Dreamcast Guides: Binaries Explained & How to Make Them

Published in

· 4 years ago

When the Dreamcast boots a GD-ROM or CD-ROM, it reads two things from the disc before the control is passed to the program. First a bootstrap is loaded from the reserved boot area (sector 0-15) of the last data track. This strap is called the "IP.BIN", although it of course does not have a file name on the disc. Among other things, the IP.BIN names a file in the ISO filesystem of the disc that contains the actual program to run and load. This file will here be called the "1ST_READ.BIN", although any name is possible as long as it is correctly specified in the IP.BIN. When the 1ST_READ.BIN has been loaded, control is passed to the IP.BIN, which will in turn pass it to the 1ST_READ.BIN. The following sections will explain the structure of these files, and how you can create your own.

The IP.BIN is loaded by the ROM to address 8C008000. It consists of several parts, as this table shows:

  
Offset       Load address         Contents 
0000-00FF    8C008000-8C0080FF    Meta information 
0100-02FF    8C008100-8C0082FF    Table of contents 
0300-36FF    8C008300-8C00B6FF    SEGA license screen code 
3700-37FF    8C00B700-8C00B7FF    Area protection symbols 
3800-5FFF    8C00B800-8C00DFFF    Bootstrap 1 
6000-7FFF    8C00E000-8C00FFFF    Bootstrap 2

With exception of the Meta information part, all these parts contain predefined data. There is a tool in the Software section called IP creator which can create the entire IP.BIN from a textual representation of the Meta information, and a template containing all the predefined data.

This part is identical in content to the IP0000.BIN. It is not necessary to compute a correct checksum for the Device Information field, just writing 0000 works OK.

I don't know what this is used for. Just filling this region with zeroes works OK, and this is what the IP creator does as well.

This is the entry point which the ROM calls after both IP.BIN and 1ST_READ.bin have been loaded. The code here displays the SEGA logo and message "PRODUCED BY OR UNDER LICENSE FROM SEGA ENTERPRISES, LTD." for about 6 seconds and then transfers control to Bootstrap 1. Note that the code in this area can not be modified. The ROM checks every byte of it against a copy in the ROM, and will not boot the disk if there is a difference.

This area contain 8 slots which can either contain the name of a regional area or spaces. For a disk to be bootable in a certain region, the slot for that region must contain the appropriate area name. It is therefore not enough just to set the area symbol characters in the Meta information area. However, if all region names are present here, as they are in the IP.BIN:s created by IP creator, any set of regions can be selected by placing the appropriate letters in the Area Symbols field of the Meta information area.
Each of the Area protection slots is prefixed by a branch instruction jumping past it, as the CPU control actually flows through here on its way to Bootstrap 1. The individual slots are these:

  
Slot    Region       Text 
0       Japan        "For JAPAN,TAIWAN,PHILIPINES." 
1       USA          "For USA and CANADA.         " 
2       Europe       "For EUROPE.                 " 
3       Unassigned   "                            " 
4       Unassigned   "                            " 
5       Unassigned   "                            " 
6       Unassigned   "                            " 
7       Unassigned   "                            "

This code is run once the licence screen code completes. Contrary to the license screen code, this code can be modified. The default implementation sets up a few hardware registers and then transfers control to Bootstrap 2.

This code is run once Bootstrap 1 completes. Like Bootstrap 1, it can be modified. The default implementation sets up the CPU stack, the VBR, disables the cache, and transfers control to the 1ST_READ.BIN.

The 1ST_READ.BIN (or whatever you call it in the Boot filename field of the Meta information area) is loaded to address 8C010000, i.e. right after the IP.BIN. The boostrap will branch directly to this address, so it should be a raw binary file without any headers. (If you have an ELF with a VMA of 0x8c010000, you can convert it with objcopy -O binary for example.)
An interresting feature of the bootloader is that for normal CD:s (not GD:s) this file is not loaded continously into memory, but instead scatter-loaded in a pseudo-random manner. In order for your program to be loaded properly, the binary thus first has to be "scrambled". The Software section contains a tool to perform this task as well. Here is a complete example on how a scrambled 1ST_READ.BIN could be generated from a C source file, using cross-compiling GCC and binutils:

  
 sh-elf-gcc -ml -Wl,-Ttext,0x8c010000 -nostartfiles -nostdlib -e _start prog.c -o prog.elf -lgcc 
 sh-elf-objcopy -O binary prog.elf prog.bin 
 scramble prog.bin 1ST_READ.BIN

(This example assumes that prog.c begins with a function start that will be called first.)

Dreamcast Programming by Marcus Comstedt
Last modified: Thu Nov 16 02:48:47 MET 2000