Some Playstation games have additional protection to prevent copying
and importing. I will give some detail on SCEx modchip detection,
secondary disc check, disc swap, and LibCrypt. The game Spyro Year of the Dragon contains additional protection.
SCEx Codes:
- SCEI - Japan and other Asian Regions
- SCEA - North America
- SCEE - PAL Regions
Security Wobble:
Original discs are believed to utilize the tracking circuitry of the
CD-ROM to generate the SCEx code by having a section near the beginning
of the disc track spiral 'wobble' back and forth in a manner to encode
the ASCII characters for the SCEx code. During the spin up process if
the CD-ROM controller does not see the correct SCEx code it will not
allow Read commands as normal and the GetID command will inform the
software the disc is not licensed and not boot.
Swap Trick:
One of the simple ways around the SCEx code check is a Swap Trick.
An original game disc is inserted into the CD-ROM so that a legitimate
SCEx code is read and then the disc is changed while keeping the lid
switch sensor pressed so that the drive controller is unaware of the
change. See here for more detailed information.
SCEx Modchip Detection:
The most basic modchips will send one or even all three of these SCEx
codes constantly. This allowed the early protected games to easily
detect the modchip. Normally a protected game will seek to some
position in the middle of the disc and begin reading. It will then
reset the SCEx Counters in the CD-ROM controller which keep track of
how many SCEx codes were received. After a short time it will then read
how many SCEx codes were received. Without a modchip it would be zero.
Secondary Disc Check:
After the first protected games were released someone realized they
could bypass the protection in these games if the modchip was turned
off either by a switch or by a timer so that the game could boot up but
the modchip wouldn't still be sending the SCEx codes once the game
started. So in order to prevent this easy work around the protection
routine evolved. The new routine would first issue the command ReadTOC.
Despite its plain name the command does more than reading the Table of
Contents from the disc. ReadTOC also resets the disc security
authentication and checks for the SCEx code again. This means you
cannot simply turn off your modchip because the secondary disc check
would fail and the game would stop at the Software Terminated screen.
Another effect of the secondary disc check is it combats people who
were using a Swap Trick to play the game.
Disc Swap Protection:
Some games appear as though they attempt to detect if the game was
booted using a swap trick. The game will usually read the total number
of tracks with command GetTN and then using command GetTD it usually
checks the timecode of a track. If an unexpected response is received
it will trigger the protection. Normally when doing a swap trick the
Table of Contents from your original disc is still in memory and not
the Table of Contents from the disc you swapped in. This check seems
unnecessary in some games due to the secondary disc check updating the ToC and
rechecking the security code but I believe this is done for the Early
Japanese Consoles. See the swap trick information page.
Early Japanese Consoles:
The earliest Japanese consoles have vC0
CD-ROM controllers. These controllers do not support the ReadTOC
command and so the secondary disc check is not possible.
LibCrypt:
This protection was used primarily and I believe only in PAL regions.
It was absolutely not used in Japanese releases because the first
CD-ROM controllers don't support the subchannel reading commands
required for this protection. In theory it could have been used for
American releases but I don't believe it ever happened. The basic idea
of LibCrypt is the discs were mastered with bad Q subchannel data that
would be read to recover a 16-bit key which would be used to decrypt
game data. This worked because many CD writers and copying software
would not replicate this modified subchannel data. I believe if you use
the right software and your writer supports it you can burn a copy with
this data intact and not be bothered by the protection. Some LibCrypt
protected games may also be modchip protected.
Stealth Modchips:
These chips are designed to pass all the previously mentioned checks by
mimicing the correct behavior of using an original disc. They should
only generate the SCEx codes at the appropriate time.
Below are listings of protected games. This is not necessarily a complete list.
Protected North American Games:
- Cool Boarders 2001
- Crash Bash
- Dino Crisis
- Disney's The Emperor's New Groove
- Grind Session
- Legend of Dragoon
- MediEvil II
- MLB 2002, 2003, 2004, 2005
- NBA ShootOut 2002, 2003, 2004
- NCAA Final Four 2001
- NCAA GameBreaker 2001
- NFL GameDay 2001, 2002, 2003, 2004, 2005
- NHL FaceOff 2001
- Resident Evil: Survivor
- Spyro: Year of the Dragon
- Strider 2
- Tomba! 2: The Evil Swine Return
- Vandal Hearts II
- Wild Arms 2
- Yu-Gi-Oh! Forbidden Memories
Protected Japanese Games:
- Alundra 2
- Arc the Lad III
- Biohazard 3: Last Escape
- Breath of Fire IV
- Capcom Vs. SNK Millennium Fight 2000 Pro
- Dino Crisis
- Dino Crisis 2
- Final Fantasy VIII
- Gekisou Tomarunner
- Gungage
- PoPoRoGue
- Rockman Complete Works 1,2,3,4,5,6
- Rockman X5
- Rockman X6
- Saru! Get You! (Ape Escape)
- Seiken Densetsu: Legend of Mana
- Silent Hill
- Tron ni Kobun ( Misadventures of Tron Bonne )
- Vandall Hearts II
- Wild Arms 2
- Yu-Gi-Oh! Shin Duel Monsters
Spryo Year of the Dragon Protection:
This Spyro game has the same protection as later games for detecting
modchips and swap tricks. But unlike any other game it has layered
checks to detect any changes to the program. This is sometimes called
anti-crack protection. If you remove the code that checks for modchips
then other parts of the game will behave differently. You can still
play the game but you'll be informed early on that your game is hacked
and may not work properly. See the article
at TCRF for more details. The early cracks for the game after its
release all triggered this anti-crack protection and it was around 2
months before the group Paradox released a fully working cracked
version.
While developing Stealth Unlocker and focusing on support for Japanese
and Asian consoles I discovered how the anti-mod patch from TonyHax was
not going to work for the asian consoles. I had to develop my own
patches for bypassing the protection routines in games for them to
work. Because of this I had to do my own crack or patch for Spyro. I
came up with my own solution for the american version and implemented
it into Stealth Unlocker. Afterwards I thought it might be useful and
would be fun to turn that into my own stand alone patch that could be
applied to the ISO. As an added bonus this may be the first crack for
the revised version of the game which has important bug fixes. I did
try taking a quick look afterwards at the Paradox crack to see how they
dealt with it and as far as I could see they may have patched the
Kernel in some way to deal with it. I didn't look much closer than
that. The TonyHax anti-mod patch is also a Kernel patch but as
previously mentioned it would not help on the Japanese consoles.
MottZilla's Spyro 3 Protection Patch