Derrow or anyone else how to edit out RCE

[Plunkett]

Hi guys

Have ripped a Region code enhanced disc and set non region disc. Under the Ifoedit method (thanks to Derrow) i put it back together but it comes up with the RCE title first and wont allow play despite being all region enabled is there a place in the ifo i need to edit? Would you need the ifo to find out??? Let me know because i need to get this sorted

thanks
:D

[mpucoder]

These are tricky, and if you really want to make the disk region free, you'll need to study the virtual machine code. What is happening is in some PGC, probably the First_Play (FP_PGC) a check is made on the player's region code by reading SPRM 20, and a branch is made accordingly.
IFOEdit can help, but you'll need to make the changes by hand, in HexEdit.

I don't know if Derrow has the time right now (he IS working on something major), but I sure would like to see this. If you could, zip up ALL the ifo's and either post them or email them to me.

[Plunkett]

MPUcoder if you give me your email addy i'll send the files

Cheers mate

[Derrow]

Sound's like an interesting problem!

I would like to have a closer look at it.
So please pack the IFO file(s) together and post them in this thread or send them via email,

and we will figure this out. :-)

[mpucoder]

Plunkett - please read your private messages!

[Derrow]

Here's what I and MpuCoder figured out:


---- Part of VIDEO_TS.IFO - first play PGC: ---------
1.Pre Command: JumpSS VMGM pgcn 1
-------------------------------------------------------

---- Part of VIDEO_TS.IFO - VMGM_PGCI_UT - LU_1: ----
1.Pre Command: Set GPreg<9> mov SPreg<player region code>
2.Pre Command: Set GPreg<9> and sval#<15>
3.Pre Command: If GPreg<9> != #cval<1> then Goto line# 7
...
-------------------------------------------------------

If you take a look to the commands of the first play
PGC, then you will see a Jump-command to the Menu-PGC
1 in VIDEO_TS.IFO.
Now expand in the tree-view the table: 'VMGM_PGCI_UT'.
Go into the PGC-Menu-1 and scroll down to the
commands.

The first command reads the player-region code, and in
the 3td line, it's compared with something (MpuCoder assumed it
is compare with value 1, so it's a Region 1 Disc), and if it
does not match, then it jump's to line (command) 7.

So this third line is the key! Now just put a 'NOP' in
there, and your region-problem is gone!
To put a nop in there, simple double click the line,
and in the Hex-Edit View put a zero over every value.

Enjoy your new Region-Free Disc. :-)

[Mikele]

I'm trying this method with Almost Famous R1. The last Pre Command of First Play PGC jumps to VMGM pgcn 2. Then I go to VMGM_PGCI_UT - LU_1 - PGC_Menu_2. There are 5 Pre Commands there:

Set GPreg<0> mov SPreg<player region code>
Set GPreg<0> and sval#<255>
Set GPreg<1> mov sval#<1>
If GPreg<0> == GPreg<1> then JumpSS VMGM pgcn 4
JumpSS VMGM pgcn 3

So I guess that what we want is to avoid line 4 and go directly to pgcn 3. So I put a NOP in line 4. But PowerDVD (set to region 4) still refuses to play it.

Maybe I'm doing something wrong?

[gvers]

I say that it should read

NOP
NOP
NOP
NOP
JumpSS VMGM pgcn 4

instead of

Set GPreg<0> mov SPreg<player region code>
Set GPreg<0> and sval#<255>
Set GPreg<1> mov sval#<1>
If GPreg<0> == GPreg<1> then JumpSS VMGM pgcn 4
JumpSS VMGM pgcn 3

[daveidmx]

backwards, mikele.

Set GPreg<0> mov SPreg<player region code>
Set GPreg<0> and sval#<255>
Set GPreg<1> mov sval#<1>
If GPreg<0> == GPreg<1> then JumpSS VMGM pgcn 4
JumpSS VMGM pgcn 3


it looks like line 4 tests the low 8 bits of the player's region code against the constant value "1".

aka "if this is a region 1 player then JumpSS VMGM pgcn 4"
"else JumpSS VMGM pgcn 3"

so writing line 4 to NOP will _guarantee_ that the disc will never play.

try this. (i make no guarantees, i just looked some hex values and tried to hand-write some new code)

change line 1 to 0x71 00 00 00 00 01 00 00
to make it "Set GPreg<0> mov sval#<1>"

[daveidmx]

yeah, "NOP/NOP/NOP/NOP/JumpSS VMGM pgcn 4" should work too, but that entails chaning five lines instead of just one...

of course you _could_ just change line 1 to "JumpSS VMGM pgcn 4"

[gvers]

Set GPreg<0> mov SPreg<player region code>
Set GPreg<0> and sval#<255>
Set GPreg<1> mov sval#<1>
If GPreg<0> == GPreg<1> then JumpSS VMGM pgcn 4
JumpSS VMGM pgcn 4

This is only a one line change

[Derrow]

Buddy's, please give me more such examples,
where the region code is checked via commands.

I'm planning to enhance my button 'Region Free' with a
new function to remove such commands automatically!
Cause they seem to be in every PGC and in every IFO file,
in it would be really anoying to remove them all by hand.

[mpucoder]

Here's some basic rules:
1) don't move anything, there may be jumps in other parts of the disk to the part you're modifying.
2) don't change the loading of registers, other parts may depend on the values
3) Once you find a jump based on the region code either NOP it if jumps because the region is wrong, or remove the condition if it jumps for a correct region

The conditional part of jump/link/call commands is bits 6-4 of the second byte. If you zero them the JLC becomes unconditional

[Taric25]

But still, these are sill RCE, yes? How do you make these without specificity to any region?

[mpucoder]

There are 2 things you need to do to make a region-free DVD. First is to clear the "prohibited regions" mask in video_ts.ifo, this can be done with IFOEdit. The second is to hunt down any RCE code as outlined above. RCE is simply using the interactive instruction set of DVD players to either show you the movie, or show you a nasty message. Once reprogrammed, the disk shows the movie regardless of region code.
We are talking about burning new DVD-R/RW in this thread, not somehow magically making a stamped DVD act differently.
BTW, a side-effect of RCE, as in the 2 cases posted here, is that a region free player will NOT play the movie.

[Mikele]

I changed line 5 as gvers suggested, and it worked just fine.

[gobills]

The trick seems to be to change all occurances of "Set GPreg<0> mov SPreg<player region code>" with "Set GPreg<0> mov sval#<1>". You can do this by replacing 0x6100000000940000 with 0x7100000000010000. This assumes they always use reg 0. The register is the fourth byte so just leave that the same as it was. I also 'clear the "prohibited regions" mask in video_ts.ifo' as was suggested by mpucoder but didn't verify if this was necessary.

I successfully de-RCE'd South Park Bigger, Longer and Uncut by modifying VIDEO_TS.IFO and VTS_02_01.IFO. It now plays with PowerDVD 4.0 =)

I like this change as it performs exactly the operation that it would have if your player was region 1 (loading GPreg 0 with 1).

Good luck,
gobills

[Derrow]

Originally posted by gobills
The trick seems to be to change all occurances of "Set GPreg<0> mov SPreg<player region code>" with "Set GPreg<0> mov sval#<1>". You can do this by

You can do this by using IfoEdit 0.75 :)
I enhanced it with that option, so it will do this in every IFO file in every PGC!

http://mpucoder.kewlhair.com/Derrow/index.html

Derrow