PSX BOOT PROTECTION...Challenge !

[GoZeR]

Hi,

i found an very interesting post, regarding "perhaps" the possibility to bypass via 1:1 copy the PSX Boot protection without MODCHIP or CRACK !!!

get more information at:
hxxp://www.cdfreaks.com/news2.php3?ID=4339

i very hope, see one day a software which could really able to bypass this protection without modchip needed !

a dreams ?!
not sure..

(just my opinions...)

[VIPER_1069]

its a long running debate almost as long as psx has been available thats 10 years or more !??!

from what i know and learnt in that time is that original PSX disks are that the data is STAMPED into the disk or PRESSED onto them and no public available burner can read TRACK 1 of the disk as this is where the main boot code lies and my guess its right on the inner ring usually clear plastic on a blank disk out of range of a burners but just inside the travel of a psx lazer unit ! (this is my theory!) or around that area and the modechip replaces the boot code (TRACK1) , the protection code and the country code over and over and over injecting this information until the backup boots !

OTHER than this i hear that some hong kong whizz has made it possible to burn by modifying his burner !? but no details have been posted anywhere or diagrams how to do this or software to use to burn them !?

so i still say as many other gurus do IT SIMPLY CANNOT BE DONE ! simple as that !

[ASTRAPI]

Hi
any comments on this?
Source : cdfreaks

I've done a very cool reconnaissance: Now I know exactly where the PSX Laser searchs for the countrycode-bootsector. The place is exact 16-17 mm from the begin of the inner CD circle. I simply glued a small paper near the laser-lens and watched from the (under-)side at which location the lense moves when the BIOS looks for the "Bootsector". And because I have a switchable ModChip, I know now exact the location and priod of this 2 times, when this happens.

The location must be on the very edge of the LEAD-IN. And I've found Information that its possible to read out the Bootsector, and the next info, it was in italian language, but I've understanded it so far, the first! CountryCode protection is in the PREGAP!!

An other info told us the Country Code Bytes are streamed from the Subchannels, so its logic this Country Code is located in the PreGaps Subcode (this is a 2 seconds or 150 sector big "unused" space directly before the usual ISO or BIN Sector start, but on PSX-CDs these sectors start with 00 00 20 00 00 00 20 00 Subheader, which is Mode2 Data!).

O.K., What we need: A software which is able to Read out and burn the RAW uncorrected Pregap with Subchannels. I have already a burning Soft called "Gamejack" which is able to read out the Pregap, but doesn't write the 2448 Bytes big Sectors 1:1 on the CD.

It's pretty intresting to see the theories behind this protection that hasn't been bypassed for the all the years it has been on the market.


Its all together now threads Merged >>> joripe

[VIPER_1069]

this is already posted about here its the same article and related article >


Tnx Viper Threads Merged >>> joripe

[XxR0ckMAnxX]

i have been in the psx scene for a very long time and have had this discussion at least two times a year with some of the greatest psx hackers that have ever been active in the scene. i have heard theory after theory about how sony is doing this from ecc/edc checks, special pressed cds, global file checksums special optical technology in their cds ect....

this forum thread over at that forum is the same exact stuff that has been going on for years. Although i stongly commend his work i hate to say it but i dont think he is even close. it is easier to create a 1 wire modchip or wireless mod that boots everything at 100% than to cracks sonys protection.

i can tell you that it is in fact pressed into sonys cds, here are some pictures of pre-production cds commonly used with psx/ps2 dev units. Sonys copy protection for both memory cards and cd/dvd has now been collectively know by then as "magic gate"

[XxR0ckMAnxX]

another picture

[VIPER_1069]

ive had that pressed in data theory for long enough