As you may know, to fetch data from a CD, a laser beam is used to detect the pits and lands embedded in the disc's track.
Now, conventional discs are not perfectly flat and often contain tiny fluctuations in their tracks. These defects are completely unnoticeable during reading, as the laser can automatically calibrate itself as it reads.
This is what Sony based their copy protection on: the Sub-CPU only reads discs whose particular track - the Table of Contents (TOC) - is engraved using a defined frequency, informally known as Wobble Groove. This frequency is introduced during the mastering process and cannot be replicated by conventional CD burners. The TOC resides in the inner section of the CD (called 'Lead-In' area) and instructs the laser on how to navigate throughout the disc . Moreover, it is repeated multiple times as a fault-tolerance mechanism.
Within the game's table of contents, one of the following character strings is embedded:
- SCEA, meaning 'Sony Computer Entertainment of America'.
- SCEE, meaning 'Sony Computer Entertainment of Europe'.
- SCEI, meaning 'Sony Computer Entertainment of Japan'.
As you can guess, this technique was applied for region-locking as well.
Defeat
Conversely, this check is only executed once at the start, meaning that manually swapping the disc immediately after verification can bypass this protection - albeit with the risk of damaging the drive.
Later on, some games took matters into their own hands and often reinitialised the drive during gameplay, forcing the check to be performed again. This was done to prevent users from performing the 'swap trick'.
Alternatively, tiny commercial boards programmed to mock the Wobble Groove signal could be soldered into the console. Known as Modchips, these components - while legally contentious - became incredibly popular.
Retaliation
The widespread availability of modchips, CD burners, and emulators were viewed as a significant threat by publishers. In response, later games included their own protection measures (mostly checksums) to deter any type of unauthorised use or modification.
One such method I was told about involved deliberately reinitialising the CD drive and then making it read specific sectors that would fail the Wobble Groove check. If this managed to unlock the drive regardless, the game (still residing in RAM) would happily unveil its anti-piracy material. Notably, this approach could also affect modified consoles using genuine discs.
Later on, Sony provided a library called Libcrypt, which fortified copy protection with the use of two approaches :
- From the hardware side, checksums of specific sectors were stored in sub-channels of the disc.
- CD-ROM sub-channels traditionally store metadata, mostly to guide the drive. These are not user-accessible and conventional readers rarely allow to manually write over them.
- From the software side, a set of routines were embedded at different points of the game. These fetch the checksum values and mix them with others to perform verifications, in an attempt to counteract both emulators and pirated discs.