22:22Machine-translated from Azerbaijani by AIRead in Azerbaijani
PlayStation 2 Security Chip Code Extracted After 25 Years
The program code of the “SPC970 MechaCon” chip, which verifies discs and manages security functions in the original “PlayStation 2” console, has been extracted. A developer named DiscoStarslayer achieved this more than 25 years after the fat version of the console went on sale. The SPC970 was considered the last major component in early models whose code had not yet been read. The data obtained will help researchers better understand how the chip works and investigate its vulnerabilities.
A contributor named Libby found the vulnerability used to extract the code. The chip was told that the parameter packet was empty, after which more data was sent than the capacity of the allocated memory. This modified an instruction in the internal memory, and the code was copied from the protected ROM. Earlier, about 4 years had been spent physically stripping away the chip’s casing to read the data. However, those attempts failed to extract the complete code. The SPC970 stores its code in ROM that cannot be modified afterward. The chip also has 1 KB of electrically rewritable EEPROM memory for debugging and settings. When the exploit is triggered, a 256-byte portion of the program code is copied to this memory. After the process is repeated approximately 1000 times, a complete 256 KB copy is written to a USB drive. Because the EEPROM is rewritten each time, this process may shorten the chip’s lifespan. Before starting, the tool backs up that 1 KB of data. When the process is complete, the data is written back, and the result is verified using the chip’s startup check. Nevertheless, there remains a risk that the console will stop working and require physical repair. Therefore, the method is not completely safe for owners of early “PlayStation 2” consoles. 22 firmware images have been published on “GitHub.” The archive includes code from fat consoles, starting with the “SCPH-15000” model sold only in Japan in 2000. The list extends through the “39000” series from 2002. Code from the “Namco System 246” and “Namco System 256” arcade boards is also included in the archive. The “Dragon MechaCon” software was extracted in 2021. “MechaPwn,” released one month later, did not work on early consoles with the SPC970. The new code extractions could pave the way for a chip-level unlocking method for approximately 20 early models released between 2000-2003. The files alone are not sufficient to create a system that emulates the optical disc drive. However, they could provide the basis for developing a modchip to replace the “SPC970 MechaCon” chip. The code could also help researchers study “MagicGate” encryption and emulate the entire system at a lower level. Because the games are not encrypted, this work does not currently provide access to new content. Since the SPC970 cannot be updated, finding a new vulnerability in the chip will also be more difficult.
A contributor named Libby found the vulnerability used to extract the code. The chip was told that the parameter packet was empty, after which more data was sent than the capacity of the allocated memory. This modified an instruction in the internal memory, and the code was copied from the protected ROM. Earlier, about 4 years had been spent physically stripping away the chip’s casing to read the data. However, those attempts failed to extract the complete code. The SPC970 stores its code in ROM that cannot be modified afterward. The chip also has 1 KB of electrically rewritable EEPROM memory for debugging and settings. When the exploit is triggered, a 256-byte portion of the program code is copied to this memory. After the process is repeated approximately 1000 times, a complete 256 KB copy is written to a USB drive. Because the EEPROM is rewritten each time, this process may shorten the chip’s lifespan. Before starting, the tool backs up that 1 KB of data. When the process is complete, the data is written back, and the result is verified using the chip’s startup check. Nevertheless, there remains a risk that the console will stop working and require physical repair. Therefore, the method is not completely safe for owners of early “PlayStation 2” consoles. 22 firmware images have been published on “GitHub.” The archive includes code from fat consoles, starting with the “SCPH-15000” model sold only in Japan in 2000. The list extends through the “39000” series from 2002. Code from the “Namco System 246” and “Namco System 256” arcade boards is also included in the archive. The “Dragon MechaCon” software was extracted in 2021. “MechaPwn,” released one month later, did not work on early consoles with the SPC970. The new code extractions could pave the way for a chip-level unlocking method for approximately 20 early models released between 2000-2003. The files alone are not sufficient to create a system that emulates the optical disc drive. However, they could provide the basis for developing a modchip to replace the “SPC970 MechaCon” chip. The code could also help researchers study “MagicGate” encryption and emulate the entire system at a lower level. Because the games are not encrypted, this work does not currently provide access to new content. Since the SPC970 cannot be updated, finding a new vulnerability in the chip will also be more difficult.