5 ms·

The Hidden Secrets of Alien Resurrection on the PS1 [video]

45 points by skibz 3y ago

skibz 3y ago
The game on its own is rather interesting for its capabilities for the period, but even more interesting is the copy-protection bypass feature included as a cheat code that made it into the commercial copy of the game...
- FirmwareBurner 3y ago
  > copy-protection bypass feature included as a cheat code that made it into the commercial copy of the game.. Was that intentional feature from the devs or did the devs forgot to remove a development/debug feature from the final production build of the game by accident?
  - rkachowski 3y ago
    The video references the fact that the game was originally intended to be a multi disc release and this was a tech demo / test of the disc swap feature.
    - wildzzz 3y ago
      The code to do the disc swap was intentionally obfuscated. If it was really meant for a tech demo, why keep it in the retail build? If it was accidentally left in, why hide it? I feel like the most obvious answer is that a developer wanted a personal backdoor for playing pirated games. Another possible answer is that having the backdoor would allow the developer to get around paying for debug consoles ($5k at the time) that can play test builds off CD-Rs. You could buy like 16 retail consoles for the price of a single debug unit.
      - Crosseye_Jack 3y ago
        > I feel like the most obvious answer is that a developer wanted a personal backdoor for playing pirated games. My bet would be that it was left in to be more of a “private party trick” than a real means of piracy. Alien Resurrection came pretty late in the PS1 life cycle, by which time it was much cheaper to get a mod chip fitted to the console then it would be to purchase the game at retail (Even the stealth chips with much better mimicked the correct expected behavior which bypassed in game copy protection checks), and would boot the pirated game much quicker then using this method. But I guess it could have been a "Well if everything else fails, I'll still have this one weird trick up my sleeve", a method of last resort if Sony managed to pull a rabbit out of their hat in the later revisions of the console, but one that was never needed.
      - rkachowski 3y ago
        That's what was reportedly said by the developer in the video. I mean, if you did want to sneak in your own piracy backdoor I doubt you would publicly confess to it after any amount of time. That being said - going through an entire Sony Playstation certification, mastering and physical product distribution cycle in the year 2000 is a pretty intense (expensive, slow + outrageous consequences for everyone involved) way of getting around copy protection.
SleepilyLimping 3y ago
Ah, the "two-stick FPS? this will never work" game.
spicyjpeg 3y ago
As with seemingly everything PS1 related there is a healthy dose of misleading information here. What the game implements is known as an assisted swap trick and is nothing new, neither now nor at the time. In particular, after entering the cheat code, the game will: - stop the CD-ROM drive's spindle motor, so that the disc can be safely removed while manually holding the lid sensor down to trick the drive into thinking a licensed PS1 disc is still present; - wait for user input, as the lid sensor obviously cannot be used to determine when the new disc is ready; - turn the spindle motor back on and force the game's ISO9660 driver to rescan the contents of the disc; - parse SYSTEM.CNF, a text file containing the path to the main executable, then hand that path over to the kernel and let it load the game. The fact that the PS1's optical drive only validated a disc's license when it was first inserted, and didn't invalidate it until the lid switch was released, was a pretty well known one even back then. Swapping out a legitimate game for a burned one as it spun up during startup was a rite of passage for many PS1 owners, and plenty of third-party cartridges that would plug into the back of the console (before Sony eventually removed the port for that) offered assisted swap trick functionality as well. Some games with anti-piracy checks did actually force the drive to authenticate the disc multiple times in order to detect and block disc swapping. The video is partially misleading as it compares this feature to the likes of modern PS1 modding solutions such as Unirom or tonyhax, which do not require fiddling with the lid sensor as they instead activate an undocumented backdoor in the drive's firmware [1]. The backdoor was first discovered in 2013 and no code to enable it is known to be present in this game or in any officially pressed disc. For the reverse engineers out there, the function responsible for this feature is at 0x8003ec84 in ALIEN.BIN (which is a regular PS1 executable). Interestingly, the string "SYSTEM.CNF" is shuffled and XOR-obfuscated, possibly to reduce the chance of Sony and/or the general public finding out about the functionality. [1] https://psx-spx.consoledev.net/cdromdrive/#cdrom-secret-unlock-commands https://psx-spx.consoledev.net/cdromdrive/#cdrom-secret-unlo...
- mvg5000 3y ago
  Hi, video author here. feel like you're missing the point of the video. no one is saying its new. It's that it made it into a commercial game that passed through Sony TRC and was kept a secret for 23 years until the developer reached out to me
rthkljlkrj 3y ago
On the video he mentions the youtube channel of the guy who told him about this cheat code. That code has been running a youtube channel for 4 years and had at that time 529 subscribers. 2 hours after the shout out from a channel with 777k subscribers, he has 1000 subscribers.
doublerabbit 3y ago
Back then, I thought having to plug your controller in to controller port 2 for metal gear solid to beat psycho mantis battle was cool.
- computerfriend 3y ago
  I just replayed it and still think it's cool.

45 points by skibz 3y ago

The game on its own is rather interesting for its capabilities for the period, but even more interesting is the copy-protection bypass feature included as a cheat code that made it into the commercial copy of the game...

FirmwareBurner 3y ago
> copy-protection bypass feature included as a cheat code that made it into the commercial copy of the game.. Was that intentional feature from the devs or did the devs forgot to remove a development/debug feature from the final production build of the game by accident?
- rkachowski 3y ago
  The video references the fact that the game was originally intended to be a multi disc release and this was a tech demo / test of the disc swap feature.
  - wildzzz 3y ago
    The code to do the disc swap was intentionally obfuscated. If it was really meant for a tech demo, why keep it in the retail build? If it was accidentally left in, why hide it? I feel like the most obvious answer is that a developer wanted a personal backdoor for playing pirated games. Another possible answer is that having the backdoor would allow the developer to get around paying for debug consoles ($5k at the time) that can play test builds off CD-Rs. You could buy like 16 retail consoles for the price of a single debug unit.
    - Crosseye_Jack 3y ago
      > I feel like the most obvious answer is that a developer wanted a personal backdoor for playing pirated games. My bet would be that it was left in to be more of a “private party trick” than a real means of piracy. Alien Resurrection came pretty late in the PS1 life cycle, by which time it was much cheaper to get a mod chip fitted to the console then it would be to purchase the game at retail (Even the stealth chips with much better mimicked the correct expected behavior which bypassed in game copy protection checks), and would boot the pirated game much quicker then using this method. But I guess it could have been a "Well if everything else fails, I'll still have this one weird trick up my sleeve", a method of last resort if Sony managed to pull a rabbit out of their hat in the later revisions of the console, but one that was never needed.
    - rkachowski 3y ago
      That's what was reportedly said by the developer in the video. I mean, if you did want to sneak in your own piracy backdoor I doubt you would publicly confess to it after any amount of time. That being said - going through an entire Sony Playstation certification, mastering and physical product distribution cycle in the year 2000 is a pretty intense (expensive, slow + outrageous consequences for everyone involved) way of getting around copy protection.

SleepilyLimping 3y ago

Ah, the "two-stick FPS? this will never work" game.

spicyjpeg 3y ago

As with seemingly everything PS1 related there is a healthy dose of misleading information here. What the game implements is known as an assisted swap trick and is nothing new, neither now nor at the time. In particular, after entering the cheat code, the game will: - stop the CD-ROM drive's spindle motor, so that the disc can be safely removed while manually holding the lid sensor down to trick the drive into thinking a licensed PS1 disc is still present; - wait for user input, as the lid sensor obviously cannot be used to determine when the new disc is ready; - turn the spindle motor back on and force the game's ISO9660 driver to rescan the contents of the disc; - parse SYSTEM.CNF, a text file containing the path to the main executable, then hand that path over to the kernel and let it load the game. The fact that the PS1's optical drive only validated a disc's license when it was first inserted, and didn't invalidate it until the lid switch was released, was a pretty well known one even back then. Swapping out a legitimate game for a burned one as it spun up during startup was a rite of passage for many PS1 owners, and plenty of third-party cartridges that would plug into the back of the console (before Sony eventually removed the port for that) offered assisted swap trick functionality as well. Some games with anti-piracy checks did actually force the drive to authenticate the disc multiple times in order to detect and block disc swapping. The video is partially misleading as it compares this feature to the likes of modern PS1 modding solutions such as Unirom or tonyhax, which do not require fiddling with the lid sensor as they instead activate an undocumented backdoor in the drive's firmware [1]. The backdoor was first discovered in 2013 and no code to enable it is known to be present in this game or in any officially pressed disc. For the reverse engineers out there, the function responsible for this feature is at 0x8003ec84 in ALIEN.BIN (which is a regular PS1 executable). Interestingly, the string "SYSTEM.CNF" is shuffled and XOR-obfuscated, possibly to reduce the chance of Sony and/or the general public finding out about the functionality. [1] https://psx-spx.consoledev.net/cdromdrive/#cdrom-secret-unlock-commands https://psx-spx.consoledev.net/cdromdrive/#cdrom-secret-unlo...

mvg5000 3y ago
Hi, video author here. feel like you're missing the point of the video. no one is saying its new. It's that it made it into a commercial game that passed through Sony TRC and was kept a secret for 23 years until the developer reached out to me

rthkljlkrj 3y ago

On the video he mentions the youtube channel of the guy who told him about this cheat code. That code has been running a youtube channel for 4 years and had at that time 529 subscribers. 2 hours after the shout out from a channel with 777k subscribers, he has 1000 subscribers.

doublerabbit 3y ago

Back then, I thought having to plug your controller in to controller port 2 for metal gear solid to beat psycho mantis battle was cool.

computerfriend 3y ago
I just replayed it and still think it's cool.