Hello! I'm one of the people involved in reverse engineering the MechaCon. Please take note of the following:
* It is already possible to run backup/copied discs entirely using software methods (from memory card, HDD, or DVD video player exploit), and in the case of the 50k series and newer (Dragon MechaCon), can use the "force unlock" patch that does not require any patches to copied discs.
* The dumps, alone, does not give enough information to create an """hardware""" ODE (optical drive emulator). However, it is possible to make a modchip that replaces the MechaCon, relying on the DSP to continue to read discs.
* The current method to dump the ROM used in the SPC970 requires lots of writing to NVRAM.
* These dumps will eventually be useful for full-system low level emulation, as MagicGate and KELF/KIRX security goes through it.
* These dumps are useful for vulnability searching, which can allow functionality to MechaPwn (code execution on MechaCon, unlocking security e.g. set disc type and max LBN) or TonyHax (unlocking PS1 mode to read any disc, on SPC970 based MechaCons and all PS1 MechaCons).
* The contents of game discs (except those that use DNAS online authentication) are not encrypted. These dumps don't unlock anything additional there.
There are many different revisions of the DVD player software, requiring specific offsets for each exploit. The SPRs (system parameter registers) exposed in DVD player scripting do not expose enough information to be able to merge the exploits.
> Some of the reverse engineering tricks utilized by DiscoStarslayer include chemically decapping the CXP102064 to expose the die, then using microscopes and optical dumping skills to analyze the silicon chip circuitry. In this case, a lucky break during the hacking apparently uncovered an exploit that provided a method whereby the chip’s data could be extracted through software.
This is next level commitment to the cause.
Also, I can totally imagine their reaction when they discovered the exploit and realized they could put down the ... chemicals. XD
There actually is a pretty large community of hardware reverse engineers decapping chips for fun, sometimes just to dump internal ROMs (like in this case) and other times going as far as to try reconstructing the original schematics and netlists in order to document the chip's internals and allow for more accurate emulation, in some cases all the way down to the transistor level [1] [2]. If you want to learn more, Ken Shirriff has written a lot of blog posts on the subject [3] and Siliconprawn [4] hosts a huge collection of die shots from many contributors.
Doesn’t decapping chips require hydrofluoric acid ?
If so I cannot express enough respect, the one person I’ve interacted with that regularly worked with it put the fear of god with by showing what one insignificant miss for anything else did to his finger
No, the default acid used is nitric acid. Which should definitely be treated with respect, but isn't nearly as nasty as anything with fluorine.
But if you have a few examples of the chip and can break a few eggs to make an omelette, there are techniques that just involve hitting the epoxy with a blow torch and/or opening it up with plyers.
This will be great for preservation of PS2 games. Well done!
It seems like preservation of games for later consoles is a lost cause. If I pull out my PS5 30 years from now and pop in my Cyberpunk 2077 disk to play, I'm going to have a barely playable game.
It's better than nothing, I suppose, but I won't be able to re-play the excellent version that I played through last year.
It is sad that consoles much newer than the PS2 will be very hard to preserve. On the other hand, I feel that the classic video game era ended by the 2010s or so. So maybe there won’t be that much interest in preserving the newer games, partly because they had so much DRM, required online play, and such, such that they’re harder to preserve.
This may seem a little bit arbitrary, but this is not uncommon throughout history. For example, in a normal English literature class, you’re going to be assigned Shakespeare. You will be assigned a bunch of novels from the 19th century, but not very much in between. Yeah, sure, there are a few works, probably, from the 1600s and 1700s, but not many compared to those other ones that I mentioned.
Video games might be the same way, where the games that were made from the NES to around 2010 are the ones that people care about far into the future.
Games from the 2010s are still "new". There are several major game series where the most current entry came from the 2010s. Think Skyrim & GTA5.
Game companies still have the source code an tooling sitting around. With some minor texture brushups, they can release a "remastered" version and get $20 out of people again.
Nintendo games are the odd ones here, because their love of novel gameplay means that a lot of first party games need to run on OG hardware for the full experience. Think Wii, DS/3DS.
1. Playstation purchases seem to follow accounts and most games will run on future hardware.
2. Cross-platform is near universal now. While you may not be able to play the PS5 version on your PS9, you will likely be able to run the PC version still.
There's a subset of the preservation community who are focusing on decomp/recomp with PCs as the target architecture. x86 / Windows will outlive all of us, and with the source code, games can be recompiled for newer target architectures. This is trivial with LLMs now (targeting new architectures, not the decomp/recomp - though that has made progress too).
It's not a perfect solution, but it's good enough, IMHO.
In 30 years you may need to modify your PS5 just to get it booting. A lot of retro consoles have to be recapped.
Also the plastic gets brittle. I was replacing a fuse on a PS2 motherboard and some of the ribbon connector pieces just shattered on reassembly. There are many challenges to preservation. Eventually all that old hardware will be all gone.
I think what’s worse is flash lifespan. You can recap, but can you find replacements for failed flash? Can you reimage it with the correct data? Can you even access the flash, which may be buried inside a chip somewhere?
Plastic may get brittle but I think modern plastics do this less than 90s plastics.
This has been sort of a problem already in the Wii U community as some units have a less reliable NAND chip. For that console the community has developed the ability to emulate the NAND chip with an SD card. Proper NAND replacements are possible too but obviously more work and more risk and I think you may have needed to dump your encryption keys beforehand. Potentially it can be fixable but for some consoles like the Xbox Series line that we know very little about it may not be.
I was surprised that the “fix” for the failed storage module in my slim 4GB Xbox 360 was to tear it down and remove the storage module. It isn’t usually that easy.
I am also impressed they managed to use worse flash than the 15 year old $10 USB 2.0 drive I plugged in as a replacement.
Yes, it was one of those projects you see what you still have in the bin. Hey, this one is period correct!
Honest question, not a challenge: In what way will this improve preservation of PS2 games? My impression was that PS2 emulation was already solved, which I mention precisely to invoke Cunningham's Law. What PS2 things don't work right now because this chip hadn't been cracked?
The problem with game discs is that they rot. Some of them rot faster than others, but all of them shall eventually rot.
The problem with hardware is that it is scarce, and ultimately dies.
The problem with emulators is that they emulate. We can work to make it the same, but it is never going to be the same.
Even if the math all maths just like they did (bugs and all), and it takes precisely as long, and it shows up precisely at the same time in the same places as it did on the original hardware...and even when things like input latency are nailed down to nanosecond accuracy and the clocks are all just dead-nuts on: The code may run the same way, but the system is still not the same.
Part of the reason it's not the same is we haven't even touched the analog components yet and all and all of the things they do, whether amazing or ugly. (And no, improving the analog bits through simplification is not necessarily the sane goal at all. Improvement and emulation are different targets.)
Emulation is useful. It's great, actually. Right now, a person can think about that old PS2 they used to have and get started with playing some of their favorite games yet this afternoon. That's awesome.
But preservation, as an effort to keep old hardware to keep working as time marches on? That's a wonderful thing in its own right. The better we understand the old hardware, the more-able we are to preserve it and keep it running.
Getting past the layers of deliberate fuckery helps us to better understand what goes on behind the curtain, and that has now been achieved.
My guess (not involved with PS2 emulation specifically at all) is that this will improve low-level emulation.
So things like making a clone of the hardware with an FPGA, making emulators cycle-accurate, removing game-specific hacks that are no longer needed due to more accurate emulation, and achieving 100% bug-for-bug compatibility with original hardware.
I think this might allow doing more things with the disc drive on all(?) ps2 models like running copied/homebrew ps1 discs (currently requires a modchip afaik), or potentially developing replacement optical drives/hardware emulators
PS2 emulation leaves a lot to be desired in terms of accuracy and authenticity, and current original hardware backup solutions are not ideal or extremely cumbersome, including caveats like relying on homebrew software which alters the memory layout of games as they run, leading to inaccuracies and broken games, and needing to have multiple copies of backup loading software on your console, as some loaders will work with some games, but not with others. It's a right mess. Some solutions, such as MechaPwn, are more transparent, allowing you to burn so-called "master discs" of your game backups to DVD-R. As far as I can tell, compatibility is 100%, but if I recall correctly, this only works on specific models of console, and the process of burning a master disc can be unintuitive and relies on specific, deprecated, commercial DVD burning software.
From what I can tell, this opens the door to things like optical drive emulators, which replace the disc laser with an SD card slot, allowing the console to read game disc images no differently than the console would read a retail game.
> If I pull out my PS5 30 years from now and pop in my Cyberpunk 2077 disk to play, I'm going to have a barely playable game.
If we're lucky, it won't be playable at all. Then they'll have the option of selling it to you again, and some shareholders (the only people who matter) will be happy.
With AI-driven hardware price spikes, I think there's a great opportunity to push for a transition to streaming, so users won't have any game files at all, and subscriptions can become the norm.
Back in the day my jailbroken PS2 would run all sorts of CDs with pirated games. It was such a magical time, I would download all sorts of games and spend the evening discovering gems.
It's only a matter of time until most of these games get vibe-coded back end clones. Still not as good as a full ROM but at least and improvement over complete unplayability.
Yes. My colleague was telling me about how he was vibe coding a port of some random-ass PSP game. So people are clearly already doing it.
PS4 is AMD64 based. And so few games leveraged the cell processor in the PS3 to it's fullest, IIRC, the current emulation strategy is to translate the cell calls to x86. So the hard work is actually already done.
I have no doubt it'll be attempted, but they won't be clones, they'll be clowns.
Even if they were pixel perfect clones with exactly the same play. As a person who vibe codes like there's no tomorrow to have custom software, I still find the color of the bytes important for something like a retrogame.
Otherwise it's like color photocopy of an art piece.
IIRC, the PS2 did not download game updates or patches from the internet. The game on the disk was what you played. As long as you had a PS2 and the disk, you could play the exact game you played so many years ago.
With the PS5, the disk is more or less a key that lets the console download the game. Having the console and the disk is a guarantee of nothing in the future other than you can probably play the buggy mess that they packaged up way before the game was done.
I don't know why this myth keeps getting perpetuated. It's simply not true. The countless game discs I own that let me install and play the game without internet access are proof of that. There are some games where the game acts as a key and doesn't contain the full game, but this isn't the rule.
Everything gets broken eventually. Every Nintendo console except the switch 2 is wide open. Even the "unbreakable" Xbox consoles were broken with Damage Control. Anything worth breaking will be broken, eventually, whether in software or by a mod chip.
What's the practical benefit of this? Will it allow us to reverse-engineer the BIOS so that PS2 emulators can ship with a working one rather than forcing end-users to "procure" a proprietary BIOS blob?
Hello! I'm one of the people involved in reverse engineering the MechaCon. Please take note of the following:
* It is already possible to run backup/copied discs entirely using software methods (from memory card, HDD, or DVD video player exploit), and in the case of the 50k series and newer (Dragon MechaCon), can use the "force unlock" patch that does not require any patches to copied discs.
* The dumps, alone, does not give enough information to create an """hardware""" ODE (optical drive emulator). However, it is possible to make a modchip that replaces the MechaCon, relying on the DSP to continue to read discs.
* The current method to dump the ROM used in the SPC970 requires lots of writing to NVRAM.
* These dumps will eventually be useful for full-system low level emulation, as MagicGate and KELF/KIRX security goes through it.
* These dumps are useful for vulnability searching, which can allow functionality to MechaPwn (code execution on MechaCon, unlocking security e.g. set disc type and max LBN) or TonyHax (unlocking PS1 mode to read any disc, on SPC970 based MechaCons and all PS1 MechaCons).
* The contents of game discs (except those that use DNAS online authentication) are not encrypted. These dumps don't unlock anything additional there.
See https://gist.github.com/uyjulian/aaf4f4e2e74d980f620a9b73ba0... for updated info.
I never could get the DVD player exploit to work, so I ended up buying a memory card with with FreeMCBoot.
I get the feeling that the DVD exploit is fiddly and requires adjustments for each iteration of the possible PS2 hardware configurations.
There are many different revisions of the DVD player software, requiring specific offsets for each exploit. The SPRs (system parameter registers) exposed in DVD player scripting do not expose enough information to be able to merge the exploits.
> Some of the reverse engineering tricks utilized by DiscoStarslayer include chemically decapping the CXP102064 to expose the die, then using microscopes and optical dumping skills to analyze the silicon chip circuitry. In this case, a lucky break during the hacking apparently uncovered an exploit that provided a method whereby the chip’s data could be extracted through software.
This is next level commitment to the cause.
Also, I can totally imagine their reaction when they discovered the exploit and realized they could put down the ... chemicals. XD
There actually is a pretty large community of hardware reverse engineers decapping chips for fun, sometimes just to dump internal ROMs (like in this case) and other times going as far as to try reconstructing the original schematics and netlists in order to document the chip's internals and allow for more accurate emulation, in some cases all the way down to the transistor level [1] [2]. If you want to learn more, Ken Shirriff has written a lot of blog posts on the subject [3] and Siliconprawn [4] hosts a huge collection of die shots from many contributors.
[1] https://floooh.github.io/visual6502remix
[2] https://github.com/iaddis/metalnes
[3] https://www.righto.com/
[4] https://siliconprawn.org/
Doesn’t decapping chips require hydrofluoric acid ? If so I cannot express enough respect, the one person I’ve interacted with that regularly worked with it put the fear of god with by showing what one insignificant miss for anything else did to his finger
No, the default acid used is nitric acid. Which should definitely be treated with respect, but isn't nearly as nasty as anything with fluorine.
But if you have a few examples of the chip and can break a few eggs to make an omelette, there are techniques that just involve hitting the epoxy with a blow torch and/or opening it up with plyers.
Byuu and McMaster decapped all the SNES ones with amazing write-ups a number of years ago.
This article seems to be completely based on the X post by the reverse engineer DiscoStarSlayer : https://x.com/DiscoStarslayer/status/2099132300390744320.
That post reads "After 4 years of effort, I'm happy to announce that one of the final secrets of the PS2 has been broken wide open!
It's been a long process of decapping, optical dumping, and now at last a software solution.
Thank you Libby for finding the exploit from our dirty optical dumps!"
Yesterday DiscoStarSlayer also promised details are coming: "Will share full write-up on how we got here soon!"
This will be great for preservation of PS2 games. Well done!
It seems like preservation of games for later consoles is a lost cause. If I pull out my PS5 30 years from now and pop in my Cyberpunk 2077 disk to play, I'm going to have a barely playable game.
It's better than nothing, I suppose, but I won't be able to re-play the excellent version that I played through last year.
It is sad that consoles much newer than the PS2 will be very hard to preserve. On the other hand, I feel that the classic video game era ended by the 2010s or so. So maybe there won’t be that much interest in preserving the newer games, partly because they had so much DRM, required online play, and such, such that they’re harder to preserve.
This may seem a little bit arbitrary, but this is not uncommon throughout history. For example, in a normal English literature class, you’re going to be assigned Shakespeare. You will be assigned a bunch of novels from the 19th century, but not very much in between. Yeah, sure, there are a few works, probably, from the 1600s and 1700s, but not many compared to those other ones that I mentioned.
Video games might be the same way, where the games that were made from the NES to around 2010 are the ones that people care about far into the future.
Games from the 2010s are still "new". There are several major game series where the most current entry came from the 2010s. Think Skyrim & GTA5.
Game companies still have the source code an tooling sitting around. With some minor texture brushups, they can release a "remastered" version and get $20 out of people again.
Nintendo games are the odd ones here, because their love of novel gameplay means that a lot of first party games need to run on OG hardware for the full experience. Think Wii, DS/3DS.
The flip side is:
1. Playstation purchases seem to follow accounts and most games will run on future hardware.
2. Cross-platform is near universal now. While you may not be able to play the PS5 version on your PS9, you will likely be able to run the PC version still.
There's a subset of the preservation community who are focusing on decomp/recomp with PCs as the target architecture. x86 / Windows will outlive all of us, and with the source code, games can be recompiled for newer target architectures. This is trivial with LLMs now (targeting new architectures, not the decomp/recomp - though that has made progress too).
It's not a perfect solution, but it's good enough, IMHO.
In 30 years you may need to modify your PS5 just to get it booting. A lot of retro consoles have to be recapped.
Also the plastic gets brittle. I was replacing a fuse on a PS2 motherboard and some of the ribbon connector pieces just shattered on reassembly. There are many challenges to preservation. Eventually all that old hardware will be all gone.
I think what’s worse is flash lifespan. You can recap, but can you find replacements for failed flash? Can you reimage it with the correct data? Can you even access the flash, which may be buried inside a chip somewhere?
Plastic may get brittle but I think modern plastics do this less than 90s plastics.
This has been sort of a problem already in the Wii U community as some units have a less reliable NAND chip. For that console the community has developed the ability to emulate the NAND chip with an SD card. Proper NAND replacements are possible too but obviously more work and more risk and I think you may have needed to dump your encryption keys beforehand. Potentially it can be fixable but for some consoles like the Xbox Series line that we know very little about it may not be.
This explains all those lots of "untested" WiiU's I see for sale.
I was surprised that the “fix” for the failed storage module in my slim 4GB Xbox 360 was to tear it down and remove the storage module. It isn’t usually that easy.
I am also impressed they managed to use worse flash than the 15 year old $10 USB 2.0 drive I plugged in as a replacement.
Yes, it was one of those projects you see what you still have in the bin. Hey, this one is period correct!
Honest question, not a challenge: In what way will this improve preservation of PS2 games? My impression was that PS2 emulation was already solved, which I mention precisely to invoke Cunningham's Law. What PS2 things don't work right now because this chip hadn't been cracked?
The problem with game discs is that they rot. Some of them rot faster than others, but all of them shall eventually rot.
The problem with hardware is that it is scarce, and ultimately dies.
The problem with emulators is that they emulate. We can work to make it the same, but it is never going to be the same.
Even if the math all maths just like they did (bugs and all), and it takes precisely as long, and it shows up precisely at the same time in the same places as it did on the original hardware...and even when things like input latency are nailed down to nanosecond accuracy and the clocks are all just dead-nuts on: The code may run the same way, but the system is still not the same.
Part of the reason it's not the same is we haven't even touched the analog components yet and all and all of the things they do, whether amazing or ugly. (And no, improving the analog bits through simplification is not necessarily the sane goal at all. Improvement and emulation are different targets.)
Emulation is useful. It's great, actually. Right now, a person can think about that old PS2 they used to have and get started with playing some of their favorite games yet this afternoon. That's awesome.
But preservation, as an effort to keep old hardware to keep working as time marches on? That's a wonderful thing in its own right. The better we understand the old hardware, the more-able we are to preserve it and keep it running.
Getting past the layers of deliberate fuckery helps us to better understand what goes on behind the curtain, and that has now been achieved.
My guess (not involved with PS2 emulation specifically at all) is that this will improve low-level emulation.
So things like making a clone of the hardware with an FPGA, making emulators cycle-accurate, removing game-specific hacks that are no longer needed due to more accurate emulation, and achieving 100% bug-for-bug compatibility with original hardware.
I think this might allow doing more things with the disc drive on all(?) ps2 models like running copied/homebrew ps1 discs (currently requires a modchip afaik), or potentially developing replacement optical drives/hardware emulators
PS2 emulation leaves a lot to be desired in terms of accuracy and authenticity, and current original hardware backup solutions are not ideal or extremely cumbersome, including caveats like relying on homebrew software which alters the memory layout of games as they run, leading to inaccuracies and broken games, and needing to have multiple copies of backup loading software on your console, as some loaders will work with some games, but not with others. It's a right mess. Some solutions, such as MechaPwn, are more transparent, allowing you to burn so-called "master discs" of your game backups to DVD-R. As far as I can tell, compatibility is 100%, but if I recall correctly, this only works on specific models of console, and the process of burning a master disc can be unintuitive and relies on specific, deprecated, commercial DVD burning software.
From what I can tell, this opens the door to things like optical drive emulators, which replace the disc laser with an SD card slot, allowing the console to read game disc images no differently than the console would read a retail game.
Ah, hardware disk drive replacements, that would make sense. I'm very software oriented so wasn't considering the hardware implications. Thank you.
PS3 has been jailbroken since 2010 (remember geohot?)
The original fat PS3 and the first few years of slims are also completely “open” as well (with custom firmware that’s fairly easy to install).
If anything, the PS3 was easier to break its security on.
> If I pull out my PS5 30 years from now and pop in my Cyberpunk 2077 disk to play, I'm going to have a barely playable game.
If we're lucky, it won't be playable at all. Then they'll have the option of selling it to you again, and some shareholders (the only people who matter) will be happy.
With AI-driven hardware price spikes, I think there's a great opportunity to push for a transition to streaming, so users won't have any game files at all, and subscriptions can become the norm.
> pop in my Cyberpunk 2077 disk to play
It depends if you have a ps4 disk or a ps5 disk.
The ps5 disk is the "Ultimate Edition" version. It was released 3 years after launch and contains the 2.0 update
Back in the day my jailbroken PS2 would run all sorts of CDs with pirated games. It was such a magical time, I would download all sorts of games and spend the evening discovering gems.
It's only a matter of time until most of these games get vibe-coded back end clones. Still not as good as a full ROM but at least and improvement over complete unplayability.
Do you honestly believe that most of the thousands of PS2, PS3 and PS4 games will get vibe-coded backend clones?
Yes. My colleague was telling me about how he was vibe coding a port of some random-ass PSP game. So people are clearly already doing it.
PS4 is AMD64 based. And so few games leveraged the cell processor in the PS3 to it's fullest, IIRC, the current emulation strategy is to translate the cell calls to x86. So the hard work is actually already done.
I have no doubt it'll be attempted, but they won't be clones, they'll be clowns.
Even if they were pixel perfect clones with exactly the same play. As a person who vibe codes like there's no tomorrow to have custom software, I still find the color of the bytes important for something like a retrogame.
Otherwise it's like color photocopy of an art piece.
In the PS2 days people thought that about the PS2, too.
IIRC, the PS2 did not download game updates or patches from the internet. The game on the disk was what you played. As long as you had a PS2 and the disk, you could play the exact game you played so many years ago.
With the PS5, the disk is more or less a key that lets the console download the game. Having the console and the disk is a guarantee of nothing in the future other than you can probably play the buggy mess that they packaged up way before the game was done.
I don't know why this myth keeps getting perpetuated. It's simply not true. The countless game discs I own that let me install and play the game without internet access are proof of that. There are some games where the game acts as a key and doesn't contain the full game, but this isn't the rule.
Everything gets broken eventually. Every Nintendo console except the switch 2 is wide open. Even the "unbreakable" Xbox consoles were broken with Damage Control. Anything worth breaking will be broken, eventually, whether in software or by a mod chip.
X360 / PS3 are totally hackable, and those games were released before the PITA of modern gaming began.
Maybe the real question is whether these games are worth preserving. Most valuable games have a PC port anyway and those get cracked sooner or later.
If you pop in gta6 you'll have exactly no game at all!
Looks like they also wrote a Ghidra Decompiler for the ISA https://github.com/DiscoStarslayer/ghidra-spc970
https://github.com/spc970-dumper-union/spc970-dumps-public
What's the practical benefit of this? Will it allow us to reverse-engineer the BIOS so that PS2 emulators can ship with a working one rather than forcing end-users to "procure" a proprietary BIOS blob?
Yeah, and day-one patches only exist while the servers do. Archive the PKGs.
This is the one you can't mechapwn, right? Can we do anything with this information?
after 26 years? its a PS2...