Thread

Original Sony PlayStation 2 security chip 'broken wide open' after 26 years

285 points · 91 comments · rbanffy

uyjulian · 1789570941 · focus · HN ↗
Hello! I'm one of the people involved in reverse engineering the MechaCon. Please take note of the following:
* It is already possible to run backup/copied discs entirely using software methods (from memory card, HDD, or DVD video player exploit), and in the case of the 50k series and newer (Dragon MechaCon), can use the "force unlock" patch that does not require any patches to copied discs.
* The dumps, alone, does not give enough information to create an """hardware""" ODE (optical drive emulator). However, it is possible to make a modchip that replaces the MechaCon, relying on the DSP to continue to read discs.
* The current method to dump the ROM used in the SPC970 requires lots of writing to NVRAM.
* These dumps will eventually be useful for full-system low level emulation, as MagicGate and KELF/KIRX security goes through it.
* These dumps are useful for vulnability searching, which can allow functionality to MechaPwn (code execution on MechaCon, unlocking security e.g. set disc type and max LBN) or TonyHax (unlocking PS1 mode to read any disc, on SPC970 based MechaCons and all PS1 MechaCons).
* The contents of game discs (except those that use DNAS online authentication) are not encrypted. These dumps don't unlock anything additional there.
See <a href="https://gist.github.com/uyjulian/aaf4f4e2e74d980f620a9b73ba04b309" rel="nofollow">https://gist.github.com/uyjulian/aaf4f4e2e74d980f620a9b73ba0... for updated info.
1. znpy · 1789587139 · focus · HN ↗
  Would this allow, at learning in theory, to build and run a modern Linux distro to run on the ps2 ?
  1. uyjulian · 1789596894 · focus · HN ↗
    There already exists a modern Linux kernel port supporting Gentoo to the PS2. <a href="https://github.com/frno7/linux" rel="nofollow">https://github.com/frno7/linux The SPC970 MechaCon dumps don't add anything additional, as previous memory card/hard disk drive/disc based exploits will work with the above port.
    In addition, PS2 Linux based on Linux 2.2 and PSBBN based on Linux 2.2.19/heavily patched MontaVista/Hard Hat Linux 2.4.17 exist. Additionally unofficial ports for Linux 2.6 and 3.8 also exist: <a href="https://gitlab.com/ps2max/linux" rel="nofollow">https://gitlab.com/ps2max/linux
    znpy · 1789815834 · focus · HN ↗
    Nice!

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.