david4599_hex Profile Banner
david4599 Profile
david4599

@david4599_hex

Followers
694
Following
387
Media
34
Statuses
223

Programming, reverse engineering and electronics. Mostly lurking on the internet, but working on stuff in background

France
Joined March 2014
Don't wanna be here? Send us removal request.
@david4599_hex
david4599
3 years
OMG IT WORKS!! 🥳 Selfbootable #PS1 CD-R! No modchip! That's a huge progress since last time but there are big reliability issues and I'm not sure that this can be fixed using my method. Increase the sound to hear the PS1 struggling to read the disc. More details below.
59
299
1K
@Grimdoomer
Ryan M
5 months
I know I said I retired from console hacking but I got one more in me. An Xbox 360 softmod is coming, no eta yet, THIS WILL TAKE TIME to finish
203
717
5K
@prank17_
prank17
10 months
I’ve completed the PSNee PCB for the PSone (PS1 Slim), easy to install and compatible with both NTSC and PAL versions. Everything is programmed on the latest generation ATtiny426. If you're interested: https://t.co/6VAPy5Az8r
6
36
210
@travisgoodspeed
Travis Goodspeed
1 year
Remote code execution on a Yamaha piano. https://t.co/Gt2Yf5zO1D
psi3.ru
17
280
2K
@david4599_hex
david4599
1 year
Too lazy to push the reset button every time I wanted to upload another program so I added a software reset feature (triggered from the computer) to the new PS1USB development cart :D
@onorisoft
OrionSoft
1 year
Firmware update v1.2 for the #PS1USB development cartridge, this adds a new software reset feature contributed by @david4599_hex If you are interested in this #Playstation1 dev cart, send me an email, Download update here https://t.co/Yw9Kyui43P #psxdev
0
0
9
@Voultar
Voultar
1 year
1/2 Friends, please share. This could be crippling! There has been a surge of PS1 counterfeits on markets such as AlieXpress. These counterfeit PS1 titles are being pressed onto a dark substrate which makes these counterfeits visually indistinguishable from the real deal.
86
279
907
@atc1441
atc1441
1 year
Just finished the new and until now biggest E-Paper Wall 3.0 🥳 Made out of 56 x 9.7" E-Paper Displays Find a video build log here: https://t.co/VeRIx05Al5
4
15
124
@_ramapcsx2
Robert Neumann
1 year
Hey guys, today the guys over on Ali have finally released their xStation clone. It's a pretty big blow for me, gotta say, but it was a good and long run. Depending on the hack used, this might not even update correctly. Consider your money, as I had already said once :p
79
37
389
@onorisoft
OrionSoft
2 years
New english video of #PS1USB a development cartridge for the #Playstation1 allowing data transfer between your computer and your #ps1 over USB #psxdev #ps1dev Check the pre-order page: https://t.co/Yw9Kyui43P
10
69
251
@onorisoft
OrionSoft
2 years
Sending and Executing a demo of 838KBytes in less than 7 seconds via USB on the #Playstation1 Anyone interested by a dev cartridge ? answer the poll below #ps1dev #psxdev #retrogaming #indiegamedev
4
9
40
@YveltalGriffin
YveltalGriffin
2 years
This is the PS Hanami, my handmade Playstation 1 portable that I designed and built in one month! It uses a REAL PS1 motherboard that I cut in half, folded like a book, and rewired. NO emulation! Details in🧵 https://t.co/WF8F8KgAiw
327
5K
34K
@david4599_hex
david4599
2 years
Then, the path (e.g. "cdrom:\SLUS_006.33;1") is extracted, some system reinitialization is made and finally, the LoadExec() function is called and the swapped game starts.
1
1
19
@david4599_hex
david4599
2 years
After L1 is released and if the previous flag is set, the SYSTEM.CNF file will be read and a search of the "BOOT" string will be done to know where the executable path is. The line in the file has the form "BOOT = cdrom:\SLUS_006.33;1".
1
2
14
@david4599_hex
david4599
2 years
Once the disc is stopped, we enter in a loop until we release L1. In this loop, we just check if the user presses both Square and Triangle which will set a flag. If this flag is not set, the secret feature ends and the selected level (6 here) will be loaded once L1 is released.
1
0
12
@david4599_hex
david4599
2 years
Then, one important part for swapping is the CdControlB() call where the command CdlStop is sent to stop the disc without resetting the wobble protection check.
1
2
14
@david4599_hex
david4599
2 years
The second trick is the characters shuffling. The list of the right character order is hardcoded. This means each character of "SESYF.MCTN" maps directly to this list. S = 2nd place, E = 4th place, S = 0th place, etc. This will ultimately decode as "SYSTEM.CNF".
1
0
15
@david4599_hex
david4599
2 years
So, in the function, we begin with the string "$2$.1Y:4#9" which doesn't seem to mean anything until we check the following do...while loop. The first trick in this loop is the usage of XOR (symbol "^") with the key 0x77 to encode the text. Once decoded, we have "SESYF.MCTN".
1
0
15
@david4599_hex
david4599
2 years
Why? Well, this text file is usually the first one loaded by the PS1 in the normal boot process and AFAIK, games don't need to read it. It just contains a few things like the game executable path that will be launched and that's actually why we need it here.
1
0
12
@david4599_hex
david4599
2 years
Then, some basic obfuscation is used to hide the "SYSTEM.CNF" string in the executable. Otherwise, this filename could be eye-catching and could lead to an easier discovery of this secret.
1
0
13
@david4599_hex
david4599
2 years
At the beginning, a check is made to verify that the user entered the super secret cheat code. If the flag is not set, the game just continues and the selected level will be loaded. There is also a check of the choosen level in the cheat menu which has to be 6.
1
0
16