On Wed, 15 Jan 2003, Matt Neuber wrote:
> I'm quite interested in ripping PSFs, however you do not explain a few
> things on the page. Such as, where exactly do I look for various data?

First of all, you need to know R3000 assembly.  If that's not a problem,
keep reading.  ;)  If it is, you'll probably want to wait until _Demo_
adds PSF logging/saving to ePSXe, which he is planning on doing.

The main game executable is stored in a file named after the game's
product code, i.e. "SLUS_010.13".  Open that up in IDA Pro and it should
recognize the EXE format, analyze the code and mark the library call names
for you.

Next, you locate the music playing code.  This isn't hard to do if you
follow the library calls that IDA already marked - usually named things
like "_spu_XXXX".  Generally there's an init routine, a timer callback
routine, one or more routines to upload samples and play sequence data,
and a cleanup routine (which won't be necessary).

Then you find the music data itself.  Sometimes it's painfully obvious
where this is.  LoM had a directory full of files named MUSIC###.SET.
Sometimes it's not so obvious.  FF9 had me searching for data chunks
beginning with the ASCII mark "AKAO" in the FF9.IMG file.  I had to write
a program to help with that.

Now you load the game executable into PSFLab, and patch the main() routine
(preferably the C main() routine, not the PSY-Q startup code) so that it
avoids graphics/CDROM/memory card calls, and only initializes the sound
engine.  Then you insert calls to load the sequence/sample data from a
specific address (say 0x80180000), import your music data to that address,
and try playing it.  And if it doesn't play, you debug it until it does!