The Project to Reverse-Engineer a "Magic 3"

presented by

AYANAMI <==> Reverse Engineering

The Magic Friend

Disclaimer: The information contained herein is provided as-is. No warranties of any kind are expressed or implied; use of this information is solely the responsibility of the persons accessing these pages. The author does not condone software piracy and will not assume responsibility for illegal or other misuse of the materials contained herein.

10-DECEMBER-03 I was waiting for this update for a longtime, Ok here are the News "ICE TEAM" DID IT AGAIN After a long wait they have come with a solution for V9 and V10 it seems is now working on Pal and Ntsc(reported by kajetsu), but there still testing in so be careful.

Here is the New Code SxV9kit with all the Schematics and Diagrams

	Here are some Pics taken from Ps2newz.net Forums
Vdavide's final PCB for Dip Chips
Murcielago's Smd PCB

Also There was another Release of a New code Made By Vdavide for V1- V8 and it only uses 17 wires ndv

12-JUNE-03 To RCE i know how you feel about someone ripping your code that's sad but let me tell you, we all know who you are and all the great job you have done those are a bunch of losers, Im' not goin to tell you to come back after what happend, i'm just going to thank you in the name of the comunity and i hope to see you soon if you feel like it, Cheers RCE!

11-JUNE-03 Well i have great news seems that this time Vdavide has made it good this time i have receive his latest code and it seems to be working great! for those who want to test it here there is newdvmagic3v14f1 there to versions one that Doesn't use W and the other one that use it. Great job Vdavide!

For those who are interested you can check PS2NEWZ FORUM and check for all the post there about this code http://www.ps2newz.net/forums/showthread.php?s=&threadid=8532

THE CONECTION ARE THE SAME AS THE OLD ICE CODES

10-JUNE-03 Hi every one, Murcielago want's to share his gerber files with all the comunity so here they are pcbice. This diagrams work for the ice codes 0.90+ and the magic 3.1

9-JUNE-03 Some poeple where asking for old ICE code Versions here they are some of them from Ice0.75 to 0.91f2zip

2-JUNE-03 Hi i have been busy so i didn't have time to update the page there have been a lot of improvements on the Magic ICE code it seems to be getting really stable and at this point i can say is one of the best codes compared with Mesiah2 and the DMS chip. Once againg Cheers to RCE's project and all of you that have make this posible.

COMERCIAL MAGIC 3.1 RELEASE RealM31.zip for those who where asking ! but i still recomend to use Magic ICE

Well This are the latest Changes done to the Ice Code:

Magic ICE code...

Here Magic ICE base on magic 3(disassembling)

-- 0.8x --
thx to lacyg
- - - - fix psx sleep
- - - - fix v8(aka new v7) ps2
kill logo bug in v3 fixed.
boot game from browser fixed(for v5/6/7/8)
code for v1 added...
hacked code for jap-10k(temp.... untested... 1min hack...)
vdavide cd/dvd sync code added
eject code fixed psx/ps2(for dvd browser boot...)
thx to warpjavier for testing ;-)
very stable thx to lacygX ;-)
thx to warpjavier for fixing small in new code...
EJECT_SLEEP removed
-- 0.85
DVD movie Mode
no delay for media detection...
PSX1 MODE fixed (ALL PAL tested)
NO_BUS added(u need to copy files in nobus over other files if used...)
mips rewrite...
Vdavide new DVD routine( + some modifications)
V7 SPECIAL mode(for protected games)
TAB now = 8 spaces
Can make one hex for V1-V8
-- 0.88
DELAY320nS removed thx to vdavide
DELAY_BIG removed good old LacygX..
aka ps2 mode = no delays...
-- 0.90
W is now Messiah W nice work m8
REST & W are not swaped now
protected Mode removed(not need any more but need's testing)
-- 0.91
BIG LBA >300000 boot solved(PS2)
PS2LOGO FIX

26-05-2003 0.91 - LacygX
* solved BIG LBA > 300000 boot(PS2)
* fixed PS2LOGO
29-05-2003 0.91F - LacygX
* FINAL DVD ROUTINE (VDAVIDE THX) 100/100
* Fixed XCDVDMAN
29-05-2003 x.xx - RCE
* made ChangeLog.txt(format base on one from ps2lib)
note not all is listed!
* made readme.txt thx to guichi for parts

03-06-2003 0.91F2 - LacygX
* BACK to OLD DVD ROUT => ORIGINALS PROB(thx to vdavide for pointing out)
* LSD / SHUT_DOWN logical error fix



ICE 0.90+: MAGIC 3 TO ICE... swap pin Z with A... use Messiah W point for W

Define.inc is set for all version V1-V8, No Logo, and Power down / edit define.inc if need...

Attachment: Ice0.91f2.zip

(Notice that W is always 2 pins after R point)

10-FEB-03 Well i receive a letter telling me if i'm going to give thanks that i have to name everyone who made this

posible so here is it:

06-FEB-03--Well Great News for those who are waiting for a working code for the NTSC systems after a lack of time and hard working of a few people in the forums in PS2newz.net they have came with good results we have to give thanks to RCE , For developing an Open code and for all the knowledge that have been share, also we have to thanks Lacyg , Guichi, Warpjavier and all others that have been helping to make this come true! many, many thanks to Gbox for giving me the idea of making this web! also i have to thanks Chuby for doing nothing :P !!!

HERE IS A COPY TAKEN FROM PS2NEWZ FORUM

Magic ICE code...

Here Magic ICE base on magic 3(disassembling)

-- 0.70 --
1st ver posted
...
-- 0.76x thx to Guichi --
added info v7
removed BIOSXX_LOGO & BIOS2050_KILL_LOGO but added notes for them...
fixed some errors
unhard coded fuse...
...
-- 0.777 --
removed some macros
readded KILL_LOGO(for 50/XX only) 1/2 tested :-)
added GH015(V6) bios pins thx to razorx
...
-- 0.78x --
moved r5900 code to *.mip(note may move back...)
added POWER_DOWN untested...
added SWAP_PINS
added KILL_LOGO(v3 aka all)...
rename by ver(files....) thx to lacyg
added SCEX_ONLY(1/2 tested)
added osdsys_10k.mip
--- breaks 1 to 1
thx to lacyg
- - - - removed delays code
- - - - xcdcd(duplicate) code
- - - - fixed POWER_DOWN(untested)
- - - - fixed EJECT_SLEEP
- - - - fixed FULL_SLEEP
- - - - fixed swap pins :-)
- - - - ...
added osdsys_v1.mip(REMOVE i will readd(100% this time) when i know code is all working ones more :-) )
fixing dvd freezing thx to vdavide
no more SWAP_PINS(pins are swap all the time now)
..
-- 0.79 --
thx to lacyg
- - - - Add 54Mhz Code
-- 0.8x --
thx to lacyg
- - - - fix psx sleep
- - - - fix v8(aka new v7) ps2
kill logo bug in v3 fixed.
boot game from browser fixed(for v5/6/7/8)
code for v1 added...
hacked code for jap-10k(temp.... untested... 1min hack...)
vdavide cd/dvd sync code added
eject code fixed psx/ps2(for dvd browser boot...)
thx to warpjavier for testing ;-)
very stable thx to lacygX ;-)
thx to warpjavier for fixing small but in new code...
..
.


NOTE: MAGIC 3 TO ICE... pin Z swap with A and RESET with W.... and you must edit define.inc...

Attachment: ice0.84f.zip

Now here is what you need todo:

Step 1. Unzip Ice0.84f.zip
Step 2. Unzip Tools v2.zip in the same directory
Step 3. Unzip Makefile.zip in the same directory
Step 4. Edit Define.inc Depending the Version of your PS2
Step 5. Go to command prompt and go the directory
Step 6. Run 'make'
Step 7. Have fun

Editing Define:

I don't know much about it so don't mess with it

By Default V4 is uncomment Just uncomment your Ps2 Model

and comment V4 and try it;

if doesn't work fine try uncoment Kill_logo also leave the rest comment

Here are Some Pics for the PIN OUT Magic ICE Use the Magic 3 Installation Diagrams

USEFULL FILES:

PCB gerber files DIP CHIP m3v54 thx to Lacyg

PCB gerber files for MAGIC 3

Programming Software For Fluffy ICprog105A

Here is the MODBLAK 1.0 code Developed By Blakcat we don't know much about it because is just the hex it seems to be working fine with Pal and NTSC but there's not much support with it.

modblak10

modblak10_sx_Old&New

25-NOV-02 HI ALL! Well i have been out doing some things now i'm back and i got a some of info to give to you.Well every body was waiting for our Friend well he is here it was posted on Ps2Newz on Nov 21 by Robot thanks! 

i got some pictures too, I know these are old News but it will be here just in case :) 

MAGIC3 CODE 

MAGIC3 PINOUT

12-NOV-02--Hey a lot of movement in the scene Messiah 1 code was release with all it CAM files By Rex  ,Magic 2 code also was release By SniperKilla, you can check all this at our Friends Forum Ps2newz.net 

Lacyg sent me the patch info that magic2 and messiah uses it may help for the Development of New codes thanks!   BIOSPATCH

Gradius sent me the conection pin out of the Magic 3 and it uses  2  15pf condensor  

Conection Diagrams for Magic 3 

Magic3 pin (and SX-28 pin)

01 - *  (Vss aka GND)
02 - *  (RTCC)
03 - +5V also connected with pin 15 (Vdd)
04 - * (Vdd)
05 - R (RA0)
06 - Z (RA1)
07 - S (RA2)
08 - Reset (RA3)
09 - D (RB0)
10 - C (RB1)
11 - B (RB2)
12 - A (RB3)
13 - W (RB4)
14 - GND (Vss aka GND)
15 - G (RB5)
16 - H (RB6)
17 - I (RB7)
18 - V (RC0)
19 - U (RC1)
20 - T (RC2)
21 - Q (RC3)
22 - P (RC4)
23 - O (RC5)
24 - N (RC6)
25 - M (RC7)
26 - * Resonator (OSC2)
27 - * Resonator (OSC1)
28 - +5V also connected with pin 3 (MCLR)

06-NOV-02 --Hi all, today I decide to continued the job of REI; So for Now and on you can come and visit this web and as the Old Crow used to do i'm going to Keep you inform about the programming and developing of the Ps2 Modchip ,You can help to make this web better by sending all important info to the web ,i will post and share with every one all the information you give me, so let's put our hands to work!!!!

Ok this is what i got so far:

 The Magic 3 uses a Scenix SX28AC wich is the same as the Origa Chip and it uses a High Speed 50 mhz resonator, based on that information we are going to develop our Magic Friend !

Very Soon you will see Magic! 

Programmer links:

S.E.M.I.S
BPMICRO
ELENEC

Parts:

DIGIKEY

Scenix SX28AC

Resonators

Other Links:

http://www.brouhaha.com/~eric/ubicom/

http://www.ubasics.com/adam/pic/piclinks.shtml

http://www.cl.cam.ac.uk/users/rja14/tamper.html

http://people.man.ac.uk/~mbhstdj/files/

http://www.cl.cam.ac.uk/Research/Security/tamper/

http://www.cl.cam.ac.uk/%7Esps32/mcu_lock.html

http://www.sxlist.com/techref/ubicom/index.htm

ftp://ftp.mite.cz/sx/

http://www.geocities.com/SiliconValley/Station/7733/

http://www.microchipc.com/

PIC Links courtesy of Dontronics.