Hacking the Sony Demo Loaders

The "filmstrip" loader (2000-2004)

< Back to index

A game listed in the "filmstrip" loader

Chalk this one up to Sony legal cheekiness. The gist is that video game consoles were once subject to a European Union import tariff, and Sony tried to get around this by including a Yabasic interpreter on a demo disc, thereby arguably making the PS2 a personal computer you could write software for and not a game console. Thus, not subject to the tariff. In fact, Sony would've stood to get back several million euros if the courts agreed. (Unconfirmed, but this may be the reason Sony released a Linux kit for the console as well.)

It didn't work. Europe's court of first instance in Luxembourg stated flat out the PS2 was clearly a video game console, crappy BASIC interpreter or not. The point was ultimately moot, as in 2004, the import tariff was repealed, and Sony stopped including the demo disc with new consoles. This loader stopped being used after that point, both in this "filmstrip" form and the modified "arrow" loader OPS2M was using based on it.

Discs using this loader were published with the software code PBPX most often, which Sony used for bundled discs with their consoles. All screenshots on this page are taken from PBPX-95205. Some demos with this loader have a standard Sony Computer Europe software code, like SCED-51140. Otherwise, they don't have official names, being referred to solely as "Demo Disc" more often than not.

Table of contents

  1. Decrypted sample configs
  2. Config encryption
  3. Config structure
  4. Menu customization
  5. Troubleshooting
  6. Loader zoo

Decrypted sample configs [#]

Sony discs [#]

My custom discs [#]

Config encryption [#]

The German OPS2M disc for April 2004 accidentally leaked Sony's encryption tool for these called conftool.exe, which lets us encrypt, decrypt, and test config files for the "filmstrip" and "arrow" loaders, which as said before, this was based on.

Sample output:

---Demo Disc Config Tool---
1. [E]ncrypt a config file
2. [D]ecrypt a config file
3. [T]est a config file
4. [Q]uit
d
--------- Decrypt ---------
source file [default:config.dd2]:
opening file: config.dd2
file size is 14999 bytes
output file [default:configx.txt]:
writing file: configx.txt
file size is 14999 bytes
---Demo Disc Config Tool---
1. [E]ncrypt a config file
2. [D]ecrypt a config file
3. [T]est a config file
4. [Q]uit

The process for editing configs is rather basic: decrypt, edit in plain text, re-encrypt, build a new disc image. It's really important to make sure you're in the correct working directory when you load conftool. Dropping the files you're working on into the directory you have conftool in and then double-clicking the executable is the simplest way to make sure of that. The program is not especially foolhardy, and it'll try to read from bad memory addresses and crash if it can't find the file in question. More on that in "Troubleshooting".

Config structure [#]

Blocks always start with an asterisk, either a number for localization blocks (0 for English, 1 for French, 2 for German, 3 for Spanish, and 4 for Italian) or an x for blocks that apply to all languages, a colon, and then the name of the block. Then the fields of that block are listed underneath that line.

For brevity, I will only be showing x and 0 blocks here, but the localization blocks for other languages (even if they just display English) must be present, or the loader will crash if the PS2's language is set to something other than English. See "Crashes on PS2s set to other languages".

There's no comments in these decrypted examples, as conftool strips them out on encrypt, but you can still comment out lines by starting them with # as in the other loaders.


*x:MENU
OPT=FIFA2001
OPT=SSX
OPT=WWR
OPT=DOA2
OPT=FANTAVIS
OPT=ISSPRO
OPT=RIDGERV
OPT=FINDMYOWNWAY
OPT=YABASIC

The first block includes all the selectable options within the loader. Note the line break before the block; that needs to be present. See "The line break anomaly" for more information on this.

Attract block [#]

*x:ATTRACT
OPT=RIDGERV
OPT=FIFA2001
OPT=FANTAVIS
OPT=SSX
OPT=DOA2
OPT=WWR
OPT=ISSPRO
OPT=CREDITS
OPT=INTROMOV

Options for what the disc might boot into should the console be left idle. In the case of PBPX-95205, Sony set all the videos, plus the intro movie and credits, as attract options. As there's no text displayed to the player, the MENU and ATTRACT blocks don't have localization blocks.

Global blocks [#]

*x:GLOBAL
SPLASH1=cdrom0:\VIDEO\INTROMOV.PSS;1
SPLASH1_TYPE=VIDEO
ATTRACT_TIMEOUT=240
MENU_TIMEOUT=90
HELP_TIMEOUT=120
INTERACTIVE_TIMEOUT=300


*0:GLOBAL
DISCLAIM=The preview levels contained in this disc are taken from products still in development and as such do not represent the quality and appearance of the final products.
RELOADMSG=Reinitialising menu system...
RESET=Please reset your console after playing this demo.
BACK=Back
QUIT=Quit
PLAY=Play

GAME=GAME
EXTRA=EXTRA
VIDEO=VIDEO

Some options and localization text pertaining to the menu system itself. SPLASH1 is the video you get on bootup; this can be omitted if you have no startup video. I don't quite remember what ATTRACT_TIMEOUT means (possibly how long the demo will run when booted from attract instead of by the player?), but MENU_TIMEOUT is how long the menu will wait with no input before calling one of the attract videos, HELP_TIMEOUT is how long the controller screens will wait before they kick you back to the main menu, and INTERACTIVE_TIMEOUT (shared with menu items should they specify it) is how long you have to play the demo before it boots you back to the demo disc menu.

I seem to recall these times (and all times set in the config, in fact) not exactly corresponding to how long the text appears on screen in seconds. You might have to fiddle with it and maybe overshoot your desired seconds count, just in case.

RELOADMSG on the International Superstar Soccer demo

RELOADMSG is a generic setting across most blocks in this config. It's the text displayed when you return from a demo or video. As far as I can tell, RESET is never used; when such text was needed, Sony just baked it into the splash text of that demo.

The last three strings get displayed in the top horizontal bar of the menu and tell the player what the type of item they're on is (a demo, a video, or an "extra" like Yabasic or the Find My Own Way demo). You can change all these to whatever you want, if you want to use that space to brand your disc instead. If you only have executables on your disc, you can also delete the extra two VIDEO and EXTRA strings with no ill effects. You can even define your own item types (the loader zoo at the bottom of this page as a lovely MEME type, for example).

Game, video, and extra items all work off very similar settings. This is where the internal names listed in the MENU block at the start get specified, with fields for long and short names for display (long in the "echoing" text in the middle-left of the screen, short on the scroll bar), videos and executable file names, control schemes, and text both going to and going from the demo.

Fields relevant to all menu item types:

FILETYPE What the external file being loaded is. Either CREDITS, EXECUTABLE, or VIDEO.
FILE The path to the external file, starting from disc root. cdrom0:\ is used regardless of if the demo disc is a CD or a DVD.
INT_SPLASH1 The text displayed on the item splash (screen displayed on booting a video or demo). What INT stands for is yet unknown.
INT_SPLASH1_TYPE Presumably the type of splash. Always set to TEXT.
INT_SPLASH1_TIME Time the splash for that item is shown on-screen. Ostensibly seconds, but I remember it not feeling like it lined up with my counting, so some fiddling may be necessary.
LONGTITLE The longer version of the title displayed in the middle-left of the screen.
PAD_ Used for the pre-boot control scheme display on all item types, not just games. See "Control scheme display".
RELOADMSG The text displayed on returning from an executable or video. Lasts a hardcoded few seconds, so try to avoid anything too long to read in that time.
SHORTTITLE The shorter version of the title displayed in the scrolling bar at the bottom of the screen.
TYPE Either GAME, VIDEO, or EXTRA. These only correspond with the displayed menu item type in the menu itself; FILETYPE is what sets how the loader handles it. As an example, Sony, on some configs, lists some videos under EXTRA for some unknown reason.

Control scheme display [#]

The controls displayed before FIFA 2001 boots

*x:FIFA2001
FILE=cdrom0:\FIFADEMO\GAMEZ.ELF
FILETYPE=EXECUTABLE
FLASH=165
TYPE=GAME

*0:FIFA2001
LONGTITLE=FIFA 2001
SHORTTITLE=FIFA 2001
PAD_TRIANGLE=Sprint
PAD_CIRCLE=Shoot/Tackle
PAD_CROSS=Pass/Switch player
PAD_SQUARE=Lob/Aggressive tackle
PAD_START=Change camera
PAD_LSTICK=Movement
PAD_STARTSEL=Quit
RELOADMSG=FIFA 2001<br><br>Available now

One incredibly novel thing about this loader is that you can set the text that explains game controls before each game loads. Here's all the usable buttons, according to digging into the executable. The shoulder buttons are specified in a different part of the executable, but they do work.

PAD_TRIANGLE
PAD_CIRCLE
PAD_CROSS
PAD_SQUARE
PAD_SELECT
PAD_START
PAD_LSTICK
PAD_RSTICK
PAD_STARTSEL
PAD_L1
PAD_L2
PAD_R1
PAD_R2
PAD_L3
PAD_R3

Executables [#]

Yabasic, an extra, in the menu

*x:YABASIC
ATTRACT_TIMEOUT=90
INTERACTIVE_TIMEOUT=90
FILE=cdrom0:\YABASIC\YABASIC.ELF;1
FILETYPE=EXECUTABLE
FLASH=200
TYPE=EXTRA

*0:YABASIC
LONGTITLE=YABASIC
SHORTTITLE=YABASIC
INT_SPLASH1=Use YABASIC to create fun programs in the BASIC programming language.<p>Full instructions are built-in to the program.<br>Some programming knowledge is useful.<br>English, French and German languages are supported.<br>A USB keyboard (optional) can be used with this application.<p>PLEASE RESTART YOUR CONSOLE AFTER RUNNING THIS APPLICATION.
INT_SPLASH1_TYPE=TEXT
INT_SPLASH1_TIME=12

Yabasic's splash text

FLASH refers to the IOPRP image the game will try to load. PBPX-95205 comes with four, 16, 20, 165, and 202 in the SCEE_DD folder; the later SCED-51140 relocates these to SCEE_DD\IMAGES (and the relevant modules to SCEE_DD\MODULES). You can add more if you want. If the IOPRP image it wants isn't in there, the disc will silently stall on executable load.

Videos [#]

Dead or Alive 2, a video, in the menu

*x:DOA2
ATTRACT_TIMEOUT=90
INTERACTIVE_TIMEOUT=90
FILE=cdrom0:\DOA2\DOA2.PSS;1
FILETYPE=VIDEO
FLASH=165
TYPE=VIDEO
RELOADMSG=DOA2 DEAD OR ALIVE 2<br><br>Available 13/12/2000

*0:DOA2
LONGTITLE=DEAD OR ALIVE 2
SHORTTITLE=DOA2
PAD_STARTSEL=Quit
RELOADMSG=DOA2 DEAD OR ALIVE 2<br><br>Available 13/12/2000

These still have control text, but only to exit the video. Despite the previous example, videos do not need an IOPRP image specified. Sony left that in out of laziness and sloppiness, most likely.

Credits [#]

PBPX-95205's credits scroll

*x:CREDITS
ATTRACT_TIMEOUT=120
FILE=cdrom0:\VIDEO\CREDITS;1
FILETYPE=CREDITS

*0:CREDITS
RELOADMSG=(c)2000 SCEE

A quick, simple credits scroll. This is not a menu option on any of Sony's discs, but it'll work just fine if you add it as one for yours. You'll need to add it as a menu option (giving it a TYPE, SHORTTITLE, and LONGTITLE so it doesn't crash the loader) and edit the CREDITS.TXT file in SCEE_DD. It is not loaded from the VIDEO folder like this says it is, the path is hardcoded in the executable. I can't tell how to make it load arbitrary text files, but you'll be able to use that one, at the very least. 45 characters is the absolutely max per line in my experience.

EOF marker [#]

#EOF

The config ends with an EOF marker comment. Unlike the start of the config, this does not seem to need any weird, special spacing. If you get any bizarre extra characters at the end of the file after decrypting a config, go ahead and delete them. The EOF marker needs to be the last thing in the file.

HTML colors [#]

An attempt at making rainbow text

Here's something no one's ever written about before: this loader actually supports a small subset of HTML 3.2! Line breaks and paragraphs are common in Sony's configs, but internally, the loader also uses <FONT COLOR> tags to color up certain bits of text. Yes, these work if you put them in your own configs. I'm not sure what format the colors are in—they resemble RGBA.

There's some quirks that make color in the loader slightly unpredictable:

The loader zoo's colored startup

The loader zoo at the bottom of this page starts up with a colored disclaimer which is my best attempt at getting coherent colors out of the loader. The color codes I used, in order, are FF0000FF, AA00AAFF, and EE82EEFF.

On a more boring but practical note, line breaks (<BR>) and paragraph breaks (<P>) both work. Paragraph breaks will add more space after the line than a line break, so the former's good for forcing text to wrap exactly how you want it and the latter is good for starting a new bit of information proper.

Background video [#]

IPU files are basically just MPEG-2 video files, like all other video on the PS2 is encoded in. You'll need ps2str, some official Sony kit, to encode those. The video size is 320×512; bizarre, I know.

Now, M2V encoding using ps2str is tricky enough without the extra limitations of this loader video. The only program I've found that works completely for encoding M2Vs like the PS2 likes is TMPGEnc Plus; thankfully, you can get a period disc image and serial at the Internet Archive. Make sure it's video-only and make sure the GOP contains only I-frames when you encode. (Despite the PS2 being a conforming DVD player, compliant PSS/IPU files need to have only I-frames, no P- or B- frames. You'll know if you built a good file if the Info tab in ps2str says it's both PS2 and IPU compliant.)

ps2str showing a compliant background video

Yet, here's the kicker—the entire video needs to fit in the PS2's memory. You have a hard cap of 12MB, or else the loader will reject your video outright and the background will be dark. This means you need to either crank the bitrate to unacceptably low levels or keep your loader video short. Our sweet spot was 3MB/s for about 30 seconds of looping background video. You decide what the tradeoff is. Point being, that loader video needs to be 12MB or less—not 500KB over.

Background music [#]

The background music played throughout the menus is a simple VAG file called TESTMONO.VAG in the SCEE_DD folder. The path to this file is hardcoded in the executable. I've seen two different menu loops in use, one for the early PBPX discs, and one for the later "bonus demos".

As implied, this is mono ADPCM at 44.1KHz 16-bit. MFAudio can convert to and from it with no problem. Sony's own music loop is 1:17; GH2DX 2.0's is 1:07 and consists of two instrumental (drum and bass only) rounds of the game's "Psychobilly Freakout" cover.

Keep in mind that you'll need to use a separate VAG editor to make the music loop if it ends before your disc goes into attract. (The song will always start playing again after the attract has finished.) I used VAG Editor (mirrored here as the old link was gone and the domain swiped) to set loop points and it worked great.

Intro video [#]

As far as I can tell, it's just a standard PS2 PSS file. Resolution doesn't matter. Follow the steps in "Background video" to make a compliant PSS it should work. You can also outright omit the SPLASH1 and SPLASH1_TYPE fields if you'd prefer to not have an intro video at all.

Troubleshooting [#]

Always test your configs! [#]

You'll get odd, "bleeding" visual artifacts, a nice lockup, or a boot back to the PS2 browser if the disc fails to load the new config. Thus, I'd recommend testing out your newly-encrypted config with conftool before you build a disc with it. It might seem picky, but the loader can be just as picky.

If your Command Prompt quits or gives an error, there's a bug in your config. If you see this instead:

** If you can see this message then the config.txt file parsed correctly **

You're golden.

Crashes on PS2s set to other languages [#]

Unlike the "orbs" loader, where other languages are optional, if the PS2 is set to another language other than English and that language isn't present in the config, you will get a nice crash on hardware or a blank menu on emulator. Even if they're all set to English text, it might be a good idea to duplicate all localization blocks for each of the five languages just in case someone international might play your disc.

Random conftool crashes [#]

As said before, conftool is not the best built program. I regularly get random null pointer dereferences while using it, usually while testing configs. If you see something like The instruction at 00402e6a referenced memory at 00000000, just restart the program, they're errant and happen at random. It doesn't mean anything's wrong with your configs.

The line break anomaly [#]

One of the finest examples of how picky this loader can be is that both it and conftool insist on a line break at the start of the config. If you don't, you'll get an error about a missing menu entry for a later block and not only will it fail a conftool test, the disc won't even boot. Seriously, I don't know why, but check this out. If I have it like this, with the start of this code block meaning the start of the file:

*x:MENU
OPT=CREDITS
OPT=BORGER

*x:ATTRACT
OPT=BORGER

conftool will complain like this:

New group: x:CREDITS
language=[x]
checking BORGER
Cannot set this group up as there is no menu entry for 'CREDITS'

But if I were to add just one line break before the MENU block:

New group: 0:CREDITS
language=[0]
checking CREDITS
checking BORGER
New language is: 0, group is: 0
LINE: [LONGTITLE=CREDITS]
Setting: LONGTITLE=CREDITS
Menu: 0, ID=LONGTITLE, VALUE=CREDITS, tag=0
LINE: [SHORTTITLE=CREDITS]
Setting: SHORTTITLE=CREDITS
Menu: 0, ID=SHORTTITLE, VALUE=CREDITS, tag=1
LINE: [RELOADMSG=(c)2000 SCEE]
Setting: RELOADMSG=(c)2000 SCEE
Menu: 0, ID=RELOADMSG, VALUE=(c)2000 SCEE, tag=2
LINE: []
Empty line
LINE: []
Empty line
LINE: []
Empty line
LINE: [#]
Comment

** If you can see this message then the config.txt file parsed correctly **

It's fine. I can't explain this and I don't know why it insists on this, but it does. Even freshly decrypted configs (fresh from conftool, not Sony's actual original input configs, which we don't have any) will fail this check for some reason.

Loader zoo [#]

Loader zoo ISO can be downloaded here. This is a fully bootable disc with three menu options, a controls demonstration, and color on some of the splash texts. All languages have been filled out to prevent crashes, though they're all just English. The decrypted config used to customize the loader and conftool.exe are included in the SCEE_DD directory.

The version of the loader used is from SCED-51140, as the PBPX-95205 executable has some kind of media check that prevents it from working on DVD discs (the original disc was a CD).

< Back to index

Wanna chat about anything? Send me something at mariteaux@somnolescent.net!

Cammy's Island | About | Aboveground | Underground | Elsewhere