PlayStation 1: LibCrypt protection (Old)

From Redump Wiki

The PlayStation 1: LibCrypt protection guide is intended to allow you to determine if a game has LibCrypt and how to properly rip it.

Common Information

Sony first introduced LibCrypt protection in PAL version of MediEvil in October 1998. Since then more than hundred games containing LibCrypt have been released. What's special about this protection is that it uses subchannels to store some non-Yellow Book data, thus breaking the standard.

Every CD sector contains 2352 bytes of main channel data and 96 (+ 2 sync) bytes of subchannels data. While main channel stores user data, sync and error-correction codes, subchannels data was not intended to contain user data. 96 bytes of subchannels are divided to 8 12-byte channels: P, Q, R, S, T, U, V, W. In case of non-protected CD channel P contains pause info, channel Q contains current track flags and current sector address; other subchannels are zeroed. As all this data can be included in CUE, it's one of the reasons PSXDB images contain only main channel data. The other reason is that it's nearly impossible to make perfect copy of subchannels data, because they don't have error-correction codes, not being encoded with CIRC. So, both dumping subchannels and calculating their checksums makes no sense.

Discs with LibCrypt protection have 16 or 32 sectors with slightly modified Q-channel, comparing to the same sectors in standard Yellow Book disc. The first half of the sectors is located on 3rd minute, and the second half on 9th minute. All modified sectors can be divided into pairs, the distance between sectors in each pair is 5 sectors. At the moment we have found 3 different protected sectors generation schemas.

Protected sectors generation schemas

• 2 bits from both MSFs are modified, CRC-16 is recalculated and XORed with 0x0080.
  • Games: MediEvil (E).
• 2 bits from both MSFs are modified, original CRC-16 is XORed with 0x8001.
  • Games: CTR: Crash Team Racing (E) (No EDC), CTR: Crash Team Racing (E) (EDC), Dino Crisis (E), Eagle One: Harrier Attack (E) et al.
• Either 2 bits or none from both MSFs are modified, CRC-16 is recalculated and XORed with 0x0080.
  • Games: Ape Escape (S) et al.