P L A Y S T A T I O N / P S - O N E |
|
|
|
Release
Protection
CD Covers
Manual |
: 21-10-1998 (US)
: SCEE
: -
: - |
|
PSX Hacker v1.1 [8 kb] - CLI only version. |
HTTP |
|
|
GUI Hacker v1.0 [26 kb] - Graphics/GUI frontend for PSX Hacker |
HTTP |
|
|
PSX Hacker MediEvil [UK] Patch [2 kb] |
HTTP |
|
|
PSX Hacker MediEvil [GERMAN] Patch [3 kb] |
HTTP |
|
|
|
Short Instructions (read the included text file for additional information):
- Create a ISO image using MakeCD.
- Apply the appropriate country Patch:
- PSXHacker r medievil_uk.pat CDI1:01_Mode2_49_57_33
- PSXHacker r medievil_de.pat CDI1:01_Mode2_49_57_33
- Burn the ISO image back to a CD-R.
|
NOTE: |
These tools are for the AMIGA computer ONLY and don't work on a PC. |
|
|
|
Patch Archive [4 kb] - Patcher for the UK & Australian version. |
HTTP |
|
|
Patch Archive [4 kb] - Patcher for the French version. |
HTTP |
|
|
Patch Archive [91 kb] - HexEdit for the UK & Australian version. |
HTTP |
|
|
|
If you try to run it on any other version, it will probably complain that it cannot find the bytes.
- Make an image file from your CD and call it 'medievil.nrg'
- Place medievil.com in the same directory and run it.
It's not perfect because there are 10 locations (7 for the French) to patch and for each one, the whole image is searched from the start.
I hope to brush up on my assembly language to improve this but for now it's better than editing the image manually.
This patch uses a "Search and Replace" method to patch the necessary bytes rather than the normal offset method and so should work on ANY image file no matter what software produced it.
The filename does need to be medievil.nrg though so if you are using CDRWin, rename the .bin file, patch it then rename it back before burning. |
NOTE: |
These patches don't work for the SPANISH & ITALIAN versions! |
|
|
|
MediEvil WalkThrough |
HTTP |
|
|
|
|
As for chopping the image, all it requires is that the post-gap is removed (it depends on the writer, but usually it's either 450 or 452 sectors, so cut 2352*n off the end. Where 'n' is the required value your burner adds to tracks in TAO mode. This may not be required, but I assume that the reported track length in the TOC is checked, so any post-gap added by a TAO written track *may* not work correctly due to the extra 'n' sectors. Come to think of it, just strip 450 sectors, as the PSX doesn't report frames, so +/- 2 sectors won't make a difference.
Basically, chop of 2352*450 (1,058,400 bytes) from the end of the image and write it in TAO mode and close the disc. It should then work on any burner that accepts RAW data sectors (2352 bytes) and writes in TAO mode. It is also imperative that the track type is set as Mode2/Form2 (XA) in the cue-sheet. This should be obvious, though.
As for software that supports TAO, most software should do TAO (like EasyCD Pro, just don't select the DAO option any it will default to TAO).
Mario. |
NOTE: |
By removing (chopping) the existing post-gap from an image, the CD burner is forced to generate a new post-gap (holding the correct EDC/ECC). |
|
|
I have tried TRSIMEDI.zip on German, French, UK, Spanish and Australian versions and it works 100% - but the writer must be able to regenerate the EDC/ECC.
There is no reason to hex edit or run any other patches.
BTW: It should be possible to write it on ANY writer, just chop the image and write it in TAO instead of DAO, as all writers should regenerate EDC/ECC when in TAO mode.
Mario. |
|
Here is a list of the CD-Writers that correctly recalculate the CheckSum when burning (the patch is still needed to remove the protection!): |
CD Writer [Firmware] |
Software |
Version |
Patch |
PSX |
JVC XR-W2010 [1.52i] |
CDRWIN 3.6b |
German |
TRSIMEDI.zip |
SCPH-1002, 5502, 5552, 7002, 7502 |
HP7100 [3.01] |
CDRWIN 3.6a (image) & FireBurner (burn in TAO Mode) |
Spanish |
TRSIMEDI.zip |
SCPH-5502 |
HP7100i [3.01] |
CDRWIN 3.6a (image), BinChunker 1.56 (create 2 tracks) WinOnCD (burn in TAO Mode) |
French |
TRSIMEDI.zip |
SCPH-5502 |
HP7200i [3.01] |
CDRWIN 3.6a |
UK |
Hex Edit |
SCPH-1002 |
HP7200i [3.01] |
CDRWIN 3.6b |
Swedish |
TRSIMEDI.zip |
SCPH-1002 |
HP8100i [1.0g] |
CDRWIN 3.6a |
UK |
TRSIMEDI.zip |
SCPH-1002 |
Matshushita CW-7502 |
CDRWIN 3.6a |
Dutch |
TRSIMEDI.zip |
- |
Matshushita CW-7502 [3.02] |
CDRWIN 3.6a |
Spanish |
TRSIMEDI.zip |
SCPH-5502 |
Memorex CRW-1622 [D3.7] |
NTI CD-Copy 95 3.1.550MU (set ignore source cd medium error) |
UK |
Hex Edit |
SCPH-5502 |
Panasonic 7502 [4.10] |
CDRWIN 3.6a |
French
Australian |
TRSIMEDI.zip
Hex Edit |
SCPH-1002 |
Philips CDD-2600 |
CDRWIN 3.5c |
UK |
TRSIMEDI.zip |
All |
Philips CDD-3610 |
EasyCDPro 2.11 |
Italian |
TRSIMEDI.zip |
SCPH-5502 |
PlexWriter 412 [1.04/1.06] |
CDRWIN 3.6a |
French |
TRSIMEDI.zip |
All |
PlexWriter 412 [1.04/1.06] |
CDRWIN 3.6a |
UK |
TRSIMEDI.zip |
SCPH-5502 |
Ricoh MP6200s [1.0] |
CDRWIN 3.6a |
French |
TRSIMEDI.zip |
SCPH-1002, 55x2 |
Sony CDU920S [2.0c] |
CDRWIN 3.6a |
UK |
TRSIMEDI.zip |
SCPH-5502, 7002, 7502 |
Sony CDU928E [1.1e] |
EasyCDPro 2.11 |
UK |
Hex Edit |
SCPH-1002 |
Sony CDU948S [1.0e] |
Nero 3.0.7.1 |
UK |
Hex Edit |
SCPH-55x2 |
Teac 55S [1.1] |
CDRWIN 3.5c |
German |
PATCH.zip, TRSI didn't work |
SCPH-1002 |
Teac 55S [1.0g] |
CDRWIN 3.6a |
German |
PATCH.zip |
SCPH-5502, 7002 |
Teac 55S [1.k] |
CDRWIN 3.6a
Jitter disabled |
Italian |
TRSIMEDI.zip |
SCPH-1001, 5502, 7200 |
Traxdata CDR2260plus
(Yamaha CDR200) |
CDRWIN 3.6b |
German |
PATCH.zip |
SCPH-7502 |
Traxdata CDR2600
(Yamaha CDR200) |
WinOnCD 3.0 (in TAO Mode) |
- |
PATCH.zip |
- |
Traxdata CDR4120 [5.0j] |
CDRWIN 3.6a |
German |
PATCH.zip, TRSI didn't work |
SCPH-1002 |
Traxdata CDR4120 Pro [5.0h] |
Nero 4.0.0.2 |
UK |
Hex Edit |
SCPH-1002 |
Yamaha CDR100 [1.12] |
CDRWIN 3.6a |
German |
PATCH.zip |
SCPH-7002 |
Yamaha CDR100 [1.12] |
ECD Pro MM v3
(TAO, CDROM XA Mode) |
Australian |
TRSIMEDI.zip |
SCPH-5502, 7002, 7502 |
Yamaha CDR200t [1.0n] |
CDRWIN 3.6a |
Spanish |
TRSIMEDI.zip |
SCPH-1002, 5002, 5502, 7002 |
Yamaha CDR200 [1.0h] |
CDRWIN |
Italian |
TRSIMEDI.zip |
SCPH-700x |
Yamaha CDR400t [1.0n] |
DAO 3.5c
Prassi CDRight+ |
- |
TRSIMEDI.zip |
SCPH-5502 |
Yamaha CDR400at [1.0m] |
CDRWIN 3.5c |
German |
TRSIMEDI.zip |
SCPH-5502 |
Yamaha CDR4000t |
- |
- |
- |
- |
Yamaha CRW2260 |
- |
- |
Hex Edit |
- |
Yamaha CRW4260 [1.0h] |
- |
- |
Hex Edit |
- |
Yamaha CRW4260 |
CDRWIN 3.6a |
UK |
TRSIMEDI.zip |
SCPH-5502, 7002, 7502 |
Yamaha CRW4260 |
CDRWIN 3.6a |
Spanish |
TRSIMEDI.zip |
SCPH-5502, 7002, 7502 |
Yamaha CRW4260 [1.0j] |
CDRWIN 3.6b |
German |
PATCH.zip |
SCPH-7002c |
Yamaha CRW4260 [1.0j/q] |
CDRWIN 3.6b |
German |
TRSIMEDI.zip |
SCPH-1002, 5502, 5552, 7002, 7502 |
Yamaha CRW4416 [1.0b] |
CDRWIN 3.6b |
German |
TRSIMEDI.zip |
SCPH-1002, 5502, 5552, 7002, 7502 |
|
Here is a list of the CD-Writers that failed to copy: |
CD Writer [Firmware] |
Traxdata CDR4120 pro [5.0J] - Teac 55S drive |
JVC XR2020 |
|
|
If you do not already have a hex editor, then use HEdit.
When hacking a binary CD image, you are upsetting the checksums that are built into the image to ensure data integrity. A CD Recorder will handle this in one of two ways:
- It will recalculate the checksum based on the data in the sector. This is what happened for the people who were successful with my original patch.
- It will recalculate the data based on the checksum. This is what happened to the people who were unsuccessful. The patch was overwritten by the CD Recorder.
The following screen grabs show a bad non working copy of Medievil on the left and a Good patched version on the right. The differences are highlighted.
What you need to do is use your Hex Editor to SEARCH for a sequence of bytes that appear in the pictures. When you are happy that the bytes you are looking at are the actual bytes shown on the left of my screen grabs then you can proceed to edit them to the values on the right.
I did warn you that it was a lot of editing.
The image file used was made with Nero Burning Rom and the Hex editor used was HEdit. If you use the same (although it is not compulsory) it is highly likely that the locations of the bytes to change will also be the same.
Please do not mail me telling me that you cannot find the bytes listed. This patch should work with the English version and the Australian version. It may work with others but I'm not sure.
If you are successful using this patch then by all means send me a mail telling me so. If you get another coaster then send flame mail to postmaster@localhost.
Here we go:-
|
Double-click the picture to see all six pictures! |
Done editing?
Then save the edited image file and burn it to a new CD. |
|
The "MediEvil Patch [UK PAL & ALL] CD-Copy Instructions (by DAZ)" can also be used for the Australian version. Only the offsets locations different slightly:
- Location 1: 18833854 hex
- Location 2: 187ACFFC hex
- Location 3: 187AD164 hex
These values are the hexadecimal addresses "highlighted/selected locations" in the DAZ fix!
Tnx to Cameron Stepens for sending this fix by e-mail! |
|
|
Patch Archive [3 kb] |
HTTP |
|
|
|
Backup Instructions:
- Make an Image-Copy using CDRWIN (using the RAW-Option).
- Use TRSIMEDI.EXE from the archive to patch the imagefile.
- Burn the image onto a CD-R.
Tnx to Joost & Mario for both supplying the fix! |
NOTE: |
It has been reported that this fix fails on the French & Spanish versions!
It, for sure, doesn't work on the German version, use the PATCH.zip instead! |
|
|
Also checked on Australian version which is PAL. The byte offsets are different but it the sequence of bytes is the same and so is searchable. Given this information, I don't see why it shouldn't work for any version. (Not sure about NTSC though). Let me know eh.
When copied to a recordable CD this game will not allow you to play level 4 (The Hilltop Mausoleum). To fix this limitation, do the following:
To apply the patch you will need:
Software to produce a binary CD image (CDRWin recommended)
- A Hex editor (like HEdit)
- A CD Recorder
- A blank CD
The patch:
- Extract the CD image from the CD (original or unworking copy)
- Load the CD image into your Hex Editor
- The exact positions within the file may change depending on what software you use to record the image file. The following pictures are included so you can see the byte sequence around the necessary locations and were taken from an image using CDRWin.
There are 3 locations which require changes.
Location 1:
Change the highlighted locations to 'AA 87' . Yes I know the picture above shows them already changed but I had already done that before I grabbed the screen. Just search for the bytes before and after.
Location 2:
Change the selected locations to '00 00 00 00'
Location 3:
Change the selected locations to '00 00 00 00'
If you now SAVE the amended CD image and burn this image to a CD you should have a fully functional 'back-up' copy of Medievil.
Credit also goes to MrSporty who provided the Action Replay codes for the game which my patch is based on.
If anybody would like to produce an easier way to make an executable patch from my method then please let me know first and credit me when you do it. That's all I ask.
Disclaimer:
The method described above worked for me and should work for anybody who has the UK PAL version of Medievil that stopped at level 4. If it doesn't work for you then I'm really sorry but I can't help you any further. |
NOTE: |
It has been reported that this fix also works with the Australian version and it should work for ANY version!!! |
|
|
|
Patch Archive [21 kb] |
HTTP |
|
|
|
Backup Instructions:
- Make an Image-Copy using CDRWIN onto you harddisk, image filename: MEDIEVIL.BIN
- Use the PATCH.EXE from the archive to patch the MEDIEVIL.BIN imagefile.
- Burn the image onto a CD-R.
NOTE: |
This fix works ONLY for the German version!!! |
|
|
|
Patch Archive [14 kb] |
HTTP |
|
|
|
Backup Instructions:
- Make an Image-Copy using CDRWIN onto you harddisk, image filename: MEDIEVIL.BIN
- Use the MEDIEVIL.EXE from the archive to patch the MEDIEVIL.BIN imagefile.
- Burn the image onto a CD-R.
|
Info on the MediEvil Protection (Myst3rio):
first of all: don't use any patch. By now there isn't a working patch.
The protection is the same in each country but it uses different values from localization to localization. So we need different gameshark-codes/patch for each version. For example ITA and UK, both pal, differ for the value and the offset to change in memory. |
|
|
The protection is checked by reading certain sectors on the disk at a specific point in the game ... if you want to see this happening , use a blob of blue tack to jam the lid switch. Then load the disk ... go through all the intro and start a game ... when you get to the level select screen with the skull , watch the CD .. it will spin up to x4 speed for approx 1/2 a second then back to x2 speed and start playing some background music ... that's the check !!!
The check (we believe) is a sector read and it will return the following depending on the disk being original or a copy :
000db070 - aa87 0000 0800 - Original Disk
000db070 - 0000 0000 0000 - Backup Copy
000db070 - 800d b22c 197a - German Version
Ok , to bypass this , you will need an Explorer/Game Shark cartridge and what you will have to enter the following code (depending on the country):
PAL UK |
300DB07000AA
300DB0710087 |
PAL ITA |
300DB2AC00A6
300DB2AD00AA |
PAL FRA |
800DB404D16A |
After this has been entered ... the game will pass the protection check no
worries...
So , by now you all should be playing level 5 and onwards .. but it don't end
there , what we need from all of you is to play test the game and report
any more checks that we may have missed ,also we need the byte offsets
checked on NTSC games/machines .. and finally could somebody who can use
this info , produce a hard byte patch to kill this protection routine once
and for all... |
|
|
|
|