably more important (and so, the need of tools and example)
But the part "what we know so far" and the focus on ps1 game by some advance user is really promising (and in same area, i remember cobra's user saying final fantasy crisis core working).
About keys.bin, i might be wrong about the part of unique per user account after thinking ( well, it s trivial and easy to check if you already purchased ps1 game) For minis and export, i don t know how to make it working. The export function is easy to trigger, but there are fews checks on 3.55 and Sony might have change it and make it much more secure on higher FW. The interesting part of export will be for someone with PS VITA and PP category. Also during test for vbhl, irrc, some users were doing it with that function but have encounter some issue.
Here some example for keys.bin for research intended;
Chronos Cross SLUS01041:
56 88 57 C6 70 2D 42 2B 3A FA 8C B3 F1 1B 06 DC
Final Fantasy 7 SCES00868:
6A B9 09 C8 4D 2B A2 CA CA FD 07 7A 5F BD A0 5C
Final Fantasy 8 SLUS00892:
D3 47 EF 28 17 6F 6C 58 90 DF 5E 22 75 BD B1 E2
Metal Gear Solid SLUS00594:
E1 79 13 B7 37 22 F7 AF 80 E2 04 4E 5A 6E E3 7E
Legend of Mana SLUS01013 :
E2 ED 4D C0 D3 F2 50 BC BC 15 D9 37 47 70 B6 02
About config, the little i understand , it's like SYSTEM.CNF on original PS1 games.