Original Sony PlayStation 2 security chip 'broken wide open' after 26 years

1. Video Games
2. Console Gaming
3. PlayStation

Original Sony PlayStation 2 security chip ‘broken wide open’ after 26 years — chemical decapping and four years of reverse engineering unlocks MechaCon secrets

Breakthrough will improve hardware preservation, repair, and emulation projects.

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

• Facebook
• X
• Whatsapp
• Reddit
• Pinterest
• Flipboard
• Email

The ‘magic security chip’ inside the original PlayStation 2 has been successfully reverse-engineered and dumped. Canadian retro hardware and software enthusiast DiscoStarslayer was the manic mind behind the cracking open of the CXP102064 MechaCon chip, which arrived inside the ‘PS2 Fat’ from 1999. It took “four years of effort” to reach this stage, but this milestone should be a boon to hardware preservation, repair, and emulation projects.

The Mechacon got its name from its primary duty of controlling the PS2’s optical and flash drive mechanics. It also played a significant part in Sony’s game optical disc security, supporting “Magic Gate [memory card] and KELF file [executable] decryption among other things,” notes the PSDev Wiki. Unlocking the secret workings of such chips can be important to those involved in video game preservation. So, many people will appreciate DiscoStarslayer’s work in reverse engineering and dumping one of the PS2’s last remaining secrets.

As per the social media post, the arduous task of breaking the MechaCon’s security took four years. Some of the reverse engineering tricks utilized by DiscoStarslayer include chemically decapping the CXP102064 to expose the die, then using microscopes and optical dumping skills to analyze the silicon chip circuitry. In this case, a lucky break during the hacking apparently uncovered an exploit that provided a method whereby the chip’s data could be extracted through software.

With this achievement unlocked, the game/hardware preservation and programming communities can look forward to improved emulation and homebrew developments. It should also open up possibilities for replacing the aging optical drives in PS2 consoles.

Beyond the confines of PS2 Fat consoles, some social media commenters noted that the MechaCon was also used in a handful of arcade machines from the era. Specifically, the Namco System 246 and System 256, as well as the Konami Python 1, which used modified PS2 hardware, used the MechaCon firmware to authenticate security and allow the execution of encrypted game data.

• Just one instruction on AMD's 2015-era CPUs cracks open secret memory areas and gives full hardware-level control
• RPCS3 emulator can now run games on PC directly from a disc drive in landmark development
• PS5 emulation ramps up in response to Sony killing physical games

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.

Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.

Mark Tyson is a news editor at Tom's Hardware. He enjoys covering the full breadth of PC tech; from business and semiconductor design to products approaching the edge of reason.

• JeffreyP55

  Admin said:The ‘magic security chip’ inside the original PlayStation 2 has been successfully reverse engineered and dumped after four years of effort.
  
  Original Sony PlayStation 2 security chip ‘broken wide open’ after 26 years — chemical decapping and four years of reverse engineering unlocks Mech... : Read more

  Too much time on my hands. Reply
• uyjulian Hello! I'm one of the people involved in reverse engineering the MechaCon. Please take note of the following:
  * It is already possible to run backup/copied discs entirely using software methods (from memory card, HDD, or DVD video player exploit), and in the case of the 50k series and newer (Dragon MechaCon), can use the "force unlock" patch that does not require any patches to copied discs.
  * The dumps, alone, does not give enough information to create an """hardware""" ODE (optical drive emulator). However, it is possible to make a modchip that replaces the MechaCon, relying on the DSP to continue to read discs.
  * The current method to dump the ROM used in the SPC970 requires lots of writing to NVRAM.
  * These dumps will eventually be useful for full-system low level emulation, as MagicGate and KELF/KIRX security goes through it.
  * These dumps are useful for vulnability searching, which can allow functionality to MechaPwn (code execution on MechaCon, unlocking security) or TonyHax (unlocking PS1 mode to read any disc, on SPC970 based MechaCons and all PS1 MechaCons).
  * The contents of game discs (except those that use DNAS online authentication) are not encrypted. These dumps don't unlock anything additional there. Reply
• Darkhands Fantastic work from you guys! Thanks for all that effort. Reply
• DS426 Great work and glad all that time and effort has finally come to fruition. Reply