Openscex

6084 bytes of flash · 8 board families, PU-7 to PM-41(2) · 3 regions · 0 MISRA deviations · 100% host line and branch coverage · 669/669 mutants killed

gh release download --repo gufranco/openscex-modchip --pattern 'openscex-modchip-attiny85.hex' --pattern SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing
avrdude -c <programmer> -p attiny85 -U flash:w:openscex-modchip-attiny85.hex:i

[!IMPORTANT] The current firmware passes the full simulation gate and has not yet run on a console. Measure the tap voltages before wiring. Source: compatibility reports, tests/sim.

Region-unlock firmware for the original PlayStation and the PSone, on an ATtiny85. It sends the configured region string only inside the SUBQ region-check window and keeps DATA high-impedance the rest of the time. It does not patch the boot ROM, so Japanese fat consoles and the PAL PSone also need a patched BIOS. It is not an optical-drive emulator, does not support PS2 or Saturn, and does not defeat LibCrypt. Source: src/run.c, src/inject.c, AGENTS.md.

Overview

Supported build per console

The PU-7 and PU-8 use the static-gate method, as in PsNee V9.0. Dev boards (DTL-H120x, PU-9) read burned discs natively and need no chip. Source: PsNee PSNee.ino L33-L38, PsNee PSNee.ino L10-L17, PsNee PSNee.ino L456-L490, src/subq.c.

Quick start

Each release carries prebuilt images: us, eu, jp, jp-vcd for the SCPH-5903, a quiet -final variant of each (see Status indicator), a SHA256SUMS file, the license, toolchain.spdx.json, an SPDX bill of materials of the toolchain that built them, and a build-provenance attestation for every one of those files, the bill of materials included. Check a download before flashing it:

sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify openscex-modchip-attiny85.hex --repo gufranco/openscex-modchip

Releases are versioned automatically from the commit history. To build from source, run every build, check and test through make in the pinned Docker toolchain; only avrdude runs on the host. Source: .releaserc.json, .github/workflows/release.yml.

git clone https://github.com/gufranco/openscex-modchip.git
cd openscex-modchip
make REGION=us                                        # America
make REGION=jp VCD_FILTER=on                          # SCPH-5903
make REGION=us PROFILE=final                          # America, quiet indicator
make REGION=us PROFILE=trace                          # America, debug trace on pin 2
avrdude -c <programmer> -p attiny85 -U flash:w:build/attiny85/release/openscex-modchip-attiny85.hex:i
avrdude -c <programmer> -p attiny85 -U lfuse:w:0xE2:m -U hfuse:w:0xDD:m -U efuse:w:0xFF:m

Any ISP works, including an Arduino as ISP. Write the flash first and the fuses last. The low fuse 0xE2 selects the internal 8 MHz oscillator, the slow-rising-power start-up delay and no clock divider (CKSEL 0010, SUT 10; datasheet Tables 6-6 and 6-7). The firmware also clears the clock prescaler at boot, so CKDIV8 cannot slow it. Reflashing erases the calibration record and oscillator trim; the chip learns them again. Source: Arduino as ISP, ATtiny25/45/85 datasheet 2586Q, src/run.c.

A new ATtiny85 ships with CKDIV8 programmed and runs at 1 MHz, so the ISP clock must stay below 250 kHz until the fuses are written; the datasheet requires each half of the ISP clock to last more than two CPU cycles. An Arduino as ISP already does. With another programmer, add avrdude's -B, for example -B 8, for the first write. Source: ATtiny25/45/85 datasheet 2586Q, avrdude manual, -B.

Brown-out detection holds the chip in reset below 2.7 V, the ATtiny85's minimum supply for its speed grade; keep it on. The firmware also measures its supply before every string and holds back below about 2.75 V, shown as code 7. That limit still passes a 3.3 V supply 5 percent low on a chip whose bandgap reads high. Source: ATtiny25/45/85 datasheet 2586Q, src/supply.c.

Verify with the Makefile targets:

make size        # image size; fails when less than 256 bytes of flash stay free
make test        # host tests, simavr console model and its stack check
make analyse     # formatting, lint, types, licences, MISRA and the Python tests
make repro       # every release image, built twice from clean, byte-identical
make mutate      # mutation testing on the logic layer
make mutate_platform  # mutation of run.c and engine.c, killed by the simulator
make bench_ci    # console bench: this firmware against PsNee in the same simulated console

CI runs the same gates on every push to main and every pull request, as defined in .github/workflows/ci.yml. make mutate_platform runs in its own workflow, .github/workflows/mutation.yml, whenever the firmware, the simulator suite, the mutation tool or the pinned toolchain changes. make hooks enables the commit-message and formatting checks locally.

MCU pinout

The four SCEx signals and the indicator pin keep PsNee's ATtiny85 assignment from its MCU.h, so PsNee wiring guides match pin for pin. PB5 stays RESET, so the chip remains ISP-programmable. Pin numbers are for the 8-pin PDIP; check the datasheet for SOIC. Source: PsNee MCU.h L453-L530, include/port/registers.h, ATtiny25/45/85 datasheet 2586Q.

Console tap points

The photos below label SQCK, SUBQ, DATA, WFCK, VCC and GND on each board; solder each wire where they are marked. The PU-18 photo shows the underside. Leave AX, DX and RESET unconnected: they belong to PsNee's boot-ROM patch. Source: assets/psnee.

PU-7. Photo from PsNee	PU-8, 1-658-467-22. Photo from PsNee	PU-8, 1-658-467-12. Photo from PsNee
PU-18. Photo from PsNee	PU-20. Photo from PsNee	PU-22. Photo from PsNee
PU-23. Photo from PsNee	PM-41. Photo from PsNee	PM-41(2). Photo from PsNee

These nine photos come from PsNee V9.0 by kalymos and its contributors, released into the public domain under the Unlicense, and are copied here resized.

With no clock or lid wire, the chip can sit anywhere the four signal wires reach. Keep those wires short: long wires pick up noise, a known cause of Mayumi V4 failures (quade.co). Remove the clock and lid wires of an install made for an earlier release before flashing this firmware, because pin 2 is now PB3, the indicator output, and would drive against a console clock left there. Source: src/trim.c, src/loop.c, quade.co Mayumi V4 guide, include/port/registers.h.

Board

One optional board holds the chip in a DIP-8 socket, so it comes out for reflashing. The console wires land on six 4 by 4 mm top-side pads with no holes, 6 mm apart along the bottom edge: WFCK, SQCK, SUBQ, DATA, VCC and GND. Every part is through-hole. The socket, a 100 nF decoupling capacitor, a 220 µF bulk capacitor and a 10 kΩ RESET pull-up are always fitted, the pull-up because the chip's internal one is weak against console noise. Three headers are optional and marked "opt" on the board, so a build fits only what it uses. The board is a KiCad 10 project with its schematic, layout and design rules, 35.6 × 34.3 mm. Source: hardware/openscex.kicad_sch, hardware/openscex.kicad_pcb.

The board, 3D view

The board, top

The board, bottom, the ground plane

The board is symmetric about its vertical centre line: the chip, the serial header and the row of wire pads sit on it, and the ISP header on the left is balanced by the indicator header, R1 and C1 on the right. It has two layers laid out against noise. Every track is as wide as its route allows, 1.0 mm on this board; tracks run on top where they can, so the bottom stays a ground plane under the console lines; both layers are ground-poured and stitched with 0.6 mm vias; every bend is a tangent arc of at most 45 degrees; different nets keep 1 mm apart and 0.8 mm from pads. Source: hardware/openscex.kicad_pcb, hardware/openscex.kicad_dru.

The ISP header follows the AVR 6-pin layout: 1 MISO on SUBQ, 2 VCC, 3 SCK on DATA, 4 MOSI on SQCK, 5 RESET, 6 GND. Its keyed shroud keeps 1.5 mm clear of every other part. Reflash with the board out of the console or its wires unsoldered; in place, the programmer would feed the console's supply and fight the console's drivers on SQCK and SUBQ. Source: hardware/openscex.kicad_sch, ATtiny25/45/85 datasheet 2586Q.

J2 is a keyed JST XH header, so its plug goes in one way only. Its pins follow the RC servo order, GND, VCC, signal: VCC in the middle never meets a ground wire, so even a plug forced in reversed powers nothing backwards. VCC powers whatever the cable leads to, such as a buzzer module or a board of your own; a plain LED needs only GND and SIG. VCC is the console's 3.5 V rail, so a cable must never join it to GND. Source: hardware/openscex.kicad_sch, JST XH datasheet.

The serial header J3 takes the 6-way socket of an FTDI TTL-232R cable: pin 1 is GND, pin 5 the cable's RXD input, and pins 2, 3, 4 and 6 stay open, so the cable's 5 V output never reaches the console. It stands at the top edge with 2 mm clear around it, so the socket meets no other part. J2 and J3 both carry PB3, and the image flashed decides what PB3 is, so plug only the cable that matches it: the indicator cable for debug or final, the serial cable for trace. Source: hardware/openscex.kicad_sch, hardware/openscex.kicad_pcb, TTL-232R datasheet.

The board has a bill of materials, whose Fit column names the optional parts, and a Gerber and drill archive ready for a board house, both exported with KiCad 10.0.6. Teardrops are drawn into the board, so the archive needs no refill in KiCad. Source: hardware/openscex-bom.csv, hardware/fab/openscex-gerbers.zip.

Safety

• Measure the voltage at every tap point before wiring. Every board, PU-7 to PM-41(2), runs most of its chips from +3.5 V, and that is the chip's supply; the board's +5 V rail feeds a few parts such as the AV multi out, the audio amplifier and the regulator for the sound and CD supply, and PsNee warns against wiring the chip to it. Source: psx-spx pinouts.md, voltage summary, PsNee changelog.
• Opening a console and soldering to the CD subsystem can destroy it. Build at your own risk. Source: quade.co PS1 modchip guide.

Status indicator

PB3 drives an optional indicator, usually an LED, the chip's only diagnostic channel. It shows the current stage, whether each disc passed its region check, and which wire to check when something fails. It never delays or gates a feature and keeps no history, so every code except the two boot codes describes the present. Source: src/indicator.c.

Two builds drive the pin. debug, the default, shows everything below; final, built with make PROFILE=final and released as the -final images, stays quiet. Flash debug to install and troubleshoot, then final to play. Only the pin differs: the simulator checks edge by edge that both send the same strings at the same times. Source: include/pscu/indicator.h, tests/sim/sim_profile.c.

Codes are long 700 ms flashes, 300 ms apart, with a 2 s pause before the code repeats. In final, codes 3 and 4 play once per disc, and code 7 repeats every 30 s while it holds. Source: src/indicator.c.

Serial trace

make PROFILE=trace builds an image that turns pin 2 (PB3) into a serial line instead of the indicator, at 115200 baud, 8N1. It carries everything needed to find a fault without an oscilloscope: a boot report, every SUBQ frame the chip captured, and a line for every decision it took, each with its time since power-on. The lines go out in the gap after each frame, at most one decision per gap, so DATA sends the same strings with the same bit timing as the other two images, each string starting at most one frame later, which the simulator checks edge by edge. Source: src/trace.c, src/run.c, tests/sim/sim_trace.c, tests/sim/sim_profile.c.

To connect it on the board, plug a TTL-232R cable onto the serial header J3, black wire on GND, with no indicator cable on J2. On a bare chip, wire pin 2 to the RX input of a USB serial adapter and its ground to the console's ground. The line swings between 0 and the console's 3.5 V logic supply, which a 3.3 V adapter such as the TTL-232R-3V3 reads. Start the capture before powering the console, so the boot report is in it. Source: hardware/openscex.kicad_sch, TTL-232R datasheet, psx-spx pinouts.md, voltage summary.

# Linux; on macOS the port is /dev/cu.usbserial-*, and stty takes -f
stty -F /dev/ttyUSB0 115200 raw && cat /dev/ttyUSB0 | tee capture.txt
python3 tools/serial_trace.py capture.txt

Each frame line is the 12 SUBQ bytes in hex; a failed capture reads as all F. Every other line starts with @ and the time, such as @1.460 OPEN 0A 0A, in seconds and milliseconds since power-on. Source: src/trace.c.

tools/serial_trace.py reads a saved capture, or the terminal piped into it, and prints the timeline in words, with each frame's place on the disc and its CRC checked and runs of the same frame folded into one line. It ends with a diagnosis that names the likely fault and what to check: no frame or every capture failed points to the SQCK and SUBQ wires, many bad CRCs to noise on them, watchdog restarts to a supply dip or noise that stopped the main loop, repeated power-on starts or a low supply to the power tap, a lead-in that never opens the window to the learned start, strings without PASS to the DATA and WFCK wires or a region mismatch, and PASS with a game that still stops to an anti-mod check or a boot-ROM region check. --summary prints the diagnosis alone. Source: tools/serial_trace.py, tests/serial_trace/test_serial_trace.py.

How it works

graph LR
    subgraph Console
        CD[CD subsystem]
        WF[WFCK]
        MECH[Mechacon]
    end
    subgraph ATtiny85
        CAP[SUBQ capture]
        DET[Region-check detector]
        ST[Stealth state machine]
        INJ[SCEx injector]
        IND[Status indicator]
        CAL[Per-console calibration]
    end
    CD -->|SQCK, SUBQ| CAP
    CAP --> DET --> ST --> INJ
    ST --> IND
    ST <-->|start| CAL
    WF -->|gate or carrier| INJ
    INJ -->|DATA| MECH

What's included

Per-console calibration

The chip learns how this console reads the region string and keeps the result in a six-byte EEPROM record, so later discs spend less time with DATA driven. Learned values only fall back toward the defaults, so a lost, damaged or foreign record costs stealth, never a disc. Source: src/calib.c.

The chip writes only changed bytes, only at boot, after a disc's check resolves, when the oscillator trim moves, or once, just before the first string, when a WFCK carrier appears after power-on, and otherwise never while the stealth window is open or held, and a write that cannot finish is kept and retried, so a settled console with a settled trim writes nothing; cell endurance is 100,000 writes. A check byte makes a record cut short by power-off read as the defaults. Reflashing erases the record, because both fuse sets leave EESAVE unprogrammed (datasheet Table 20-4, high fuse bit 3). The 2-frame step and the 20-frame bound are not yet tuned on a console. The trim targets the datasheet's 1% after user calibration, against 10% from the factory (Table 21-2). Source: src/calib.c, src/run.c, src/port_chip.S, ATtiny25/45/85 datasheet 2586Q.

Configuration

One source builds every variant; the knobs are passed to make. Source: Makefile.

A non-default region, filter or profile tags the artifact name, for example openscex-modchip-attiny85-jp.hex, openscex-modchip-attiny85-jp-vcd.hex or openscex-modchip-attiny85-final.hex. Source: Makefile.

Against other chips

In the console bench

The console bench plays one simulated console into every chip it can build or load. Each check models an anti-mod test or a console fault and holds only if it holds in every scenario for a board the chip targets; a chip that targets none of those boards reads n/a. These are simulation results, not console results; CONTRIBUTING.md describes the model and its sources.

• Silent in the anti-mod v1 probe: the game counts SCEx strings while playing the program area, where an original disc has none; any string it receives whole there means a modchip. Source: psx-spx cdromformat.md, anti-modchip.
• Re-authenticates in the anti-mod v2 re-read: ReadTOC clears the licensed status, and GetID fails on a copy unless a full string arrives while the lead-in is read again. Source: tonyhax docs/ap_v2.c, aprip readme, APv2.
• Silent in the anti-mod v2 probe: after the re-read the game seeks to the middle of the disc and counts SCEx strings again. Source: tonyhax docs/ap_v2.c, psx-spx cdromformat.md, anti-modchip.
• No string once the game runs: the region check reads the lead-in; a string while the program area is read is what a detector looks for. Source: psx-spx cdromdrive.md, 19h,04h.
• Console pins float while not injecting: a line driven or pulled up between strings loads the console's own signal, the PM-41(2) pickup noise, and is visible to anything watching it; checked on DATA, the gate and every input. Source: quade.co PsNee guide, bench runners.
• Accepts after SQCK sticks low: a clock that stops mid-frame must not hang the chip past the check. Source: tools/bench/edge_scenarios.py.
• Recovers from a WFCK stall, WFCK never driven: on a carrier board WFCK is the CD DSP's output; driving it fights the console. Source: tools/bench/edge_scenarios.py.
• Rearms for a second disc: a multi-disc game asks for the region again after a swap. Source: tools/bench/scenarios.py.

Tested on hardware

Combinations that booted out-of-region discs on a real console with the console-clock firmware of 2026-10-05. Source: compatibility reports.

That firmware predates the lid-wire-free swap detection, the trimmed oscillator, program-area silence, re-read handling and the bounded SUBQ waits; the current firmware has not yet run on a console. Untested on hardware: PU-7, PU-8, PU-20, PU-22, PU-23, PM-41(2), and PAL or NTSC-J on any family. Source: compatibility reports, AGENTS.md.

To add your console, open a compatibility report. A disc with anti-mod protection, APv1 or APv2, tests the stealth window hardest: it boots only if the chip stays silent once the console reads the game. The form asks for one; the tonyhax international anti-piracy table lists 57 APv1 and 200 APv2 discs. Source: tonyhax international anti-piracy table, src/inject.c.

Versioning

Releases follow Semantic Versioning on the 0.x line, so a minor release can break compatibility. v0.3.0 to v0.8.0 are ATtiny84 builds, and releases up to v0.2.0 are ATtiny85 builds of an earlier four-wire design. Each release is built from a commit whose CI passed, and whose platform mutation run passed when the push changed what it covers, plus its changelog entry, and the release job refuses a tag that changes anything else; notes are on the releases page.

Support

License

MIT for the firmware, the documentation and the board designs in hardware/.

The footprints in hardware/openscex.pretty start from KiCad's library footprints and keep their licence, CC-BY-SA-4.0 with the KiCad libraries exception: a board made with them carries no obligation. Source: REUSE.toml.