PS2 Crystal Chip R34 V5 Development

R3Z3N

Member
88.png


So I happen to be one of the lucky few that have a Crystal Chip modchip. Actually 3: CC2.0SLE, CC2.0, CC1.0. My goal is to implement a couple features that the team stated they did but either don't/didn't work or add a couple new features.

The Crystal Chip is the only PS2 modchip I know of where the Firmware is open source! Combined with it's closed source "Boot Manager" yet open source scripting labeled as *.PBAT we have a very versatile chip.

My current modifications can be found here: https://github.com/saildot4k/Crystal-Chip-R34-v3

More info about the chips can be found here: https://www.willsconsolemodifications.co.uk/ps2-wiki/chips.php

Great collection of modchip files: https://github.com/m4x10187/ps2-modchip-files

Goals:
  1. (COMPLETE) Boot BM from MemCard1 (done by crystal team decades ago)
  2. (COMPLETE) Boot BM from MemCard2 (finalized support for it a few days ago)
  3. (IN PROGRESS) Boot BM from USB (supposedly supported but yet to work)
  4. (IN PROGRESS) Boot BM from HDD (added code but does not load scripts, same issue as Goal 3)
  5. Alter FW to allow a boot order rather than 1 hardcoded choice of MC0,MC1,USB,iHDD
  6. Add FW support for 8MB DataFlash AT45DB642D (4MB AT45DB321D can be installed with no source changes)
  7. Allow CC2.0 with built in DataFlash to boot from MC0,MC1,USB,iHDD as well.
  8. Allow apps to access DataFlash storage. Probably needs app update and/or custom IRX.
  9. Reverse engineer such that others can order the parts, and reprint a PCB and solder the BOM (bill of materials)
Needed:
  1. someone with Assembly knowledge
  2. coders
I myself am not a coder but do have many IT skills, and am excited that I have at least completed Goal 2! (That was stupid simple, edit makeit_nocd to complile each version and label as such, then edit BM/FWS/LATEST/FWINFO.PBT to add choices)


I am hoping to list SMDs on the 3 chips I have and their values
IE FPGA: Actel Pro Asic APA075-F TQ100
DataFlash for CC 2.0: Atmel AT45DB081B-CNC (1MB, 528bytes/page)
DataFlash for CC 2.0SLE: Atmel AT45DB161B-CNC (2MB, 528bytes/page)
Supported Atmel AT45DB321D (4MB, 528bytes/page)
Would like to use AT45DB642D (8MB, 1056bytes/page)
 
Last edited:
What part of assembly are you interested in precisely? General knowledge in instructions? If so, add me on Discord - my username is the same as here.
 
What part of assembly are you interested in precisely? General knowledge in instructions? If so, add me on Discord - my username is the same as here.

Oddly I cannot "find" you on Discord. I am R3Z3N / .r3z3n

For example to choose where which boot firmware to compile in the OSDPAY.S file:
This is commented out for notes line 18
Code:
; This is the device the firmware will load BootManager from, if installed.
; Device
;   0 = Memory Card Slot 1
;   1 = Memory Card Slot 2
;   2 = USB HDD(requires USBD.IRX and USB_MASS.IRX to be stored at mc0:/BM/SHARED)
;   3 = CC2.0+ DataFlash(on-chip)
;
;BOOT_DEV                EQU 0

so to concentrate on fixing Dev mode 2 (line 657 of OSDPAY.S) for and/or combination of maybe making a "boot order" (mind you I changed: txtMC0_USBMASS to txtMC0_USBHDFSD and its reference to the same pointed file name: (The drivers used are EL ISRAS BDM ASSAULT and work fine when BM is running, allowing me to use an exfat usbstick). Sadly dev mode 3 is kicked to OSDSYS (sony memcard manager and settings)
Code:
args_boot:
IF BOOT_DEV == 0
MESSAGE "Booting from Memory Card Slot 1"
ALIGN 4
                        DW txtROM0_XSIO2MAN, txtROM0_XMCMAN, txtBM_ELF
argc_boot:              DW 3
txtBM_ELF:              DB "mc0:/BM/BM2.ELF",0
ENDIF

IF BOOT_DEV == 1
MESSAGE "Booting from Memory Card Slot 2"
ALIGN 4
                        DW txtROM0_XSIO2MAN, txtROM0_XMCMAN, txtBM_ELF
argc_boot:              DW 3
txtBM_ELF:              DB "mc1:/BM/BM2.ELF",0
ENDIF

IF BOOT_DEV == 2
MESSAGE "Booting from USB"
ALIGN 4
                        DW txtROM0_XSIO2MAN, txtROM0_XMCMAN, txtMC0_USBD, txtMC0_USBHDFSD, txtBM_ELF
argc_boot:              DW 5
txtBM_ELF:              DB "mass:/BM/BM2.ELF",0
txtMC0_USBD:            DB "-m mc0:/BM/SHARED/USBD.IRX",0
txtMC0_USBHDFSD:        DB "-m mc0:/BM/SHARED/USBHDFSD.IRX",0
ENDIF

IF BOOT_DEV == 3
MESSAGE "Booting from CC2.0+ DataFlash"
ALIGN 4
                        DW txtBM_ELF
argc_boot:              DW 1
txtBM_ELF:              DB "dffs:/BM/BM2.ELF",0
BIN_IOPLOAD:            INCLUDE BINARY "..\TMP\IOPLOAD.BIN"
ENDIF


And on the to the idea of boot order maybe something like:
Code:
args_boot:
IF BOOT_DEV == 0
MESSAGE "Booting from Memory Card Slot 1"
ALIGN 4
                        DW txtROM0_XSIO2MAN, txtROM0_XMCMAN, txtBM_ELFMC0
argc_boot:              DW 3
txtBM_ELFMC0:              DB "mc0:/BM/BM2.ELF",0
txtBM_ELFMC1:              DB "mc1:/BM/BM2.ELF",0
ENDIF


Line 5 also references txtBM_ELF, so unsure then how to add a second "failover" or if not avaliable, try txtBM_ELFMC1 etc. Of course want to run first avaliable...not multiple
Code:
_bootOSD:
                        sltiu       at, a2, 3
                        bnez        at, _noError
                        nop

                        lw          a0, 0x08(a3)
                        la          a1, txtBM_ELF
                        jal         strcmp
                        nop

                        bnez        v0, _noError
                        nop

                        li          at, 1
                        sw          at, 0x08(sp)

So I updated a couple things, yet to push to github as I also broke something:
So when choosing firmware IE load from MC0/1/USB/HDD I had it write a message to screen to make sure BM and drivers were installed however the boot cd did not give that option. Changed the boot cd to show "Device Manager" which is were you install drivers. I will probably change it to "Device Drivers" or something.

Ie do this before restarting as otherwise have to reboot recovery/upgrade disc and do that...which requires pressing reset 6x. Will want to make sure BM displays this info.

MC0/MC1 choices finalized and working great.

However broke boot cd now not showing usb or hdd when trying to flash fw from those sources....

USB/HDD preliminary support working....at least mass:/BM/BM2.ELF or pfs0:/BM/BM2.ELF runs. However once ran, Boot Manager from these sources does not actually have access to the scripts needed for the menus....(everything is an editable script for Boot Manager, which makes this awesome)

Also started work on including base apps like wLE ISR, KHN, OPL and choices as to run the Memory Module shutdown, drivers off, and normal. Cool thing is these individual choices can be autobooted, or shortcuts IE L1 can be wLE ISR with drivers off (because all the needed drivers are built into the ELF.

Sooo I think I have CCHW.S working to autodetect which DataFlash size is used when I do it by hand. Following along with ChatGPT works so far. Still waiting for my CC2.0 with 8MB dataflash back.
Opcode D7H calls a status register (Section 11-4 in the dataflash manual), and bits 5 through 2 identify storage size, however they mean nothing in decimal:


Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
RDY/BUSY COMP 1 0 1 1 PROTECT PAGE SIZE

So the firmware shifts right 3, and drops bits 7 through 3.
For example
10011100 becomes
00010011 becomes
00000011 which is 0x02 in hex (0x means hex, and would also ending in H like D7H above)

CC Team notes: xxxkb is dataflash size /xxx is page size
Code:
;001 - 512 /264 0x01
;010 - 1024/264 0x02
;011 - 2048/264 0x03
;100 - 4096/264 0x04
;101 - 4096/528 0x05
;110 - 8192/528 0x06

The AT45DB dataflash family has 6 models.
Code:
Model             Size   Page
AT45DB021D 128KB 264
AT45DB041D 512KB 264
AT45DB081D 1MB 264
AT45DB161D 2MB 528
AT45DB321D 4MB 528
AT45DB642D 8MB 1056
So the comments have 3 things wrong right off the bat. There are not 2 models of the 4MB and the 8MB is actually 1056-byte pages! The 2MB is also a 528-byte page! Is this why the CC 2.0 SLE sometimes loses its firmware? Because when running the D7H opcode, the 2MB gets a 264byte page assigned to it! :-(

So when looking here are the expected values:
Code:
; AT45DB Family D7H Opcode Section 11.4
; Bits 5 through 2 indicate size but have no meaning in decimal
; Shift Right 3, and mask lowest 3 bits
; AT45DB041D 10011100 gets converted to 011 0x03 DF_Page264
; AT45DB081D 10100100 gets converted to 100 0x04 DF_Page264
; AT45DB161D 10101100 gets converted to 101 0x05 DF_Page528
; AT45DB321D 10110100 gets converted to 110 0x06 DF_Page528
; AT45DB642D 10111100 gets converted to 111  0x07 DF_Page1056

So 2 things, let's correct what the firmware does to what it should and add code to run the branch for a 1056-byte page dataflash!


Code:
IF _F_CC_DF_Detect

; v3 of 1056-byte page testing
; AT45DB Family D7H Opcode Section 11.4
; Bits 5 through 2 indicate size but have no meaning in decimal
; Shift Right 3, then mask lowest 3 bits
; AT45DB041D 10011100 011 0x03 DF_Page264
; AT45DB081D 10100100 100 0x04 DF_Page264
; AT45DB161D 10101100 101 0x05 DF_Page528
; AT45DB321D 10110100 110 gets 0x06 DF_Page528
; AT45DB642D 10111100 111 gets 0x07 DF_Page1056

CC_DF_Detect            PROC
    addiu       sp, sp, -0x10
    sw          ra, 0x00(sp)
    nop
    bual        CC_DF_ReadStatus
    nop
    srl         t1, v0, 3         ; Shift right by 3 bits
    andi        t1, t1, 0x07      ; Mask the lowest 3 bits
    sltiu       at, t1, 0x05      ; Check if t1 < 5
    bnez        at, _set_264bytes
    sltiu       at, t1, 0x07      ; Check if t1 < 7
    bnez        at, _set_528bytes

    ; Default case for 1056 bytes
    li          t2, 1056          ; Set page size for 1056-byte dataflash
    la          t3, DF_Page1056   ; Set DF_Page handler for 1056-byte dataflash
    b           _done

_set_264bytes:
    li          t2, 264           ; Set page size for 264-byte dataflash
    la          t3, DF_Page264    ; Set DF_Page handler for DF_Page264
    b           _done

_set_528bytes:
    li          t2, 528           ; Set page size for 528-byte dataflash
    la          t3, DF_Page528    ; Set DF_Page handler for DF_Page528
    b           _done

_done:
    la          v0, dfdev
    sw          t2, 0x00(v0)
    lw          ra, 0x00(sp)
    sw          t3, 0x04(v0)
    jr          ra
    addiu       sp, sp, 0x10

CC_DF_Detect            ENDP
ENDIF

TLDR:
If masked bits are less than 5, set t1 to 264 branch
Otherwise if includes 5 or 6, set to 528 branch
If 7 or greater set to 1056 branch

and then we need the code for the DF_PAGE1056 code:
Code:
DF_Page1056             PROC

                        andi        v0, a2, 0xFF
                        sll         v0, v0, 8                           ; v0 = (baddr & 0xFF) << 8

                        srl         a2, a2, 8
                        andi        a2, a2, 0x07                        ; Mask the top 3 bits for 1056-byte addressing
                        or          v0, v0, a2

                        sll         v1, a1, 3                           ; Shift paddr left 3 bits
                        andi        v1, v1, 0xF8                        ; Mask for alignment
                        or          v0, v0, v1

                        sll         v0, v0, 8

                        srl         a1, a1, 5                           ; Shift right for remaining bits
                        or          v0, v0, a1
                        sll         v0, v0, 8

                        jr          ra
                        or          v0, v0, a0

DF_Page1056             ENDP

Simplified page detection logic down to 33 lines from almost 50....
 
Last edited by a moderator:
Hello! In read me to R34v3 i see that i can change memory chip to AT45DB641E, but what kind of it? Is AT45DB641E-MWHN-Y good choice?
 
Yes that is the correct choice. I am still testing and the changes to CCHW.S have not been pushed to the main branch yet for either 8MB dataflash. Updated readme to reflect that testing still is in progress.
 
Thanks! I'll try to replace when i got my CC 2.0. If AT45DB641E working fine without code changes, why you would like to use AT45DB642D? And what exactly purpose of dataflash memory in CC itself?
 
The 641E uses 264 byte pages and the 642D uses1056 byte pages. Both are essentially reported as value 0x07 (there are 7 dataflash variants in the AT45DBXXXD family) The Crystal Chip devs orig code said anything 0x05 and larger is 528 byte pages but I am unable to find a 8MB dataflash that uses 528 bytes, so the code had to be changed such that values 0x05 and 0x06 use 528 byte pages, and depending on model flash use 264 or 1056 byte pages. The current code handles the number of pages for an 8MB 264 byte page dataflash, but needs code to handle the 1056 byte pages.

Stayed up late till 4am playing with the 641E and am unhappy with it. I think the FPGA code needs changes for both varients so I have pulled references of 8MB dataflash for now (though the 2 8MB dataflash branches are on github)

So for now if you want to upgrade at least to 4MB, put in the AT45DB321D-MW(U) or -S(U). Parenthesis optional.

And what exactly purpose of dataflash memory in CC itself?
The EEPROM (CC1.0/1.1) Holds the firmware. The dataflash (CC1.2+) holds firmware, Bootmanager/scripts/drivers and any apps you can fit. Not all apps will run from dataflash, none outside of BootManager can read/write to dataflash, that would have to be added to apps which will not happen most likely.

The same is true for any other modchip. When you flash/upgrade the firmware you are not changing any code on the FPGA but rather the EEPROM (all other modchips that have upgradeable firmware)

Have made a few more quality of life improvements. I need to change such that they are dependent on the language scripts so they get translated as needed.

My main goal right now is to add "Kid Friendly Mode" IE PIN number to lock/unlock FW Upgrade/Erase and possibly more...
 
Last edited:
I see. Do you think you can get acess to dataflash memory storage for use it like usb/Hdd/etc.? And thanks for FW devolopment i will try that when my CC arrives. So to be clear, is CC 2.0(SLE) best chip among most functional chips like DMS4 or Matrix Infinity(genuine) ?
 
Do you think you can get acess to dataflash memory storage for use it like usb/Hdd/etc.?

Sort Of. Crystal Chip OG FW/Dashboard already supports installing other apps to the dataflash. Heck if you wanted the FW OSDPAY.S can be edited to run any APP/HOMEBREW you desire upon boot instead of booting to BootManager then autoloading another app via it's config settings. However as stated other apps do not read/write to the dataflash which may cause other issues. For example I have wLE_ISR and OPL installed to my dataflash. Those apps cannot read their own configs if they are looking where the app is run from IE PWD (path working directory) (though for OPL I use the HDD....) HOWEVER the crystal chip scripting DOES support file redirect....

For example file redirect: Any app that uses IPCONFIG.DAT IE wLE and BootManager I do a file redirect so that if I edit the IP via BootManager, the IP used by wLE is also updated....Check the readme as it tells which file to reference. I do hope to copy my setup to my github repository such that it is a full AIO (all in one) installer. Someday I shall update such that it supports UMCS/SAS (cant unpack .psu though via BootManager) but I can tell it to run apps outside of /BM/APPS/*

So to be clear, is CC 2.0(SLE) best chip among most functional chips like DMS4 or Matrix Infinity(genuine) ?

ANY version of the Crystal Chip is by far MUCH better than either. Exception to that is the 1.0 due to how the TO (tray open) line works, such that it is less consistent with some PS2 Slims. for booting or may need FW updated first in a PHAT to work.

DMS4 was shit as far as HW build quality was concerned. Unsure if just shitty PCB or purchased less than ideal build quality parts. It's does support using ones own USB IRXs though if I recall correctly. It's method for running games is dated and far outclassed by OPL/Nuetrino etc....It also does not get out of it's own way when loading homebrew requiring different IRXs/IOP reboot etc....

Matrix Infinity Genuine IMO is a pain to use if you don't have multiple PS2 to initially get setup. IE infinity manager/usb loading. And BOOT1/2/3 naming scheme is not user friendly if troubleshooting. Nor are the stupid naming scheme of Dev1 boot Dev2 boot etc. Should have been named USB Boot, HD Boot, MC Boot etc. It like most modchips has limited settings and does not get out of it's own way for apps that have built in IRXs....

The BIGGEST advantage CC has is its "easy" scripting and how it allows itself and modules to get out of the way and unloaded to not interefere with other things. For example I can unload the USBD.IRX and USBHDFSD.IRX when booting OPL/ WLE_ISR to not interfere with the drivers already installed in their .ELFs (the new way to do things). It's easy enough to do that for any driver or to reboot IOP... Of course it depends on how the APP is written IE does it reboot IOP? (may be incorrect info as I am not a PS2 dev/coder). Gets very complex.

If you want more info straight from the author of the CC code, head on over to the PS2 Scene Discord and read anything
asmblur_45mblur has written. I wouldn't bother contacting them as I have already tried and has not been on for 2 years now. Also want to not have too many trying to contact him in hopes of continuing and pushing him further out of the scene due to too many that are not devs themselves.


If I am lucky, I may get access to ~100 CC1.0s though at significant cost. Then I would be updating and handing out to some that want to help with features/updates/languages and then put back on market. If I am really lucky I will setup a "farm" to try to get access to the FPGA code. HW alone for that is ~$2500 per FPGA reader/programmer.... Will probably take years to do it that way....but alas if never tried then will never happen.
 
Last edited:
If you want more info straight from the author of the CC code, head on over to the PS2 Scene Discord and read anything
asmblur_45mblur has written. I wouldn't bother contacting them as I have already tried and has not been on for 2 years now. Also want to not have too many trying to contact him in hopes of continuing and pushing him further out of the scene due to too many that are not devs themselves.
Ok I'll take a look. I just curious what chip are the best( now i think is CC 2.0 SLE). I had v12 console with DMS4 as i remember i couldn't get to launch Silent Hill 2 Director's Cut on it. It started 1 time of 20 tries i think it's because of chip..
 
If you can't desolder the flash on a 1.2, 2.0 or 2.0 SLE, then yes 2.0SLE is the "best" All of them have the same features except again 1.2 and later can be upgraded easily to a 4MB dataflash. WIth a 1MB or larger dataflash, BootManager can be installed to the modchip.

20 Minutes ago I added "Security Settings" under Configuration which is a ""Kid Safe mode". Put in a PIN and advanced functions are locked out.


Added a theme I made for fun, Cotton Candy Slim. 1 version per chip made:
HRbBSmp.png


The goal was to set it to autoload the right chip....but on hold for now. Had it working.... Also, these image sizes are quite large. Forexample the old themes are ~35KB. These are ~350KB. Due to the size, while it loads on USB, it will not reload upon reboot. Only on faster Memcard or Dataflash. I may posterize or dither to reduce the number of colors....

MMCE support added to Crystal Chip R34 V3 (rolling release I guess....)
Run/Install/Remove to/from the device. :-D

B0YxAtI.png


MnTw3vP.png


Uploaded a "BootManager MegaPack 2-1-2025"

All of them are updated as of today. Things that are not allowed such as XEB+ is simply the script to run and inform user if not installed at mass if trying to run from elsewhere, and if not installed on mass informs you to install!

Any config for the app will need to be done, for example NHDDL, RETROLauncher, OSDXMB, etc.....

If there are any recommended apps to include, let me know....
If I don't update something soon enough, just replace contents as needed and update APPINFO.PBT with the new version of the app...

Next Milestone will be to inform user if device running from/installing to is not supported and will exit instead of continuing on....which means testing apps via Memcard, USB, HDD, MMCE and the 3 ways that each app can be loaded (shutdown memory module, disable usb/memcard, no option)

Why? Because I don't want YOU to worry about it unless you want to help support the project. I do this because I DONT WANT TO REMEMBER ANYTHING when I go to do this X years/days from now with the same apps installed from when I last left.

qeSx0UT.png


In other news...a batch of 100 Crystal Chip 1.0s should be here monday and are NOS (new old stock) 4 ghost 2 v2 chips, 2 DMS4 Lites, and then from other people I solicit: another genuine MI blue dot? and Ghost 2 v2 and DMS4 PRO SE from german ebay.
 
Last edited by a moderator:
Uploaded a "BootManager MegaPack 2-1-2025"
In other news...a batch of 100 Crystal Chip 1.0s should be here monday and are NOS (new old stock) 4 ghost 2 v2 chips, 2 DMS4 Lites, and then from other people I solicit: another genuine MI blue dot? and Ghost 2 v2 and DMS4 PRO SE from german ebay.
Thanks for updates. By the way, why do you looking for those other chips?
 
Of course, you are welcome. I do it for myself mostly it seems but glad a few will enjoy as word spreads like snails on tar!

Why the other chips? Because I can.

 
Last edited by a moderator:
Got back to it a little.

Added what I can for System info to recognize if it is a v17 or 18 board (90k). Sadly there is a wildcard bug, so using the teams way doesn't quite work as needed when a model may have multiple bootrom versions in same chassis...IE checking if SCPH-500* does not work oddly due to said wildcard bug...

This did get me on another path since BootROM 2.2, 2.3 or 2.5 (I believe latter is the KDL PS2 TV only) is only 75K and up Deckard units.

BootROM version is checked in initialization. IF 2.2 or later (Deckard), HDD modules will not load even if set to autoload since the SPEED chip is missing. This will help with compatibility by not loading unsupported modules. This also means if you have 2 or more Crystal Chips and move your memory card between units, your saved setting will work between units if the PS2 supports HDD (70k and lower)

HDD options are hidden in menu if 2.2 or later (Deckard).

MegaMemory patching is hidden from menu if unit is a PSTwo slim. Electrically this is not supported on slims...

So just QOL life adjustments so far. Starting more full bore on SAS support soon and adding power off and restart in main menu.
 
R34 V6 Changes by R3Z3N 11/17/2025
Fixes/Changes:
  • MMCE is now treated like HDD/NETWORK. You can enable/disable/autoload in the Configuration menu.
  • Advanced App Config added for apps that support more than 1 arg[v]. See APP_NHDDL for example from https://ps2store.com
    This is also useful for testing different boot methods. Reference SYS_OSDMENU from https://ps2store.com
  • Can delete saved app configs from BootManager saved variables (This does not affect apps that MAKE their own configs like OPL.)
  • Scripting cleanup/simplification
  • Fixed installer...some dumbass like me forgot each IF needs and ENDIF...SO SORRY!
 

Similar threads

Back
Top