Spent the week trying to get RetroAchievements working on a real PS1.
What if we could read PSX memory somehow? Old models have the parallel port, all of them have the serial port, there are memory card exploits, so what if we added a WiFi-enabled device somewhere in between to read memory values and send them to the RetroAchievements API?
The parallel port attempt
With that in mind I went head on trying to print a parallel port adapter. After five hours of test prints, 68 pins were hard to fit even at 0.12mm so I set that option aside.
The SIO port
Moved on to the SIO (Serial I/O) port. Easier print, 8 pins from which I only need 3. Connected the Raspberry Pi Pico 2W, wrote a Python script bridging to the RA API over WiFi. Then I patched game executables to send the memory addresses needed for their specific achievement sets. Got responses successfully for Devil Dice and Kula World, it updated the last played game and showed me achievements. Kinda works. Worth mentioning: the Pico only has 264KB of RAM so it can't fit the whole JSON response with all achievements for a game. For now I picked only the headers I needed to make it work. That part will need proper testing across games eventually.
The dead end
Made it exist first. But this is a very bad way to program something and I also ran out of blank CDs with all that testing. The issue is I had literally hardcoded an extra memory function that loads and sits in a specific memory heap for the whole runtime. If the game ever needs that address, it crashes. It worked for Kula World and Devil Dice but games like Crash Bandicoot exploit any means of memory available on the PSX. Not a real solution.
Sunday morning POST
Stepped back on Sunday morning with a coffee and a clear head.
Devices POST and check stuff. The parallel port used to load cheats via Action Replay, which added a payload to the BIOS before the game started and that's how they modded RAM. Then I remembered, if you plug a memory card in after the console boots it won't read it. So the BIOS is doing something with the memory card very early, before the game ever loads.
FreePSXBoot exploits a buffer overflow in the BIOS memory card boot handler, letting a crafted memory card inject a payload before the game runs. That payload could install a timer interrupt handler that periodically reads whatever RAM addresses RA needs and sends them over SIO to the Pico, which forwards to the RA API over WiFi. Original disc completely untouched.
Where it's paused
So I could buy a pre-flashed memory card, or get the memory port off a dead PSX, or solder wires to my RPi5. I tried taping some Dupont cables to a memory card reader but stopped because I wasn't going to risk burning my Pi and my only memory card. If I do this I'll do it properly.
Paused for now but pretty close. One thing worth saying, AI gave me a wrong SIO pinout from a plain text site it had clearly been trained on and cited it confidently. Always check multiple hardware sources before you connect anything.
Repo is private for now.
