How the PS1 was hacked
The Purpose
Sony was concerned about using cd rom games because CD burners were already widely available, and they were worried about pirated games. Sony decided to accomplish this through hardware instead of software.
Sony did not use software encryption to protect PS1 games. Instead, they used a physical manufacturing trick:
- The Wobble: Official PS1 discs had a microscopic, wavy deviation in the data track called a “wobble groove”.
- The Country Code: This wobble vibrated at a specific frequency that spelled out an ASCII string (“SCEA” for America, “SCEE” for Europe, “SCEI” for Japan).
- The Laser: The PS1 hardware laser read this physical wobble only during the first few seconds of booting a disc.
- The Catch: Standard consumer CD burners could not replicate this physical wobble groove on blank CD-Rs. If the PS1 laser didn’t detect the wobble, it assumed the disc was a pirate copy and blocked it.
The Wobble
Sony added a factory-burned ‘wobble ring’ that no consumer CD burner could duplicate. This wobble ring was read on boot up. Once the ring was read and comfirmed bu the cpu, the sony did a soft-reboot and started the game.
The Swap Trick
The exact method Sony used allowed for an insanely simple way to bypass the security. The Swap Trick.
The earliest hack required zero hardware modifications, relying purely on timing and physics:
- The Jam: Hackers used a piece of tape or a plastic clip to hold down the console’s lid-sensor switch, fooling the PS1 into thinking the door was always closed.
- The Switcheroo: A user would insert a legitimate, licensed PS1 game.
- The Bypass: The console would spin the real disc, successfully read the physical wobble groove, and pass the security check.
- The Swap: The second the security check passed—but right before the console began reading the actual game data—the user quickly swapped out the real disc for a burned CD-R while the motor was still spinning. The console, thinking it was still playing the authenticated disc, would run the pirated game.
The Mod
Later on, mod chips were created that automated this method.
Because the swap trick was tedious and could damage the console’s spindle motor, hackers engineered the modchip. This kickstarted the golden age of console modding.
- The Injection: A small microcontroller (like the PIC12C508) was soldered directly to the PS1’s optical drive controller board.
- The Lie: When the console booted up, the modchip intercepted the security check and electronically fed the “SCEA/E/I” frequency string directly into the console’s controller chip.
- The Result: The modchip completely blinded the console to what was actually in the disc tray. The PS1 would happily boot any burned CD-R or foreign region game instantly, without needing a manual swap.