PSP dumping

F1ReB4LL
Posts: 3395
Joined: Mon Jun 08, 2026 1:26 am

Re: PSP dumping

Post by F1ReB4LL »

Jackal wrote:Maybe there are any optical drives that can be hacked/modified into reading UMD discs? Image
Has anyone tried to insert them into the PC drive? I've heard the ideas but were there any real experiments?

https://www.ecma-international.org/publ … MA-365.pdf -- looks like a normal DVD structure? Same sector format, same lead-in sector format, no BCA, are you sure they aren't readable? The centre hole is 11mm for UMDs vs 15mm for CDs/DVDs, so you either need a custom spindle or to carefully enlarge the hole before inserting it into the drive.
sarami wrote:Does anybody have the source code of UMD Killer PRX EDITION V1.5?
I want it because I haven't understood how to dump the disc in the kernel mode.
https://archive.org/download/UMDKillerV … .2_src.zip
https://archive.org/download/UMDKillerV … .5_src.zip
sarami
Posts: 1762
Joined: Mon Jun 08, 2026 1:27 am

Re: PSP dumping

Post by sarami »

Thanks. I understood how to show the letters in kernel mode screen.

ioctl command list
http://www.psdevwiki.com/ps3/Talk:PSP_E … ntal_Patch

Code: Select all

jpcsp/src/jpcsp/HLE/modules/IoFileMgrForUser.java
public int hleIoIoctl(int id, int cmd, int indata_addr, int inlen, int outdata_addr, int outlen, boolean async) {
    // UMD file seek set.
    case 0x01010005: {
    // UMD file ahead (from info listed in the log file of "The Legend of Heroes: Trails in the Sky SC")
    case 0x0101000A: {
    // Get UMD Primary Volume Descriptor
    case 0x01020001: {
    // Get UMD Path Table
    case 0x01020002: {
    // Get Sector size
    case 0x01020003: {
    // Get UMD file pointer.
    case 0x01020004: {
    // Get UMD file start sector.
    case 0x01020006: {
    // Get UMD file length in bytes.
    case 0x01020007: {
    // Read UMD file.
    case 0x01030008: {
    // UMD disc read sectors operation.
    case 0x01F30003: {
    // UMD file seek whence.
    case 0x01F100A6: {

ppsspp/Core/HLE/sceio.cpp
static u32 sceIoDevctl(const char *name, int cmd, u32 argAddr, int argLen, u32 outPtr, int outLen) {
    case 0x01F20001:  
        // Get UMD disc type
    case 0x01F20002:  
        // Get UMD current LBA
    case 0x01F20003:
    case 0x01F100A3:  
        // Seek UMD disc (raw)
    case 0x01F100A4:  
        // Prepare UMD data into cache.
    case 0x01F300A5:  
        // Prepare UMD data into cache and get status
    case 0x01F300A7:
        // Wait for the UMD data cache thread
    case 0x01F300A8:
        // Poll the UMD data cache thread
    case 0x01F300A9:
        // Cancel the UMD data cache thread
    // TODO: What do these do?  Seem to require a u32 in, no output.
    case 0x01F100A6:
    case 0x01F100A8:
    case 0x01F100A9:

static int __IoIoctl(u32 id, u32 cmd, u32 indataPtr, u32 inlen, u32 outdataPtr, u32 outlen, int &usec) {
    // TODO: Should not work for umd0:/, ms0:/, etc.
    // Get UMD sector size
    case 0x01020003:
    // Get UMD file offset
    case 0x01020004:
    case 0x01010005:
    // Get UMD file start sector.
    case 0x01020006:
    // Get UMD file size in bytes.
    case 0x01020007:
    // Read from UMD file.
    case 0x01030008:
    // Get current sector seek pos from UMD device file.
    case 0x01d20001:
    // Read raw sectors from UMD device file.
    case 0x01f30003:
    // Seek by sector in UMD device file.
    case 0x01f100a6:

complement
    sceIoDevctl: 0x01F20001 // pspUmdInfo
    sceIoDevctl: 0x01F20002 // Maximum Logical Block Address of L0 + L1
    sceIoDevctl: 0x01F20003 // Maximum Logical Block Address of L0

I found command
    sceIoDevctl: 0x01F20014 result=0x00000000 // always 05 80 00 32
    sceIoDevctl: 0x01F200A0 result=0x00000000 // 01 or 10 or 20
    sceIoDevctl: 0x01F200A1 result=0x80010016 // unknown (argument is out)
    sceIoDevctl: 0x01F200A2 result=0x80010016 // unknown (argument is out)
Last edited by sarami on Thu Aug 16, 2018 10:10 pm, edited 1 time in total.
DiscImageCreator, UmdImageCreator, Conv2multiBin, bin2wav, PS3Auth (needs login), [url=http://www.mediafire.com/file/5cgoy11x6ahc7qh/%2523recompressTo7z_20150109.bat/file]recompressTo7z_20150109.bat[/url]
LedZeppelin68
Posts: 80
Joined: Mon Jun 08, 2026 1:26 am

Re: PSP dumping

Post by LedZeppelin68 »

Hi, i have modded UMDKiller PRX edition and wish to explain, how it works

https://pastebin.com/iJsTSgST

the main part is this code

opening UMD for reading, not the file system, the media itself
fd = sceIoOpen("umd0:", PSP_O_RDONLY, 0777);

allocating buffer in memory
umdbuffer=malloc(2097152);

reading 1024 sectors in buffer
sceIoRead(fd, umdbuffer, 1024);

opening file for writing on memorystick
redump = sceIoOpen("ms0:/ISO/REDUMP.iso", PSP_O_WRONLY| PSP_O_CREAT | PSP_O_TRUNC, 0777);

writing buffer bytes to file
sceIoWrite(redump, umdbuffer, 1024*2048);

it works with sectors, not file system

working buffer is 1 or 2 megabytes doesn't affect the perfomance, ripping time is equal, PSFiller == UMDKiller (300 Mb Tron Evolution in ~3:30 minutes)

What have been modded.

the original killer reads and saves chunks of 512 sectors at once.
this is ok when the size of UMD is a multiple of 512 (my test Tron Evolution is multiple, what a luck)
and i can't understand if original source does have the routine to handle not multiple UMDs, maybe this sceIoRead is so clever and can handle it by itself?

ok, there is a function "sceIoLseek" it can show the end sector, and if we add +1, it will be the size of the UMD
there is another place, that stores complete size in sectors, 16th sector of UMD, at the offset 0x50h

16 * 2048 + 0x50h = 0x8050h

Tron Evolution (ULES-01494)

Code: Select all

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00008000  01 43 44 30 30 31 01 00 50 53 50 20 47 41 4D 45  .CD001..PSP GAME
00008010  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                  
00008020  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                  
00008030  20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20                  
00008040  20 20 20 20 20 20 20 20 00 00 00 00 00 00 00 00          ........
00008050  00 4A 02 00 00 02 4A 00 00 00 00 00 00 00 00 00  .J....J.........
00 4A 02 00 = 024A00h = 150016

I added this check, reading 16th sector and determine the full size of UMD

then I'm splitting the dumping process in two parts there it dumps chunks multiple of 1024
and the remaining non-multiple chunk

Code: Select all

range1 = umdFullSize / 1024;
range2 = umdFullSize % 1024;

umdbuffer=malloc(2097152);
for(i=0;i<range1;i++)
{
    sceIoRead(fd, umdbuffer, 1024);
    sceIoWrite(redump, umdbuffer, 1024*2048);
}
free(umdbuffer);

if(range2!=0)
{
    umdbuffer=malloc(range2*2048);
    sceIoRead(fd, umdbuffer, range2);
    sceIoWrite(redump, umdbuffer, range2*2048);
    free(umdbuffer);
}
this is more simple and clear solution

to use this PRX, your should place it in "seplugins" directory on memorystick
add the line to seplugins/vsh.txt "ms0:/seplugins/UMDKiller.prx 1" without quotes
1 means enabled

don't forget to reset the handheld, place umd in drive, wait until it appears in XMB and press NOTE button
Attachments
UMDKiller.zip
Imported Redump attachment 2136
(30.36 KiB) Downloaded 1 time
Last edited by LedZeppelin68 on Mon Jul 16, 2018 11:32 pm, edited 1 time in total.
user7
Posts: 2489
Joined: Mon Jun 08, 2026 1:26 am

Re: PSP dumping

Post by user7 »

I'm trying to dump a demo with a video partition from another region (Europe) than my PSP (USA) with UMD Killer. Fake Region didn't seem to help on CFW, it just goes to a black screen. Any advice?
All my posts and submission data are released into Public Domain / CC0.
User avatar
tossEAC
Posts: 1681
Joined: Mon Jun 08, 2026 1:26 am

Re: PSP dumping

Post by tossEAC »

You can't fake the region to rip UMD's, you need a PAL PSP, a long time ago using a pandora ms you could switch regions from USA Japan and Europe, but it was permanent, unless you re-done it back again.

I have a UMD Video with HK region and the only way I can dump it is with a Hong Kong Region PSP.

The fake region might do something more to do with the online side of things, if you fake the region to Japan, it might go on the Japanese sony network like my proper Japanese model does, maybe?
He who controls the SPICE... controls the UNIVERSE!
The SPICE must flow.
UnlockerPT
Posts: 311
Joined: Mon Jun 08, 2026 1:29 am

Re: PSP dumping

Post by UnlockerPT »

@sarami

just updated to the last version (had an older one) and in _disc.txt you removed (its an example of one of the dumps):
0x01F20014 is unknown: 05 80 00 32
0x01F200A0 is unknown: 01

just fyi:
i have two umd video that have the same dump but serial on umd is different: one has -V2 and the other doesn't have it.
And the difference i'm seeing is that the value for 0x01F200A0 is different :X
Last edited by UnlockerPT on Sun May 12, 2024 2:03 pm, edited 1 time in total.
PX-W5524TA, PX-708UF, TS-H352C, BW-16D1HT
Post Reply