Hacking the Sony Demo Loaders

The "orbs" loader (2004-2008)

< Back to index

A submenu of OPS2M #48

This loader took over for the "arrow" loader in July 2004 and was used across Official PS2 Magazine translations all over Europe for the rest of their runs. It's the most customizable and structured loader of the bunch, which also makes it slightly, but not massively, more complicated than the other two. Like all three loaders, this one is structured in named blocks (chunks of settings separated by empty lines), with menu blocks pointing to menu option blocks that finally point to various link blocks for movies, executables, or other menus.

Configs, regardless of loader version, are found at SCEE_DD\CONFIG.TXT along with the disc's driver libraries.

Table of contents

  1. Decrypted sample configs
  2. Config encryption
  3. Config structure
  4. Menu customization
  5. Troubleshooting
  6. Loader zoo

Decrypted sample configs [#]

Sony discs [#]

My custom discs [#]

The Guitar Hero Demo Pack config is the shortest of the lot, good for a basic starter disc before you get fancier with it.

Config encryption [#]

The loader uses a byte-for-byte XOR encryption algorithm with the key Sir Robert McAlpine Fine Cranes. I tried and failed to get ops2m, which is a specific decryptor for these configs, to build, but like I said, it's just a byte XOR. I was able to get CyberChef to decrypt the configs, but make sure you upload a config file and not paste one in. If you try to paste it in, you'll fuck with some of the data and it won't decrypt properly.

For your own discs, it's useful to simply blank out the key in the hex editor. Do a binary search in the executable for Sir Robert McAlpine Fine Cranes and zero it out. Then you can use a completely unobfuscated config file and edit and rebuild much quicker. Use of an unencrypted config with a disc with this key intact or vice versa will present you with a crash or blank menu at startup.

Config structure [#]

As far as I can tell, the order in which blocks come in in the file do not matter. You can reference blocks you haven't defined yet just fine. Sony groups their blocks together by type, as seen in the example configs, but I don't. I have the relevant link blocks directly after their option blocks. It's however makes it the least confusing for you.

Lines are commented out by starting them with a #. I have left all commented from unsuspecting SCEE employees goofing off or disabling options with these intact.

Disc block [#]

*disc=DISC
INTROLINE=The preview levels contained in this disc are taken from products still in development<BR>and as such do not represent the quality and appearance of the final products.
TRAYOPEN=The disc tray is open.<BR>Please close the disc tray and reset your console.
ATTRACTTIMEOUT=1000
ATTRACT=VIDEO1
ATTRACT=VIDEO2
ATTRACT=VIDEO3
ATTRACT=VIDEO4
ATTRACT=VIDEO5
ATTRACT=VIDEO6
ATTRACT=VIDEO8
ATTRACT=VIDEO10
ATTRACT=VIDEO11
ATTRACT=VIDEO12
ATTRACT=VIDEO13
#ATTRACT=VIDEO15
ATTRACT=CREDITLINK
ROOTMENU=SECTIONS

The file starts with a *disc= block. All blocks, whether they be menus, menu options, or links start with an asterisk, the type of block, and then the name of the block after the equals sign. Fields are listed underneath.

On some discs, each field has a numbered equivalent for other languges (no number is English, 1 is French, 2 German, 3 Spanish, and 4 Italian), These change with the language of the console if the disc has them. (This includes links to specific localized demos and videos; see SCED-52786's decrypted config.) They can all be safely omitted and the disc will only display in that singular language if you so desire.

The INTROLINE notice

The INTROLINE field is the line you get at disc boot for approximately ten seconds. It will break lines for you, about halfway across the screen, but you can use <BR> to break them manually. TRAYOPEN is the text that displays when the disc tray is open (and the loader doesn't resume, so feel free to make it as disparaging or as secretive as you like). Omitting BACK and SELECT (which localizes those button options across the disc) changes them from level horizontal text to the diagonal, sorta-3D text seen in these screenshots, hence why you don't see it in the config example above. Your choice as to which aesthetic you prefer.

ATTRACT and ATTRACTTIMEOUT pertain to what the disc will try to do when you leave it idle and how long it takes for the loader to select one of the attract items (I am unsure of the time denomination). You can have as many ATTRACT items as you want, as long as you're pointing them at valid links. If you'd like to disable the attract outright, just point it at the root menu.

Some versions of the loader support a NOINTROMOVIE option in the disc block, but some don't. I don't know when this feature was added (likely towards the middle-end of the run), but I have copies of the loader that it does work on and copies that it doesn't work on. The zoo disc at the bottom of the page has a loader executable it does work on.

Finally, ROOTMENU will specify the menu you get on boot. This disc goes to the root menu block named SECTIONS. This brings us to...

Root menu block [#]

The main menu of OPS2M #48

*sections=SECTIONS
HEADER1=#48 / July / 04
#Normally random audio stream, this disc 4 due to no network section
AUDIOSTREAM=4
TOPBAR_ARGBLEFT=0000259b
TOPBAR_ARGBRIGHT=0000259b
BG_ARGBTOPLEFT=00000000
BG_ARGBTOPRIGHT=0000218A
BG_ARGBBOTTOMLEFT=00000000
BG_ARGBBOTTOMRIGHT=0000218A
OPTION=O_DEMOS
OPTION=O_SPY
OPTION=O_MONITOR
OPTION=O_REPLAY
#OPTION=O_NETWORK
OPTION=O_INSIDE

The root menu and submenus all work the same way, with the fields of the block meant for various customization options like music, widgets, and colors, and then a chunk underneath for all the choices you can select for that menu. These OPTION fields are what orders the items on the menu, natch, which sounds obvious, but it got me once or twice when I wasn't paying attention and only reordered the blocks themselves in the config.

Root menus (marked by *sections=) display either a logo graphic that can be customized (see "Loader logo") or a plain text header with one or two levels of text (the bigger text replacing the logo if set), while submenus use the top bar for up to two levels of text. Confusingly, for root menus, HEADER1 is actually the smaller of the two header texts, while HEADER2, if set, is the larger one and replaces the logo graphic. For submenus, HEADER1 is the larger text and HEADER2 the smaller text as expected.

Customization options for menus include:

AUDIOSTREAM One of six potential audio loops to play. See "Background music". These will nicely crossfade with each other as you switch between menus. Higher values will loop in a modulo-like way (6 = 0, 7 = 1, etc).
BG_ARGBTOPLEFT, BG_ARGBTOPLEFT, BG_ARGBBOTTOMLEFT, BG_ARGBBOTTOMRIGHT Takes hex values that will give nice gradients starting from each corner of the screen, similar to PS2 save icon backgrounds in the browser. Alpha, red, green, blue.
GFX_BG One of eight spinning backgrounds of orbs, hence the loader name. See "Backgrounds". Higher values will loop in a modulo-like way (8 = 0, 9 = 1, etc).
GFX_BLACKPLAY Adds a curved arrow widget to the right of the top bar. If HEADER2 is set on that menu, it will force a black "PLAY" over top whatever text you have set, hardcoded to line up with "re" (as in "replay"), so watch out.
GFX_DRAWBLOBS Adds glistening blobs under the text on the top bar.
GFX_DRAWSCANLINES Displays an exaggerated scanlines effect under the top bar.
GFX_DRAWVU Adds a blocky spectrum visualizer widget to the right of the top bar. Seems to follow the music set, which is neat.
HEADER1 On submenus, this is the large text in the top bar. On the root menu, this appears in small text on the right of the top bar.
HEADER2 On submenus, the smaller header text, displayed in its own box under the top bar. On the root menu, the large text in the top bar that takes the place of the logo.
TOPBAR_ARGBLEFT and TOPBAR_ARGBRIGHT Takes hex values that will give you a nice gradient on the top bar. Alpha, red, green, blue.

Text that's too long will overlap any widgets set, so keep your menu names short (~18 characters, maybe) if you enable any. Multiple widgets set will overlap each other, so maybe don't do that.

A submenu with a widget set

*menu=REPLAY
BACKMENU=SECTIONS
HEADER1=re
HEADER2=more from your games
AUDIOSTREAM=3
TOPBAR_ARGBLEFT=0095B0C5
TOPBAR_ARGBRIGHT=0095B0C5
BG_ARGBTOPLEFT=00000000
BG_ARGBTOPRIGHT=00000000
BG_ARGBBOTTOMLEFT=0089A2B5
BG_ARGBBOTTOMRIGHT=0089A2B5
GFX_BG=2
GFX_BLACKPLAY=1
OPTION=REPLAYOPT1
OPTION=REPLAYOPT2
OPTION=REPLAYOPT3
OPTION=REPLAYOPT4
OPTION=REPLAYOPT5

Nearly identical to the root menu block, though these display their options differently (they can scroll, for one thing) and have a BACKMENU specified for the menu this one should return to.

Option block [#]

A menu option with multiple links

*option=PLAYABLEOPT4
NAME=MTV Music Generator 3
#LINK_DESC=options
LINK=PLAYABLE4
LINK=TEXT4
LINK=VIDEO2

Destinations for an option are specified in LINK blocks. One of the most powerful features of this loader is the ability to set multiple destinations for a single item on a submenu through setting multiple LINK fields on an option block. These will scroll horizontally. OPS2M used this for games that had playable demos alongside trailers, galleries, their own written anticipatory marketing copy for a game, or any combination of those.

If you only have one link for your option block, feel free to simply use it as explanatory text for the menu item itself, set in the NAME field for the singular link. This will appear under the option block name on the root menu or in that scrolling band area on submenus. (Obviously a single link doesn't scroll.)

A submenu with a timeline set

*option=MONITOROPT4
NAME=Shadow Of Rome
ETA=1204
#LINK_DESC=Options
LINK=TEXT12
LINK=VIDEO13

If an option on a submenu has an ETA field set, a timeline view will get added to the top bar when that item is hovered over (and then it disappears for items without that field, so the two can be mixed). The ETA field takes a four digit number, first two for the month and last two for the two-digit year, that hooks into that timeline and scrolls it around and displays an "ETA:" date above it. The year can be anything from 00 to 99 and it'll work just fine. Obviously only useful for a demo disc, but a cute extra visual nonetheless.

Link blocks specify the end destination of a menu option, either a video, an executable, a text scroll, a gallery, or another menu. Credits also get their own special link block that contain the entirety of the text of the credits.

Orb loader credits

*link=CREDITLINK
NAME=We made this
TYPE=CREDITS
TEXT=Goal of The Month soundtrack:<BR>The Distance "Life"<BR><BR>(Words And Music by Ben Hill, Damian Sime,<BR>Jason Sinclair,Marcus Jones).<BR><BR>Copyright Control.<BR>Recorded by Stuart Bruce,<BR>Bruce Audio Services,<BR>39 Monkton Farleigh,<BR>Bradford On Avon,<BR>Wilts. BA15 2QD.<BR>Used by Permission.<BR>All Rights Reserved
TEXT=FUTURE PUBLISHING DISC EDITOR<BR>George Walter
TEXT=DEMO DISC PROGRAMMING<BR>Matt Verran<BR><BR>ADDITIONAL PROGRAMMING<BR>James Burns<BR>Phil Rogers<BR>Mike Dean<BR><BR>GRAPHICS<BR>Pete Johnson<BR>Lorne Christie<BR><BR>MUSIC AND SOUND EFFECTS<BR>Max Mezzowave<BR>Pete Johnson<BR><BR>DEMO ROOM PROGRAMMERS<BR>John Cassidy<BR>Antony White<BR><BR>DEMO TECHNICAL ASSISTANT<BR>Katy Alldred
TEXT=TRANSLATION TESTERS<BR><BR>FRENCH<BR>Michael Morel<BR>Pauline Brisoux<BR>Nicolas Rosay<BR><BR>ITALIAN<BR>Giorgio Anselmi<BR>Federico Inverni<BR>Paolo Parrucci<BR>Stefano Moretti<BR><BR>GERMAN<BR>Katharina Tropf<BR>Nadine Martin<BR>Sebastian Von Bischopink<BR>Matthias Pokorny<BR><BR>SPANISH<BR>Silvia Ferrero<BR>Yolanda Akil<BR>Virginia Martin<BR>Leire Corcuera<BR><BR>TRANSLATION MANAGEMENT<BR>Domenico Visone
TEXT=TRC TESTERS<BR>Phil Adams<BR>Phil Adcock<BR>Jimmy Areabi<BR>James Binder<BR>Dan Brough<BR>Stephen Dearden<BR>Barrie Devlin<BR>Barry Draper<BR>Dean Houghton<BR>Ste Jones<BR>Ste McCann<BR>Anna McDonald<BR>Gary Morell<BR>Andy Naylor<BR>Russ Redmond<BR>James Warburton<BR>Nathan Ward<BR>Simon Wong
TEXT=TRC LEAD TESTERS<BR>Mike Bygrave<BR>Dave Jenions<BR><BR><BR>TRC LEAD TESTER /<BR>DEMO ASSISTANT<BR>Nick Jones<BR><BR><BR>TRC SUPERVISOR<BR>Miles Rotherham
TEXT=TECHNICAL ASSISTANTS<BR>Mark Magill<BR>Chris Taylor<BR><BR><BR>TECHNICAL CO-ORDINATOR<BR>Miranda Latham<BR><BR><BR>INTERNAL DEVELOPMENT DEMO CO-ORDINATOR<BR>Jenni Rees
TEXT=PRODUCER OF SPECIAL PROJECTS<BR>Richard Milner
TEXT=©2004 Sony Computer Entertainment Europe<BR><BR><BR>A 'Special' Production

Add another TEXT field for each line of credits that you want. Each field displays on its own line and can be broken up further with <BR>.

Gallery object

*link=GALLERY7
NAME=extras
TYPE=GALLERY
FILENAME=paks/gpk/revil.GPK

A gallery of images. I don't know the format of GPK files, so not that anyone was jonesing to make their own gallery, but as of yet, we can't.

*link=MONITORLINK
NAME=hands on previews
TYPE=MENU
GOTOMENU=MONITOR

Forwards to another menu.

*link=PLAYABLE1
NAME=play
SPLASHTIME=250
SPLASH=Please note that in order to confirm options changes | must be pressed before leaving the options screen.
TYPE=PLAYABLE
FILENAME=SFODEMO\SFO.ELF
IOPIMAGE=280
INACTIVITY=60
PLAYTIME=1800

Starts another executable. SPLASHTIME (again, don't know the denomination the time is in, sorry) and SPLASH are optional for displaying text before an executable boots. (I'm sure it can also work for videos and maybe other link types, but I haven't tested this.) If a game requires special IOP drivers, use IOPIMAGE to specify which ones and drop the appropriate IMG file in the SCEE_DD directory on the disc.

INACTIVITY and PLAYTIME, in seconds, ostensibly set how long the executable can go untouched and how long the demo can be played before the player gets dropped back to the menu. I don't really know how this works, given that I'd think these would be up to the way the demo is coded and not the menu, but I haven't tested it thoroughly. Experiment to your tastes.

TEXT link block [#]

Text object

*link=TEXT4
NAME=OPS2 says
TYPE=TEXT
FILENAME=paks/tpk/MTV3.tpk

A text scroll. I know how to partially customize these. These are one part strange, 3D image displays and one part the actual text scroll, the former I don't understand the format of, and the latter I've hacked up. See "Text scrolls".

A video on a menu with a length set

*link=VIDEO3
NAME=video
TYPE=VIDEO
LENGTH=166
FILENAME=videos/jak3_eng.pss
AUDIOTYPE=PCM

AUDIOTYPE is either PCM or ADPCM, depending on what's in the PSS file. Usually, it's PCM. LENGTH is optional, but if set, is specified in seconds. The above video for Jak III will appear as length 2:46 in the menu.

Backgrounds [#]

Each menu can have a different spinning background of dots applied to it using the GFX_BG option. Of these, 0 through 7, with the exception of 6 (which looks the same as 0), will give you a different animation. Leaving it unset will default that menu to 0.

Background music [#]

You have six valid choices for menu music, all of which are roughly ten second loops as specified. On older discs, this is in SCEE_DD\SOUNDS.PAK, and in newer ones like the loader zoo executable, it's in PAKS\SOUNDS.PAK. (This file just seems to be a load of VAG files stuck together, end to end, with no header of its own or anything. I was able to extract all the menu loops using a hex editor to paste them into separate files and then using MFAudio to convert them. Presumably, you can also paste in your own VAG-encoded audio in much the same way, just make sure the length is the exact same as the original.)

Here's my extracted samples in FLAC format. These seem to play slightly faster and higher-pitched in the loaders themselves, so perhaps I have the sample rate wrong, but I don't think so. These will give you a good enough idea to help you construct your menus, anyway. Click to play in your browser or download if it doesn't support FLAC files.

Intro video [#]

The intro video (SCEE_DD\OPSM.PSS) is a strange beast. It seems to be a normal, valid PSS file according to the demux tools I've tried, but switching out the video (or leaving it off the disc) will make the loader freeze past the startup text, and trying to play the video as a menu option will also make the loader freeze. It's best to just use a loader that supports NOINTROMOVIE like featured in the "zoo" loader at the bottom of this page unless you really wanna rep Official PS2 Magazine on startup.

Editing the images of the loader itself, such as the button icons or the logo, is seriously advanced stuff. Like a lot of PS2 games, the loader stores its graphics in TIM2 format. The only way I could extract them was through using a hex editor to copy everything from the header (which is thankfully easy to spot, do a search for TIM2, which is its magic number) to the header of the next graphic (since they're all bunched up together and you can use the next one's magic number as the end of file for that graphic) into a new TM2 file and using Game Graphic Studio to make my changes.

Editing the logo graphic in Game Graphic Studio

Game Graphic Studio's interface sucks, but here's the gist of how to replace graphics:

  1. Load your TM2 file into GGS. As far as I know, all OPSM graphics use black as their alpha color.
  2. Hit "Save As..." in the Filemenu. Save as a PNG and edit as necessary.
  3. Use the "Open..." dialog in the File menu to reopen your PNG. This won't unload your TM2 file, as you can see in the bottom part of the GUI.
  4. If all goes to plan, you'll see your new logo open up to the right of the interface.
  5. Drag it onto the squished version of the logo in the bottom part of the GUI. It'll overwrite it.
  6. "Save As..." again. Yes, save the PNG again. This part might be unnecessary, since GGS doesn't tell you when it actually saves the TM2 file, but I do this in case it saves the TM2 with the PNG. (Which would be stupid, but such is life with modder tools.)
  7. Reopen your TM2 file in your hex editor and copy all the data inside it.
  8. Go to the appropriate offset of the loader ELF as listed below in your hex editor and select all the data for that image, from magic number to EOF.
  9. Paste over and save the ELF. If you did it right, it'll show in the loader when you rebuild the disc.

It's pretty important that you keep your dimensions and also the color depth in mind, as having too many or too few colors, while it might create a valid TIM2 image, won't be the same size as the original. When hex editing, you always want to paste over, and make sure you're not adding or deleting from the file, or else you'll have a bad time. TIM2 images are a bit like bitmaps in that, given the same palette and same dimensions, every image in those dimensions will be the exact same size.

For the loader logo, which I know most people would wanna change out, you're looking at a 256×64 image with an 8-bit color depth, so 256 colors. I've also successfully gotten away with using 16 colors for other logos. Just make sure you're not using too few, GGS doesn't like fewer than 16. In my experience, black is treated as a transparent color, so have the logo white-on-black.

Here's the offsets and sizes for each of the loader images, in hex. These are accurate for the loader zoo version of the loader. Other versions of this loader have slightly different offsets, but still seem to lump their graphics the same way.

Text scrolls [#]

While I can't tell you how to customize the pictures inside a text scroll, I can tell you how to pick your favorite and add your own text.

Editing a text scroll in a text editor

  1. Load your preferred TPK into a hex editor. These are stored in PAKS/TPK/ on the disc, but you do not need to put yours in there. That's just a Sony sorting thing.
  2. There's a header and subheader at 00040 and 00140, respectively. These don't seem to have length values anywhere in the file that I can see. Not that I looked very hard, but I found a header with a length of 13 (so 18 characters) and a subheader with a length of 21 (so 33 characters). Any longer than 1B (27 characters) for the subheader, and you'll get wrapping down to the next line, which will spill into your body text without <BR> breaks at the start.
  3. You'll see where the text starts in the hex editor near the end of the file. Insert your custom text over top of it. I like to keep the padding bytes at the end of the file for comfort. These padding bytes should factor into the scroll length you set.
  4. At 00004, there's a 16-bit integer in hex that specifies the length of the text scroll. This starts right after the graphics and continues until the end of the file. Whatever length your text is (in number of characters), plus the number of padding bytes, convert that to a two byte hex value and put it at that offset.
  5. Save and link somewhere in the disc.

Again, text scrolls do not need to be saved in PAKS/TPK/. For my own use, I just saved my custom one in the disc root. After all, the corresponding link block will read the file anywhere on the disc, so why add extra packaging?

Troubleshooting [#]

If you're renaming blocks (as I tend to do), make sure you keep your names straight! Here's what'll happen if you point the disc at something it can't find:

In addition, watch out for duplicate options or links. If you specify two links or two options with the same names but with different text and destinations set, the loader will only load the first one for the entire disc. All blocks need to have unique names.

Loader zoo [#]

The main menu of the loader zoo

Loader zoo ISO can be downloaded here. This is a fully bootable disc with a small set of preconfigured menus with various widgets, effects, backgrounds, and music loops set on them as a "zoo" for what various configuration options do. This version of the loader is also already set up with NOINTROMOVIE and has the encryption key zeroed out for ease of config editing.

< Back to index

Wanna chat about anything? Send me something at mariteaux@somnolescent.net!

Cammy's Island | About | Aboveground | Underground | Elsewhere