PS2 Julian's various PS2 projects (Worklog)

A list of stuff that was removed from Sony's OSS archive: https://gist.github.com/uyjulian/4d1db5183ba9b4baca85406ee8367534

I couldn't get much info for releases between 2004 and 2009 because the web page started requiring cookies (forcing redirects) during that period.

A few things I found out:
* The PSBBN sources that were archived on Wayback Machine (kernel-headers-2.4.17_ps2-26.mipsel.rpm, kernel-headers-2.4.17_ps2-22.mipsel.rpm, glibc-2.2.2-9.src.rpm) are the same as those inside the "SOURCES.TGZ" file on the installation discs.
* Sony Europe TV source code ( e.g. https://web.archive.org/web/2009042..._mpl2.aspx?l=en&site=odw_en_GB&f=licence_mpl2 ) was migrated to the global website
* Sony America TV source code ( e.g. https://web.archive.org/web/20130410153845/http://products.sel.sony.com/opensource/source_tv.shtml ) was not migrated to the global website.
* There is a reference to a URL containing the following set of models: KDE-P50HVX / KDE-P42HVX / KDE-P37HVX / KDL-L40HVX / KDL-L32HVX / KDL-L26HVX / KDX-46Q005 / KDX-40Q005 / KDL-S19A10 / KDL-S23A10 / KDL-S26A10 / KDL-S32A10 / KDL-32S1000 / KDL-40S1000 / KDL-32V1000 / KDL-40V1000 / KDF-42E1000 / KDF-50E1000. However, due to the forced redirect due to missing cookies, I wasn't able to make sure if it was related by the main processor on the SF board.
* All RDZ-, HES-V1000, and BDZ-V7/BDZ-V9 are based on a similar hardware architecture (SMP8634 DSP processor, some sort of PPC440 processor (AVPPC/CXD4707GB))
 
Last edited:
The ROM for the EG board for Sony WEGA HVX series is based on SDK 2.8.0 (just like PSX1). It is 1MB in size and does not contain an OSDSYS executable (despite being referenced in EELOAD and KERNEL), but contains (and loads on boot) DECI2 modules.
In addition, it contains the "PIF3RPC" module (which depends on the "PIF3DRV" modules not in ROM) and "DTVVER" file.

ROM dump is under the Internet Archive item "sony_2004_tv_dumps"
 
Last edited:
Some general notes on HDD replacement for recorders (incl. entering service mode):
https://rdwiki.rd-style.info/wiki.p...%8E%B0%C2%D0%BE%DD%A1%CB%A4%CEHDD%B4%B9%C1%F5
https://web.archive.org/web/20210927162026/http://pc.usy.jp/wiki/465.html

BDZ-V9 disassembly:
https://clio9330.livedoor.blog/archives/51878004.html

BDZ-V7 disassembly:
https://anniversary-net.com/furui/2015/07/08/bdz-v7sony-2006年 修理編/

BDZ-RX105 service menu and HDD replacement:
http://hs4407.web.fc2.com/others93.html

RDZ-D700 service menu and reset:
http://jacktown.cocolog-nifty.com/blog/2009/01/sony-b894.html

BDZ-AT700 HDD replacement:
https://note.com/bar_whisky/n/neea664f20ca7

Notes on service mode for models that don't have front buttons:
https://detail.chiebukuro.yahoo.co.jp/qa/question_detail/q14223215549

BDZ-X95 service menu and HDD replacement:
https://minkara.carview.co.jp/userid/221785/blog/37484144/

BDZ-EX200 servicing:
https://zroff.hatenadiary.org/entry/20120902/1346551189

BDZ-T55:
https://aristrust.com/junk/sony-bdz-t55/

BDZ-RX30 service menu and HDD replacement:
https://magnoliacostic.hatenablog.com/entry/2022/05/31/172610

BDZ-RX100 service menu and HDD replacement:
https://minkara.carview.co.jp/userid/2715788/blog/43082334/

BDZ-AT950W HDD regen:
https://ameblo.jp/ko-chikun/entry-12147256730.html

Basically:
For earlier models (?), to enter the service menu, some buttons on the front panel need to be held down before plugging in the power.
For earlier models (RX series and before?), some data (?) needs to be copied sector-by-sector from a donor HDD (can be from another recorder of the same model series), then paired using the service menu.
For newer models (?), the service menu can only be entered using a IR remote control (example from repair: transmitted from phone) or USB drive.
Even if higher capacity HDD is replaced, the system behaves as the lower capacity is available.
A tool "HDAT2" can possibly make the original HDD work again.

---
To enter the service menu:
RDZ-D50/RDZ-D70/RDZ-D90: "HDD/DVD" + "HOME" + "OPTIONS"
RDZ-D700/RDZ-D800/RDZ-D900A, BDZ-V7/BDZ-V9: "HOME" + "OPTIONS" + "REC STOP"
BDZ-EX200/BDZ-RX105/BDZ-RX100/BDZ-RX55/BDZ-RX50/BDZ-RX35/BDZ-RX30/BDZ-RS15/BDZ-RS10/BDZ-X95/BDZ-T55: "Stop" + "Stop Recording" + "Channel Minus"
BDZ-AX2000/BDZ-AX1000/BDZ-AT900/BDZ-AT700/BDZ-AT500/BDZ-AT300S: open/close+play+stop+channel down
 
Last edited:
Neither BDZ-ZW1000 nor BDZ-EW1200 will access the front USB drive in error state.


---


The AutoScript execution code in SMP-N200 appears to have been removed, but the respective commands are still there. Presumably its interface is only accessible using UART.
 
Last edited:
DECI2 DRFP as implemented by dsnet does not sandbox filesystem access.

(Note: if there are any auto-reboot watchdogs in use, they need to be neutralized or resumption support for file copy needs to be implemented)
 
For EMMA3 based players, KeyStore.load->KeyStore.engineLoad will eventually end up calling ObjectInputStream.readObject in a PrivilegedAction.run block as argument to AccessController.doPrivileged.

(This issue does not exist on IBM Java 8.0-8.60. It also does not exist on Oracle Java, which KeyStore implementation uses magic header 0xFEEDFEED.)
 
Last edited:
For the newer EMMA3R BDZ models without front button method for entering service mode, I figured out a few things:
* The USB drive is for storing the version update files when pairing the HDD
* A certain IR command (not sure how it maps to lirc) will set a flag to enter service mode
 
BDZ-V9 appears to refuse to play BDMV on DVD-RW/DVD+RW/BD-R/BD-RE (you will get 「思い出ディスクダビング」error instead).

However, it will work fine with commercial BD discs (not sure how this is determined, maybe AACS or other method).

When playing a commercial BD disc, the loading screen is similar to that of the BDP-S500, except that the loading bar is green instead of blue.

From the HES-V1000 manual (which is similar hardware-wise to BDZ-V9):

* The server does not support the BDMV format (one of the Blu-ray Disc™ specifications). You cannot playback or import BDMV content edited on PCs, or copy such content from the HDD to a disc.
* Only BD-REs/BD-Rs recorded in BDAV format are supported. BDMV format BD-REs/BD-Rs are not supported.
* The server does not support BD-ROM content that requires Internet connection.
 
Last edited:
For j9bdj, Runtime.exec eventually lands at execProgram, which is stubbed (resulting in IOException "Unable to start program").
However, System.load/System.loadLibrary eventually lands at j9sl_split_open_shared_library, which will load either the embedded static library (j9sl_up_open_shared_library->J9LinkedNatives), or call dlopen to load the dynamic library (j9sl_open_shared_library).
 
ibm-ws-rt has a copy of the IBM J9 runtime and JNI headers, located here: https://public.dhe.ibm.com/software/websphere/appserv/realtime/sr1/
I've archived it here: https://archive.org/details/ibm_ws_rt

In addition, Apache Harmony contains implementations of certain functions that function similarly to those of IBM J9 (which makes sense since IBM donated code to it):
https://github.com/apache/harmony/b...es/luni/src/main/native/luni/shared/process.c
https://github.com/apache/harmony/b...les/luni/src/main/native/luni/unix/procimpl.c
 
You must log in or register to reply here.

Similar threads

Back
Top