Original concept: Hamu (@Imaha486)
PS1 BIOS Audio Ripper SX is an experimental tool for backing up the 512 KiB BIOS of an original PlayStation you own through the console's analogue audio output.
The PS1 program reads, compresses, splits, and error-protects the BIOS, then converts the result into FSK and OFDM audio. The browser captures that audio through the Web Audio API and performs demodulation, FEC recovery, CRC32 validation, and LZSS decompression. BIOS data is never uploaded to a server; the entire recovery process runs locally in the browser.
Use this tool only to back up the BIOS of hardware you own.
- Boot the dedicated CD-R on the PS1.
- Connect the PS1's working audio output channel(s) to a PC or Mac audio input.
- Open the HTTPS receiver, select the input device, and press Start audio input.
- The PS1 sends an FSK header followed by OFDM data.
- The browser validates every packet, block, and the final BIOS image with CRC32.
ps1-bios.bincan be saved only after every validation step succeeds.
- Source address:
0xBFC00000 - Original size: 524,288 bytes
- Independent blocks: 16 KiB
- Compression: LZSS with a 4 KiB window and an 18-byte maximum match
- A block is stored as RAW when compression does not make it smaller
- Stored-block CRC32, restored-block CRC32, and whole-BIOS CRC32 are retained
Because blocks are independent, damage to one compressed block cannot propagate its dictionary history into another block.
Transmission begins with 300-baud BFSK:
- Space: 1,200 Hz
- Mark: 2,400 Hz
- Sample rate: 44.1 kHz
- One symbol: 147 samples
- UART framing: ASCII / 8N1
- An initial three-second channel test: left only, right only, then stereo
- Alternating mark/space synchronization, negotiation text, and CRC-protected block headers
The payload itself uses OFDM:
- FFT: 512 samples
- Cyclic prefix: 64 samples
- Carriers: 96, bins 24–119
- Pilots: 8
- Modulation: QPSK
- Packet: 176 bytes, including a 144-byte payload
- FEC: 16 data shards + 4 parity shards
- Packet CRC32 and block CRC32
The wire format carries an explicit version number so compatibility with already published decoders can be retained.
SX v0.3 defaults to a mono mode that sends the same OFDM signal to L and R. This permits reception from a single working channel; when both are available, the receiver combines them using weights based on channel power.
From the synchronization symbol, the receiver estimates the complex channel response of all 96 carriers. It corrects the frequency-dependent amplitude and phase errors before making QPSK decisions. If one input is silent, its combining weight effectively becomes zero.
The theoretical net rate of mono OFDM including FEC is about 7.84 kbps. A 4 KiB wire block takes 40 packets.
- OFDM interval: about 4.72 seconds
- FSK synchronization and two header copies: about 1.03 seconds
- OFDM start guard: about 0.09 seconds
- Typical total for one 4 KiB block: about 5.85 seconds
- Effective rate including block boundaries: about 5.6 kbps (roughly 700 B/s)
The first block also includes the three-second channel test and negotiation, so it takes about 12.8 seconds. Total BIOS transfer time varies with the LZSS-compressed container size.
The original PlayStation CPU has no FPU (floating-point unit). The modem therefore avoids floating-point operations and generates OFDM using a fixed-point IFFT. The resulting PCM is converted to SPU ADPCM and played continuously with double-buffered SPU RAM and DMA. The console screen shows the mode, block number, CRC, and progress.
SPU ADPCM is not the compression format used for the BIOS data. It is only the storage format used to play the generated OFDM waveform through the PS1 SPU. A 176-byte packet is mapped to QPSK; the resulting 44.1 kHz, 16-bit PCM from the IFFT is processed in groups of 28 samples. Each ADPCM block is 16 bytes: a 2-byte header plus 28 four-bit quantized samples (14 bytes).
The current high-speed real-time encoder uses filter 0 and selects the quantization shift from each block's peak. Separate L/R ADPCM streams are DMA-transferred to SPU RAM and assigned to voice 0 for L and voice 1 for R. The SPU converts them back into the analogue PCM waveform that the browser demodulates as OFDM; the browser never reads ADPCM data directly.
In stereo mode, L and R carry separate QPSK data. In mono mode, the same PCM waveform is duplicated to L and R and encoded into separate SPU ADPCM streams. The same wire format remains decodable even when captured as a single channel.
The browser requests stereo input with echo cancellation, noise suppression, and automatic gain control disabled.
- AudioWorklet: real-time input, level/RMS/peak measurement, and FSK demodulation
- OFDM Worker: resampling, synchronization search, FFT, equalization, and QPSK demodulation
- FEC Worker: missing-shard recovery over GF(256)
- UI: L/R levels, synchronization correlation, SNR, EVM, packet CRC, and block status
Input levels update at about 29 Hz, while expensive waveform snapshots are throttled to about 9.6 Hz. The UI applies only the newest value per animation frame instead of allowing stale updates to accumulate in a queue.
The BIOS download remains disabled until all of these conditions are satisfied:
- Every required block has been received
- Every stored-block CRC32 matches
- Every block CRC32 matches after LZSS decompression
- The reconstructed size is 524,288 bytes
- The whole-image CRC32 matches the value reported by the PS1
As of 2026-08-30:
- Codec, packet, and FEC unit tests: PASS
- Synthetic PCM + SPU ADPCM loopback: 160/160 packets and final CRC match
- Mono reception with one silent channel: PASS
- Docker PSn00bSDK build: PASS
- CD-R writing and boot/read on a physical PlayStation: confirmed
- Live audio level-meter updates on localhost: confirmed
- Complete 512 KiB recovery from physical PlayStation audio into the browser: PENDING / UNVERIFIED