I'm a little bored today so I thought I should give some interesting insight as to how Swap Magic and Action Replay discs are made for the PlayStation 2. It's been widely debated as to how this was pulled off, but the best explanation is that an original PS2 game was sacrificed using professional disc pressing equipment and then the leftover space where the files resides is used for the unlicensed software. Today I am going to reveal the big secret that those like Datel doesn't want you to know.
If you want to know what I mean, we need to look at a disc. Here's an example of a Swap Magic 3 disc (these are photos I found off an eBay listing since I can't find good photos of this online).
From the get-go, nothing seems too out of the ordinary with the front-side of the CD. That is, until we turn it around.
In the center of the disc, we get this strange pattern of rings; a lighter data portion, and the rest of the CD is slightly darker. It doesn't make sense until you look at the long mastering code outside of the hub of the disc which says "PTRM-001645". Now, which game do you think the people at Swap Magic used for their unlicensed backup loader of all things? Well me neither. But luckily the folks at the Redump Preservation Project has us covered; after doing a bit of research it became clear that this is the Greatest Hits release of "Crazy Taxi" (here), a noteworthy donor used in a lot of Datel's Action Replay discs. Then followed by this spliced portion, the rest consists of smaller and larger light rings, and several darker rings in-between sectors. It became clear as to how Swap Magic did this, and in a very clever way.
Every CD and DVD has a table-of-contents (or TOC for short) at the lead-in portion. This provides information to the drive about the start position of the track, the length of the disc in MSF (minutes, seconds and frame) and how many files and folders are present. When accessing files, the optical drive will need to know where exactly a file or a folder is by requesting the drive to locate it at an address within the index; this is done by logical block addressing (LBA). Each sector on a mode-1 or mode-2 disc has a 304-byte header at the beginning containing important information: the sector number and relative position, a checksum generated from the data alone (known as the "error detection code") and the ECC (error code correction) to compare and fix any problems that may arise if the disc was damaged.
If the console requests the drive to locate "MAIN.EXE" at LBA 24, it will recover the exact position of where it's at and load it into memory, which in this case is sector 0, relative to 2, and positioned at 24. How Swap Magic exploits this trickery is to splice only the TOC and watermark data requested by the PS2 to pass its security checks from an original game and then precisely know where the position of the executable is and press it on top of another disc with the Swap Magic code located in the same position as the executable, so that the laser would know and not keep seeking continuously. Of course, in order to squeeze the data into one tight space, lots of padding has to be made by not only filling unused files with dummy data, but they also made this useful by preventing other bootleggers from making copies of the software by pressing dark, blank rings into the disc as a form of copy protection; the same methods of pressing rings were used by other companies like ProRing and OK Media Group with their "Sysiphus" protection.
Each time Swap Magic boots up, bad sectors where the rings are located are checked before the menu boots up. If it fails, then you are stuck on this Swap Magic screen. That's why on its own, if you launch the main executable extracted from a rip, to a USB, and run it with wLaunchELF, it will freeze because the protection fails. The protection was eventually cracked soon after so uploads of Swap Magic without being in a disc image format will boot without needing the disc.
I hope you've learned something today, and hope I got the message around that this isn't some voodoo magic locked inside a vault never to be opened.
If you want to know what I mean, we need to look at a disc. Here's an example of a Swap Magic 3 disc (these are photos I found off an eBay listing since I can't find good photos of this online).
From the get-go, nothing seems too out of the ordinary with the front-side of the CD. That is, until we turn it around.
In the center of the disc, we get this strange pattern of rings; a lighter data portion, and the rest of the CD is slightly darker. It doesn't make sense until you look at the long mastering code outside of the hub of the disc which says "PTRM-001645". Now, which game do you think the people at Swap Magic used for their unlicensed backup loader of all things? Well me neither. But luckily the folks at the Redump Preservation Project has us covered; after doing a bit of research it became clear that this is the Greatest Hits release of "Crazy Taxi" (here), a noteworthy donor used in a lot of Datel's Action Replay discs. Then followed by this spliced portion, the rest consists of smaller and larger light rings, and several darker rings in-between sectors. It became clear as to how Swap Magic did this, and in a very clever way.
Every CD and DVD has a table-of-contents (or TOC for short) at the lead-in portion. This provides information to the drive about the start position of the track, the length of the disc in MSF (minutes, seconds and frame) and how many files and folders are present. When accessing files, the optical drive will need to know where exactly a file or a folder is by requesting the drive to locate it at an address within the index; this is done by logical block addressing (LBA). Each sector on a mode-1 or mode-2 disc has a 304-byte header at the beginning containing important information: the sector number and relative position, a checksum generated from the data alone (known as the "error detection code") and the ECC (error code correction) to compare and fix any problems that may arise if the disc was damaged.
If the console requests the drive to locate "MAIN.EXE" at LBA 24, it will recover the exact position of where it's at and load it into memory, which in this case is sector 0, relative to 2, and positioned at 24. How Swap Magic exploits this trickery is to splice only the TOC and watermark data requested by the PS2 to pass its security checks from an original game and then precisely know where the position of the executable is and press it on top of another disc with the Swap Magic code located in the same position as the executable, so that the laser would know and not keep seeking continuously. Of course, in order to squeeze the data into one tight space, lots of padding has to be made by not only filling unused files with dummy data, but they also made this useful by preventing other bootleggers from making copies of the software by pressing dark, blank rings into the disc as a form of copy protection; the same methods of pressing rings were used by other companies like ProRing and OK Media Group with their "Sysiphus" protection.
Each time Swap Magic boots up, bad sectors where the rings are located are checked before the menu boots up. If it fails, then you are stuck on this Swap Magic screen. That's why on its own, if you launch the main executable extracted from a rip, to a USB, and run it with wLaunchELF, it will freeze because the protection fails. The protection was eventually cracked soon after so uploads of Swap Magic without being in a disc image format will boot without needing the disc.
I hope you've learned something today, and hope I got the message around that this isn't some voodoo magic locked inside a vault never to be opened.
