PlayStation 2 Security Chip Cracked After 26 Years

One of the last secrets of the original PlayStation 2 has finally been laid bare. A Canadian retro-hardware enthusiast known by the handle DiscoStarslayer has reported the successful reverse-engineering and dumping of the “magic security chip” CXP102064, better known as MechaCon. The chip was fitted in the “PS2 Fat” consoles produced from 1999 onward.

What MechaCon did

The chip got its name from its main function — managing the mechanics of the optical drive and the operation of the flash storage. Its role, however, went well beyond that: MechaCon was part of Sony's game-disc protection system and, according to the PSDev Wiki, was also responsible for decrypting MagicGate memory cards and KELF-format executables. It was precisely the secrecy of these mechanisms that for years made the chip an insurmountable obstacle for preservation and emulation projects.

Four years of labor

By the researcher's own account, the crack took roughly four years. The path was predictably thorny: chemically opening the package (decapping) to expose the silicon die, studying the circuitry under a microscope, and a so-called optical dump — reading the chip's contents literally “from a picture.” The final step was a software solution: as the author notes, while analyzing the “dirty” optical dumps he stumbled upon a vulnerability that allowed the data to be extracted through software. DiscoStarslayer offered special thanks to a helper named Libby, who found the exploit.

Who it will help

The achievement promises to be a serious boon for the communities devoted to preserving gaming heritage, repair, and emulation. Beyond improving the accuracy of emulators and advancing homebrew development, cracking the chip opens up the practical possibility of replacing the aging optical drives in PS2 consoles — a problem that has only grown more acute over the years.

Interestingly, the significance of the work reaches beyond home consoles. Commenters pointed out that MechaCon was also used in a number of arcade cabinets of that era — the Namco System 246 and System 256, as well as the Konami Python 1, all built on modified PS2 hardware. They all relied on the MechaCon firmware to authenticate and launch encrypted game data, so unlocking the chip's secrets potentially concerns these platforms too.

Source: Hacker News