[HOME] [Japanese]
Playstation Programming without official tools

Private PlayStation programming by C/C++

Note: This document is translated by Japanese to English translation sofware. I don't know this is right or not.

Changed part


As development environment of PlayStation, there are a thing of pro business and a thing for amateur called a NET YAROZE , as what of Sony Computer Entertainment Inc. (SCEI) is official.

NET YAROZE is What fixed results, such as it being very attractive and constructing with a publishing company, and holding a contest or exhibiting a work by pre pre (experience version CD), left at the point that amateur can develop the soft hat of the game machine of the newest , (Thing cheap as development environment) For taking out lightheartedly, a student etc. is high expense. By closing nature that a soft hat can be exhibited only among members by predetermined web/news server, information shortage, etc., as whole, it is cold, and it ended, without assembling the member of 20,000 of a schedule.

However, without depending on such official development environment, it is what is large, and the world is analyzed uniquely, and technical information on PlayStation is exhibited or the man who is making the soft hat is also in it. Some soft hats and information are accumulated on NAPALM .

Programming of PlayStation in information/development environment which can come to hand lawfully is explained here. Finally the library for PS is built and it aims at free development environment by C/C++.

Getting development environment


In the first place, the personal computer (PC-AT compatible machine with ISA slot) for development and PlayStation main part for execution are required. Whether it is possible does not put in the parallel transmission cable and the transmission soft hat of Free Wing even by self-construction, or the note personal computer which does not have ISA slot if it purchases or other machines (PC-98).

Pro Action Replay for PlayStation

Pro Action Replay for PlayStation (PS-PAR) is the tool for game reconstruction of English DATEL company . It operates with putting to the extended terminal of PlayStation, and a basis basis is a thing for applying and converting a patch into a game and carrying out cheat such as getting items, not to decrease hit points.

Pro Comms Link

Pro Comms Link (PC-LINK) is ISA board for personal computers which makes it possible to communicate by similarly connecting PS-PAR and the personal computer (PC-AT compatible machine) of DATLEL company. It seems that the same thing for PC-98 also exists.


caetla replaces built-in software of PS-PAR, adds functions, such as transmitting and performing the program which the user created, by PC-LINK, and transforms PS-PAR into development environment. Mr. k-comm. is created and it is opened to the public by Deaf Dumb & Blind . Refer here to for a function or the detailed usage. For information written in English, refer NAPALM "CAETLA" section.

First, PS-PAR and PC-LINK are purchased from the import selling contractor who is mail-ordering on the advertisement of the specialty store in Akihabara, or a game lab, or Web. The price is about 1-20,000 yen in great numbers. Next, flash ROM of PS-PAR is replaced by caetla, and environment where the program on a personal computer can be transmitted to PlayStation, and can be performed is prepared.


Development is performed with the command line of DOS or DOS box of Windows95 fundamentally. If a compiler and a transmission tool are reconstructed, it is possible even on other OSs. PAR+caetla device driver and gcc patches (so-called ports) for BSD , are exhibited in PlayStation development with BSD .

GNU C/C++ Compiler

GNU C/C++Compiler (gcc) is a free C/C++ compiler corresponding to much platform. It corresponds to MIPS R3000 which is CPU of PlayStation. Since source wide distribution is carried out, if the machine (host) to develop, and an execution machine (target) are specified, it can build as a cross compiler.

GNU binutils

GNU binutilses are packages, such as assembler (as) linker (ld) librarian (ar) which corresponded to much platform similarly. If it is the development by the assembler, it is only here. Although a.out, coff, elf, etc. are partly in binary object form generally, "ecoff" is used by the NET YAROZE. Moreover, PlayStation original form called PSX-EXE commonly is used in the final file of CD-ROM. As for caetla, both correspond. There is a tool called eco2exe of hitmen in conversion of ecoff to PSX-EXE.

Although GCC and binutils can come to hand and can build the source personally from ftp site of every place , the compiled binary is opened to Win32/x68k by private CO HOMEPAGE (Japanese) or PSX GNU Compiler And Tools (English).

Although the document appended soft is English, since these are the soft hats on Unix from the first and various documents of Unix relation are translated into Japanese on the page of OS of Unix systems, such as Linux , FreeBSD , and NetBSD, There is also a document about these. It seems that moreover, there are also some Japanese books.

Although direction which knows only visual development environment of the latest Windows is probably a stake, it does not need to memorize that it is especially newer to have got used to GCC by x68k or MS-DOS (DJGPP) at the beginning.

Often using are the following options although many options are in GCC.

An assembler code (.s) is outputted.
An object (.o) is outputted.
Effective in optimization
-o <file>
An output file name is specified.
The definition of a macro is given.
link library named "libxx.a"
-Xlinker <option>
An option is passed to a linker.
Often using linker passed options
-Xlinker -Ttext -Xlinker <hex address>
generate address (CO gcc default is 80100000)
-Xlinker -meco/-mpsx
generate ECOFF/PSX-EXE format (CO gcc extentions:default is ELF)

GNU Make

Compile of two or more files etc. is automated by describing a file called Makefile according to format with fixed MAKE. Although it can use the batch file of DOS when compile of a long command line option or two or more files is troublesome, if MAKE is used, it can describe more briefly, and further, the date of a file is investigated and what is required can be compiled.

Probably, it is better to receive, since Makefile is appended to the convenient thing and the exhibited source, in many cases, although it is not indispensable. Although NMAKE of Microsoft, WMAKE of watcom, etc. also have a thing attached to an existing compiler, since format is delicately different, it is safe that GNU Make comes to hand.

Since MAKE does not carry out processing system dependence, it can use the compiled binary for djgpp or for mingw32 , etc. then.

Now, fundamental hardware environment and software environment became complete. So that the NET YAROZE, and development environment of pro business may use GCC as the base, since, it means that the almost same environment became complete. since a NET YAROZE are a maximum of 115200 bps serial transmission, its parallel transmission of PC-LINK is more comfortable rather -- about --.

It is an library that it is insufficient for only one. Although a thing called corresponding libc is a free-lancer and GCC is exhibited about general C standard function, there is no library depending on PlayStation called input and output of a pad and drawing of polygon. In the official development environment, although the library which controls hardware of PlayStation is attached, generally, such a thing is not exhibited. It needs to self-construction this portion.

These can be used, since analysis is made all over the world and many information is exhibited now, although for that it needs to know how hardware of PlayStation will have become uniquely.

Getting information on PlayStation

Information on CPU

And also -- since MIPS R3000 of CPU currently used for PlayStation is general CPU in a work station etc., -- English data can come to hand in the site of MIPS(since it was purchased by SGI now inside of SGI) of a developing agency There is also a sum translation family register called "MIPS RISC architecture R2000/R3000" (joint-establishment publication ISBN4-320-02598-9 C3041) common name "a blue book" (a cover is blue). Moreover, a command of R3000 is explained by the paradise play station .

Information peculiar to PlayStation

About the outline of hardware of PlayStation, although described even by PlayStation FAQ , a part of thing SCEI to a NET YAROZE is exhibited . Please refer to here about a term etc.

The reference and execution environment of a NET YAROZE library which spread information which can come to hand by the NET YAROZE when it becomes good general opening a part to the public in connection with a NET YAROZE, and a stop of exclusive server although opened to the public before only in the member by exclusive server are exhibited by WickedBeAT . Moreover, a NET YATOZE and a sample program are introduced by the number for C Magazine (soft bank) October, 96, and there was series of the programming during several months from the November number. Although the same environment as a direct NET YAROZE does not go into a hand or these do not necessarily understand the function inside hardware, they become the key for knowing what function there is.

About more detailed information, although it is English, data analyzed by Blackbag or CREATURE-PSX or bITmASTER's PSX-Development-Page are exhibited.

Information on Japanese of the program in an assembler and some sources are exhibited for PS development note (temporary) of above-mentioned Deaf Dumb & Blind. Moreover, the signal of various controllers and data format of a memory card are analyzed by Mr. Fujita of Nifty.

The following translates, operates orthopedically and supplements with a part of data of Blackbag.

The followings are other data.

Control of PlayStation

Using system call

Even when BIOS-ROM is carried in PlayStation and it does not control hardware directly, it has come to make a remarkable thing by system call of BIOS. What is remarkable is analyzed and a system call has come to be also able to perform a call briefly from C.

System call list

Although some system calls have lack/what is unknown, they are exhibited by Blackbag . It translates and operates here orthopedically. Moreover, the part is explained in Japanese by Deaf Dumb & Blind . The function -- of C ---like name is attached, and the thing of the name of the standard function of C considers that it is the same as that of the general usage, and is not especially wrong by analysis data. There is also a thing which has explanation of the function corresponding to an above-mentioned NET YAROZE library reference about other functions and the other structures.

Using system call from C

When an argument is required in a system call, it is always passed by $ a0, 1, 2, and 3, and five or more arguments are passed by $ sp +0x10. And a system call number is put into $ t1 ($9), and the address (0xa0, 0xb0, 0xc0) of a system call is called. When there is return value, it is returned by $ v0 ($2).

It returns with how to pass this argument, and value is completely the same as that of function call agreement of mips-gcc. Therefore, an argument (state of $ a 0-3 and a stack) is left intact, and $ t1 ($9) is set up, and if the lap function jumped to the address of a system call is introduced, it can call briefly as a function of C.

Example of a wrapper function:

prototype declaration:
int open (char * name, int mode);

	li	$8,0xa0	#system call address
	.set noreorder
	jr	$8
	li	$9,0	#system call number
	.set reorder
Here, although it is using $eight for the temporaly register for a jump, if it is except the register with the necessity saving within a function, it will not care about anything. Although it is puzzling just for a moment because of delay branch of mips, if it writes plainly
	li	$8,0xa0	#system call address
	li	$9,0	#system call number
	jr	$8

When open function is called, an argument is passed to $ a0 and $ a1 like the function of usual C, and the return address is put into $ ra, and open is called. By open, then, $ a0, $ a1, and $ ra put a system call number into $ t1, and jump it to a system call. In a system call, a system call is processed from passed $ a0 and $ a1, and it returns to the place where the address, i.e. open function, of $ ra were called.

Back is easy, once it has written the wrapper function by the assembler or the in-line assembler of GCC, although knowledge of an assembler is required for this neighborhood a little.

Control of hardware

Control of hardware is performed through the memory mapped I/O of 0x1f 801000-0x1f80??? ?. This data is in Blackbag . It translates here .


GPU (graphic processing unit) is the chip which is equivalent to 3D acceralator board of PC, and takes charge of drawing --, such as polygon drawing, --/display at large. In order to control GPU, flat triangle polygon, gouraud textured square polygon, etc. send the command packet with specific structure by each primitive (basic figure). This is the same thing as Execute Buffer of Direct3D Immidiate Mode.

In order to send a command to GPU, there are two, the method of sending 1 word (32 bits) every by CPU using a memory mapped I/O, and method of sending the link list of two or more packets at a stretch using DMA, and both are in a system call. The command of GPU is exhibited by above-mentioned Blackbag . It translates into Japanese here.

The pointer to packet size and the following packet is attached to the head of a packet usual in a link list.

 8bit  24bit
|size| next ptr |
| pkt[0]        |
| pkt[1]        |
| pkt[2]        |
| pkt[size-1]   |
24 bits of low ranks are 24 bits of the low ranks of the address of the following packet. Since only 2 M has memory, PlayStation can be expressed enough by 24 bits (it can express up to 16M). 8 bits of highes order are size in word (32 bits) of the packet. In 0, it is the packet of the empty without substance of a packet. An end of a list is -1 (0xffffffff) probably.


GTE (geometory transfer engine) is equivalent to the numerical-value operation processor which takes charge of operation of 3D. By only for 3D operations, it differs from the standard floating-point operation coprocessor of R3000. It seems that analysis of GTE. information on GTE is opened to CREATURE-PSX . Data of CREATURE are translated here


SPU (sound processing unit) is equivalent to sound boards, such as sound blaster. By the movie, since it has used CD-ROM/XA, in the wave system of AD-PCM, it can surmise whether to have not used XA. The page which CD-ROM specification document (it is expensive) of whether it is red or it is a yellow book can come to hand, and also enjoys the analysis and source of XA2WAVE since CD-ROM/XA is a kind of specification comes to be referred.

It seems that analysis of SPU progresses and it has come to be already able to make sound. Register information on SPU, a wave converter, a sample code, etc. are opened to bITmASTER' s PSX-Development-Page or CREATURE-PSX . Data of CREATURE are translated here


MDEC reproduces an animation (deployment of compressed data), and it is equivalent to MPEG reproduction board (since the performance of CPU was improved recently, although reproduction of software is more general). Since caetla is already mounting an animation reproduction function, the control method already seems to be analysis ending.


It seems to be analysis ending since this is already also mounted by PS emulator. With considering as open("cdrom:filename; 1", 1);, although it seems that there is also a method of controlling low level, it can use from system calls of file relation, such as open/lseek/read/close/firstfile/nextfile.

However, since protection of hardware and software has started CD-ROM of PlayStation, neither ordinary CD-ROM, nor data of CD-R can be read by usual PlayStation.

Memory card

It seems that a memory card is considering as open("bu00:filename", 1); (slot's 2 being "bu10:-"), and it needs to be initialized before using, although it can use from a system call of a file relation. As for concrete procedure, the assembler source of "the simple memory card management tool" of Deaf Dumb & Blind comes to be referred.


A system call has an input from a standard controller. The concrete method of initialization or a pad input is exhibited by Blackbag . As for an analog controller or a mouse, the analysis here comes to be referred. It seems that the 3rd (0x5a) byte reads, it is thrown away, and henceforth is stored in a buffer by system call. About a shock pad, it is unknown.

Creation of an library

Start up code

In GCC, since it is performed from _start, it needs to be written that a start rise code calls main. Moreover, __main is called at the head of main. Initialization of bss area and a setup of gp register are performed by _start here, and __main is made to carry out nothing.

extern  long _fbss[];
extern	long _end[];
extern	long _gp[];
register long *gp asm("gp");

	long *adr;

	for(adr = _fbss;adr!=_end;*adr++=0);
	gp = _gp;



_start.c is compiled and _start.o is made.

  mipsgcc -O2 -c _start.c

System call library

The header file which carries out prototype declaration of a wrapper function as mentioned above, and the object file which becomes substance are prepared. About C standard function, although dividing may be -- standard header files string.h, memory.being h, or -- more desirable, since it is troublesome here, wholly is made syscall.h. since it says as "library" -- it is desirable to collect a separate object by librarian so that it may not link what is unnecessary -- a thing -- although -- since it is troublesome even here, it makes one object file


The assemble of syscall.s is carried out, and syscall.o is made.

  mipsgcc -c syscall.s

C standard library

Although most C standard functions are in a system call, it can have from libc of GNU the thing for which it is insufficient. Although a floating-point operation coprocessor is not in PlayStation, there is also a floating-point operation library of software. Presently, since it is not what is required, immediately by game programming, either, it suspends.

Hardware library

Other librarys

Matrix operation function

It is matrix/vector operation relation which is needed by part for geometory operation part of 3D. Since the thing of the function which was alike anyhow was needed, the function name, the structure, fixed-point form, etc. were united with specification of a NET YAROZE. Although it will probably use GTE originally, it is mounting by software.


High level library

It may be --- which continues.


Creation of a fine library is carried out behind and goes into actual programming only using a system call.

Hello world

It is promissory Hello world program for the time being.
#include "syscall.h"

int main(int argc,char **argv)
	return 0;
It saves by hello.c .
  mipsgcc -O2 -Xlinker -mpsx -o hello.psx hello.c syscall.o _start.o
It comes out and compiles.
  psexe hello.psx
It comes out and performs.

Apart from that, by caetla, although standard input and output of PlayStation do not exist in ? system which will be where (null device?), they are extended so that it may become the console of a host machine. Probably, it is a thing for so-called "printf debugging".

A display of 2D polygon

next display polygon as PlayStation like program Since there is still no part for 3D operation part, they are 2D for the time being.

Initialization of GPU

A series of initialization needs screen size, a setup of a display area, to be set up of a drawing area, etc. Although this carries out with sending a series of command to GPU, since it carries out them, and it is in the first half of ColorBars of ROM and is carrying out things, it refers to this.
void Clear_(void)

void gpuInit(void)
	SendGPU(0);		/* Some kind of reset ? */
	SendGPU(0x03000000);	/* Display Mask (enable display) */
	SendGPU(0x06c60260);	/* Screen horizontal start/end (0/256) */
	SendGPU(0x07040010);	/* Screen vertical start/end (0/240) */
	GPU_cw(0xe1000400);	/* Draw on display area / dither off / tpage0 */
	GPU_cw(0xe3000000);	/* Draw Area x, y (0,0) */
	GPU_cw(0xe407ffff);	/* Draw Area w, h (1023,511) */
	GPU_cw(0xe5000000);	/* Draw Offset (0,0) */
	SendGPU(0x08000000);	/* Display mode, 256x240/NTSC/noninterlaced */
So that it may operate even when there is no Clear_ for the time being, although it considers a GPU flash or cash flash, end waiting, or something, since, it is disregarded, and it makes an empty function.

Primitive drawing

In order to draw a primitive, the command packet of predetermined structure is generated and it sends to GPU. By Rectangle of ROM, this also carries out them, is, and things are carried out. Since it is puzzling when remaining as it is, use the structure.
void test(void)
	struct {
		unsigned char r0,g0,b0,code;
		short	x0,y0;
		short	w,h;
	} boxf = {
		0,0,0,0x02,	//black

	struct {
		unsigned char r0,g0,b0,code;
		short	x0,y0;
		short	x1,y1;
		short	x2,y2;
	} polyF3 = {
		255,0,0,0x20,	//red

	struct {
		unsigned char r0,g0,b0,code;
		short	x0,y0;
		unsigned char r1,g1,b1,pad1;
		short	x1,y1;
		unsigned char r2,g2,b2,pad2;
		short	x2,y2;
	} polyG3 = {
		255,0,0,0x30,	//red
		0,255,0,0,	//green
		0,0,255,0,	//blue

	GPU_cwb(&boxf,sizeof(boxf)/sizeof(long));	/* background fill */
	GPU_cwb(&polyF3,sizeof(polyF3)/sizeof(long));	/* flat triangle */
	GPU_cwb(&polyG3,sizeof(polyG3)/sizeof(long));	/* gouraud triangle */

int main(int argc,char **argv)
	for(;;) ;
Since a screen disappears when it escaped from main then and it returns to caetla, it makes not return to the infinite loop by for (;;);.


Input and output of a file

Input and output of a file can be treated systematically by the system call equivalent to the low level input-and-output function of C, such as open/read/write/lseek/close. read/write/lseek needs to carry out in a block unit peculiar to device. CD-ROM is 2048 bytes and the memory card is 128 bytes. It seems that it precedes using these and interruption needs to be permitted by ExitCriticalSection();.

The file name passed to open is passed in the form of "a device name:file name".

device name   device
  cdrom:      CD-ROM
  bu00:       Memory card of slot 1
  bu10:       Memory card of slot 2
  pcdrv:      Hard disk of PC (caetla extension)
According to level 1 of ISO, as for the file name of CD-ROM, ";1" is attached to the end of English capital-letter 8.3 form. Though natural, it cannot write to CD-ROM.

In order to use a memory card, It seems that InitCARD(1); StartCARD(); _bu_init(); needs to be performed first. It seems that moreover, what in which the file name of a memory card had a certain law nature so that the file name of save data of each soft hat might not overlap is long is used.

In order to see information (file size etc.) and the directory of a file, a system call of firstfile/nextfile is used. This resembles the treatment of DOS or Windows. Since lseek can carry out only in block, the technique of lseeking at the file end and making the file pointer of the position file size cannot be used.

The following is the thing which rewrote the sample of the assembler of Deaf Dumb & Blind by C, and copies a file to pcdrv from CD-ROM.


It continues.

Please see eight -- what -- it shines for the time being even with the source of FPCE for PS .

Another way : Using libps

Usually, if a program is created in NET YAROZE environment, it will become the thing using libps. libps consists of libps.a and libps.exe, and libps.a is linked to a program, and libps.exe is read from system CD-ROM of NET YAROZE.

The relation of libps.exe and libps.a resembles the relation of the dynamic link library (.DLL) of MS-Windows, and the import library for using DLL. Only the jump table to not the library itself but the library main part which is in libps.exe is recorded by libps.a linked to a program.

Therefore, unless there is not only a program but libps.exe, the program created by NET YAROZE does not operate. In caetla, it is transmitting libps.exe in advance, and the program of NET YAROZE can also be performed.

Some NET YAROZE members are exhibiting libps.exe with their program. Although libps.a and header files cannot receive except NET YAROZE member, since the jump table is exhibited by Mark Heath' s Home Page ,they are possible for creating the same thing.

libps import library and header file

Although I think it legal to make the original import library and the header file for libps.exe similarly from cygwin32 and mingw32 which are gcc for Win 32 since the original import library and the header file for Win32 DLL are used, since I am not a lawyer,please use it at your own risk.



Since the sample program (YA.ZIP) for NET YAROZE is exhibited by Hitmen , compile this. libps.exe is also contained in this. Otherwise, the source for NET YAROZE is in PSX Developer' s Connection , Playstation.Net , etc.

Makefile is rewritten to CO' s gcc.


LINKER          = -Xlinker -Ttext -Xlinker 801b0000 -Xlinker
$(PROG): $(OBJS)
	$(CC) $(LINKER) -o $@ $?
CC = mipsgcc
LINKER          = -Xlinker -Ttext -Xlinker 801b0000 -Xlinker -meco
$(PROG): $(OBJS)
	$(CC) $(LINKER) -o $@ $? -lps
Since a batch file (A. BAT) is an object for ez-o-ray, it is rewritten to caetla.


del main
del main.o
eco2exe -p main 
ez load libps.exe 8000f800
ez load picture.tim 80180000
ez run main
del main
del main.o
rem eco2exe -p main 
psexe -X libps.exe
psexe picture.tim -d80180000
psexe main
It performs with compile now.

Creation of CD-R

Hardware protection

Protection is applied to CD of PlayStation, and if the software burnt by CD-R remains as it is, it does not operate. Special environment is required in order to perform CD-R software.

CD swap method

After starting with real CD and passing a protection check, it changes to CD-R. Usually since it will become the menu of PlayStation if a lid is opened, the switch in the back needs to be pressed down by a certain method. It seems that the thing with the function which stops CD to suitable timing is also in PAR imitation although timing is hard.

MOD chip

PlayStation main part is converted, special IC chip is attached, and a protection check is passed in hardware. It seems that this chip is sold by Akihabara or the mail order of web like PAR. Since source on PIC (Programmable IC) is exhibited on web, if it has PIC writer, it can also handmade.

Software protection (area protection)

This checks the area code currently written in CD, and overseas software is PlayStation of Japan and Japanese software is made not to operate by overseas PlayStation.

It seems that the software of the foreign-countries version is made to an image at once, it substitutes for an area code of Japan, and there is also a man who is burning by CD-R and is playing the software of the foreign-countries version.

It can pass by naturally, having the portion of an area code from real CD after creating CD-R image by some self- CD-R, although this area code is not written in.

Restriction of PSX-EXE

Although an execution file needs to be the cluster unit (the number of times of 2048) of CD, it does not perform this with the co version gcc. Therefore padding needs to be carried out pertinently, length needs to be adjusted, it needs to unite, and a header part also needs to be rewritten. The length of a file is revalued and the new length -2048 (header length) is written in 4 top bytes from the 28th byte. The tool which performs this Andrew's Stuff It is alike.


A file which hits autoexec.bat of dos and config.sys and which is called SYSTEM.CNF is made.
BOOT = cdrom:¥POLY2D.PSX;1
TCB = 4
EVENT = 10
BOOT = is the file name to start.
STACK = is the position of an initial stack pointer probably.
Although TCB and EVENT are detailed unknown, if it is made soft at the same general value, probably, they will not have a problem for the time being.

Creation of CD-R

First, made ISO image file which is CD-ROM-XA mode 2 and the file name of ISO Level1. Next, the area code in 16 top sectors (37632 bytes) is extracted from real CD-ROM, and ISO image which created is overwritten. (If you use same area of hitmen(USA or Europe?) version of PSX, hitlice in Hitmen provide easy way. but it dosn't work on Japanese version of PSX.) Finally, ISO image is burnt to CD-R and it is completion.


Since it only collected data which lie scattered here and there so that it might understand when seen, they were made there to be nothing and nothing was made. especially They are many thanks to each people or company. (Title abbreviation)

Bibliography and a related link

A part of link is here.