How MOD chip works

It not certain how the protection is written on the original black disks, there are many discussions about this topic and still no one knows exactly what Sony does.
The theory that the first 4 sectors on the CD have altered error correction sectors seems to be the one that gets used most. Normal CDR writers are not capable of writing such sectors.

However it is certain what the actual data consists of once its read from the disk and floating around as
data in the PSX. The subcoded protection data that comes off an original disk consists of 4 bytes.
What these 4 bytes are depends on which country your disk came from. Basically the serial data is the
hexadecimal representation of SCEA (for USA) or SCEI (for Japan) or SCEE (for Europe). If the PSX does
not see the correct data for its home territory it assumes the disk is simply an audio CD and boots to the
music menu. There is other territorial information in the header of the data track but that does apply until
the disk has booted.

The modchip simply after a given length of time injects all 3 of the data strings one after the other and
keeps repeating the sequence until the disk has booted. During the boot sequence the PSX sees from one
of the 3 data strings the correct string of data that it is looking for. It assumes that the disk is an original
from its own territory and boots the disk.

When an original disk is used protection data is already present on the disk however this needs to be
blocked and then replaced with the fake data coming from the chip. If we don't block this data then original
disks will not boot as the data from the chip and the data from the disk intermangle afterwhich the PSX
just sees trash and refuses to boot the disk. This does not apply to copies as they have no protection
data on them so there is nothing there that needs to be blocked.

Heres the actual data that gets injected :

LINE01: DB 09h,0a9h,3dh,2bh,0a5h,0F4h ; ---- B4 = Japanese/NTSC
LINE02: DB 09h,0a9h,3dh,2bh,0a5h,074h ; ---- 74 = European/PAL
LINE03: DB 09h,0a9h,3dh,2bh,0a5h,0B4h ; ---- F4 = U.S./NTSC

Here are the ASCII representation of the codes:

Data line for USA disc:

0x9, 0xA9, 0x3D, 0x2B, 0xA5, 0xF4

In binary:

1001 10101001 00111101 00101011 10100101 11110100

Expand into bit groups with 1 start bit (high) and 2 stop bits (low):

1 00110101 00 1 00111101 00 1 01011101 00 1 01111101 00

Remove start & stop bits:

00110101 00111101 01011101 01111101

Reverse the bits of each byte/group:

10101100 10111100 10111010 10111110

One's complement:

01010011 01000011 01000101 01000001

Back to hex:

0x53, 0x43, 0x45, 0x41

Now, to ASCII:

S C E A --> "Sony Computer Entertainment America"

Also:

0x9, 0xA9, 0x3D, 0x2B, 0xA5, 0x74 --> S C E E
"Sony Computer Entertainment Europe"

0x9, 0xA9, 0x3D, 0x2B, 0xA5, 0xB4 --> S C E I
"Sony Computer Entertainment Inc." (Japan)

(A very big part of this page was downloaded from somewhere on the net, but i have lost the URL in order to give the appropriate credits to the author)

All trademarks and logos are copyright of their respective owners.
(C) 1998-1999-2000 Stelios Koroneos