Hacker news

  • Top
  • New
  • Past
  • Ask
  • Show
  • Jobs

Original Sony PlayStation 2 security chip 'broken wide open' after 26 years (https://www.tomshardware.com)

285 points by rbanffy 4 days ago | 90 comments | View on ycombinator

uyjulian 4 days ago |

Hello! I'm one of the people involved in reverse engineering the MechaCon. Please take note of the following:

* It is already possible to run backup/copied discs entirely using software methods (from memory card, HDD, or DVD video player exploit), and in the case of the 50k series and newer (Dragon MechaCon), can use the "force unlock" patch that does not require any patches to copied discs.

* The dumps, alone, does not give enough information to create an """hardware""" ODE (optical drive emulator). However, it is possible to make a modchip that replaces the MechaCon, relying on the DSP to continue to read discs.

* The current method to dump the ROM used in the SPC970 requires lots of writing to NVRAM.

* These dumps will eventually be useful for full-system low level emulation, as MagicGate and KELF/KIRX security goes through it.

* These dumps are useful for vulnability searching, which can allow functionality to MechaPwn (code execution on MechaCon, unlocking security e.g. set disc type and max LBN) or TonyHax (unlocking PS1 mode to read any disc, on SPC970 based MechaCons and all PS1 MechaCons).

* The contents of game discs (except those that use DNAS online authentication) are not encrypted. These dumps don't unlock anything additional there.

See https://gist.github.com/uyjulian/aaf4f4e2e74d980f620a9b73ba0... for updated info.

ethagnawl 4 days ago |

> Some of the reverse engineering tricks utilized by DiscoStarslayer include chemically decapping the CXP102064 to expose the die, then using microscopes and optical dumping skills to analyze the silicon chip circuitry. In this case, a lucky break during the hacking apparently uncovered an exploit that provided a method whereby the chip’s data could be extracted through software.

This is next level commitment to the cause.

Also, I can totally imagine their reaction when they discovered the exploit and realized they could put down the ... chemicals. XD

dzdt 4 days ago |

This article seems to be completely based on the X post by the reverse engineer DiscoStarSlayer : https://x.com/DiscoStarslayer/status/2099132300390744320.

That post reads "After 4 years of effort, I'm happy to announce that one of the final secrets of the PS2 has been broken wide open!

It's been a long process of decapping, optical dumping, and now at last a software solution.

Thank you Libby for finding the exploit from our dirty optical dumps!"

Yesterday DiscoStarSlayer also promised details are coming: "Will share full write-up on how we got here soon!"

criddell 4 days ago |

This will be great for preservation of PS2 games. Well done!

It seems like preservation of games for later consoles is a lost cause. If I pull out my PS5 30 years from now and pop in my Cyberpunk 2077 disk to play, I'm going to have a barely playable game.

It's better than nothing, I suppose, but I won't be able to re-play the excellent version that I played through last year.

WhiteDawn 4 days ago |

Looks like they also wrote a Ghidra Decompiler for the ISA https://github.com/DiscoStarslayer/ghidra-spc970

hn1rig3rak 4 days ago |

Yeah, and day-one patches only exist while the servers do. Archive the PKGs.

Markoff 3 days ago |

I own HEN jailbroken PS3 Super Slim (after previous Slim died on me, RSX most likely) and honestly I am not even interested in PS4 and PS5 jailbreak, PS3 can play PS1 and PS2 games, PS4 can't. The biggest reason I don't care about jailbreaking PS4 which should be my next upgrade, I play with kids games on split screen TV or they play by themselves and sadly these are produced less and less these days with everyone expecting others to play alone over internet, which ain't fun at all, if you just wanna sit at TV and play all together in 3 people (wife is not into gaming). PS3 was peak PS split-screen gaming and peak PS compatibility with previous consoles.

AdmiralAsshat 4 days ago |

What's the practical benefit of this? Will it allow us to reverse-engineer the BIOS so that PS2 emulators can ship with a working one rather than forcing end-users to "procure" a proprietary BIOS blob?

nubinetwork 4 days ago |

This is the one you can't mechapwn, right? Can we do anything with this information?

Founderarcstone 4 days ago |

after 26 years? its a PS2...