Hacker News new | ask | show | jobs
by spicyjpeg 905 days ago
As with seemingly everything PS1 related there is a healthy dose of misleading information here. What the game implements is known as an assisted swap trick and is nothing new, neither now nor at the time. In particular, after entering the cheat code, the game will:

- stop the CD-ROM drive's spindle motor, so that the disc can be safely removed while manually holding the lid sensor down to trick the drive into thinking a licensed PS1 disc is still present;

- wait for user input, as the lid sensor obviously cannot be used to determine when the new disc is ready;

- turn the spindle motor back on and force the game's ISO9660 driver to rescan the contents of the disc;

- parse SYSTEM.CNF, a text file containing the path to the main executable, then hand that path over to the kernel and let it load the game.

The fact that the PS1's optical drive only validated a disc's license when it was first inserted, and didn't invalidate it until the lid switch was released, was a pretty well known one even back then. Swapping out a legitimate game for a burned one as it spun up during startup was a rite of passage for many PS1 owners, and plenty of third-party cartridges that would plug into the back of the console (before Sony eventually removed the port for that) offered assisted swap trick functionality as well. Some games with anti-piracy checks did actually force the drive to authenticate the disc multiple times in order to detect and block disc swapping.

The video is partially misleading as it compares this feature to the likes of modern PS1 modding solutions such as Unirom or tonyhax, which do not require fiddling with the lid sensor as they instead activate an undocumented backdoor in the drive's firmware [1]. The backdoor was first discovered in 2013 and no code to enable it is known to be present in this game or in any officially pressed disc.

For the reverse engineers out there, the function responsible for this feature is at 0x8003ec84 in ALIEN.BIN (which is a regular PS1 executable). Interestingly, the string "SYSTEM.CNF" is shuffled and XOR-obfuscated, possibly to reduce the chance of Sony and/or the general public finding out about the functionality.

[1] https://psx-spx.consoledev.net/cdromdrive/#cdrom-secret-unlo...

2 comments

Hi, video author here.

feel like you're missing the point of the video. no one is saying its new. It's that it made it into a commercial game that passed through Sony TRC and was kept a secret for 23 years until the developer reached out to me

I apologize for sounding offensive or otherwise dismissive of the discovery. I'm just clarifying what this actually is, as I have already seen discussions on Discord about this being a "game changing" exploit that will make copies of Alien Resurrection impossible to obtain for reasonable prices, or that it would have killed the console if it was discovered back in the day. While it is remarkable that this feature managed to make it past Sony's review process (and that it had obfuscation measures intentionally put in place), functionally it isn't any different from what unlicensed third party products such as the PS-X-Change or Import Player already did, and it's not like you strictly needed any of those to perform the disc swap trick anyway. A mention of those in the video, as well as a few more details on what the cheat code actually does behind the scenes, would have helped clear things up.

It's worth pointing out that there have been other instances of developers sneaking "forbidden" functionality past QA as well. For instance, an indie game developer famously tried to sneak a Perl (IIRC) interpreter into a Switch game and only got it taken down by Nintendo after publicly disclosing it.

Your clarification was provided based on baggage from discord that isn't talked about on the video at all.

The video never said that it would "make copies of the game impossible to obtain for reasonable prices" or that it would have killed the console.

You also said: > healthy dose of misleading information here (emphasis mine).

Charitably, "here" could be read as either the video or the HN thread, but since neither contain those points, I agree that your comment came off as dismissive since it reads as strawmanning both the video and the contents of this thread based on stuff that's happened on discord in order to swoop in with a correction that wasn't needed.

Otherwise, your post contained useful additional information.

Based on my own interests, the interesting thing in the video is indeed the points that the poster raised, namely how procedure used for multi-disc games got past Sony QA despite being a single disc game, which could have been flagged through scanning of the APIs called. (Presuming there weren't other genuine uses for the same API call outside of multi-disc games, which I'd be happy to learn about).

Was there another commercial game disc that did this? That seems to be central to the video’s point.