The original PlayStation 2 security chip has been reverse engineered

More than 25 years after the fat PlayStation 2 launched, a dev known as DiscoStarslayer has managed to pull firmware out of the stubborn SPC970 MechaCon chip responsible for authorizing discs and handling most of the console's security.

In a Bluesky post, the dev credited Libby, the collaborator who found an exploit that made the extraction possible. According to the dump tool's docs, that exploit told the chip that an incoming batch of settings data would be empty, and sent more data than it had room for. Before this, in an effort covering some four years, there had been struggles with a slower method of stripping the chip's packaging and reading its contents, which produced only rough dumps.

Everything has been pushed to GitHub alongside 22 firmware images covering fat PS2s from the Japan-only SCPH-15000 of 2000 to the 39000-series models of 2002. They also cover the Namco System 246 and 256 arcade boards that used the same chip. These early machines were some of the final unread parts of the PS2 after the 2003 "Dragon" MechaCon was dumped in 2021.

The SPC970 chip keeps its code in mask ROM, which can't be written or patched, and stores only calibration and config data in a separate 1KB EEPROM. To get around this, the "spc970-dumper-union" enthusiast group abused how the chip writes to that EEPROM.

The group found that by opening a config write session with a block count of zero, the chip's internal counter would underflow. Pushing more data than the seven-block buffer can hold overflows into RAM that holds the EEPROM write task. Overwriting that task's source address points it at the chip's ROM instead, meaning that the MechaCon copies 256 bytes of its firmware into the EEPROM. Once there, the PS2 can read it back with a standard command. Once repeated around 1,000 times, the full 256KB image sits on a USB stick.

Each of those 1,000 passes rewrites the EEPROM, but every dump shortens its life because it has no wear leveling and a smaller write budget than flash memory. To safeguard against this, the tool backs up the EEPROM before it starts, restoring it word by word after and checking the result against the chip's power-on checksum routine. There's still a risk, though, and Libby's original dumper warns that it can leave a PS2 "unable to operate normally, or require hardware-level repair. Use it entirely at your own risk."

Dragon MechaCon firmware images were released back in 2021. MechaPwn, the exploit that makes later PS2s region-free and lets them read backup discs, was released a month later. That exploit's README says that older consoles don't use a Dragon-based MechaCon and therefore aren't supported, and that no support is planned. That affects roughly 20 model numbers from the PS2's first three years between 2000 and 2003. Those machines can still run backups through memory card and hard drive exploits, but couldn't be unlocked at the chip level until now because nobody could see its code. These dumps make that search possible for the first time.

The images alone don't hold enough information to build an optical drive emulator, but they could support a modchip that replaces the MechaCon, while keeping the drive's DSP to read discs. Since PS2 games weren't encrypted, nothing new is unlocked here. But the firmware does expose the code behind Sony's "MagicGate" encryption for memory cards and KELF executables the console boots from disc and memory cards. That'll eventually feed "full-system low-level emulation," says contributor uyjulian. PCSX2 and other emulators, which can also emulate the weaker GameCube, don't run the chip's code at all: PCSX2 reimplements MechaCon's commands in C++ and reads a 1KB NVRAM file and a four-byte version number from disk to stand in for the real part. DiscoStarslayer maintains a PCSX2 fork called Reliquary, aimed at the PS2's authed paths. They acknowledge in its README that generated stand-in data isn't a substitute for hardware values when a security check inspects console identity.

As for the SPC970, the first job of its dump is to find a bug that opens up the early consoles. With MechaPwn, people could read the Dragon chip's code and find a weakness in how Sony let that chip update itself. uyjulian says a MechaPwn or TonyHax-style unlock for the SPC970 is one of the goals here, but it won't come as fast. It took researchers only a month to crack Dragon because Sony built that chip to accept patches. That gave researchers something to break. The SPC970 can't be updated at all; its code was baked into the chip in 2000 and has never changed.