This is a sub-page of PlayStation 2.
|
This needs some investigation. |
Security Implementation Overview#
Copy Protection#
The PS2, taking inspiration from its predecessor, primarily prevents access to foreign and/or non-original discs by rejecting them in hardware: the mechacon identifies discs as PS1 or PS2 CDs with or without Redbook audio tracks, PS2 DVDs, audio CDs, movie DVDs, or "other" on its own. The CD-ROM Backdoor trick can be used, but only for PS1 games and is only usable on PS2 systems up to model number SCPH-39xxx, due to subsequent models having a different mechacon.
- On most models, if a rudimentary login procedure (called "boot certification") is not done, no disc can be read at all. This attempts to obstruct the development of third-party ROMs and system updates.
- PS1 CDs still have to pass the PS1 wobble-based security system. Once authenticated, PS1 discs can be swapped with PS2 CDs or vice versa (this means a simple PS1 modchip can be fitted in a PS2 to run PS1, as well as PS2 CD backups when combined with homebrew access; typically, however, it is not possible to switch between PS1 or PS2 modes at runtime).
- "Other" discs are always rejected.
- DVD-Video discs are blocked by default (and after every reset by official firmware) until the mechacon successfully decrypts a KELF declaring itself to be a DVD Player.
:*On regular consumer consoles, FreeMCBoot normally circumvents this by loading such a dummy KELF.
:*Developer consoles, instead, are not licensed as DVD players and will refuse to load such a KELF.
(Source: ysai187)
:*Specifically, the DVD player software shuts itself down if the console NVRAM model begins with DTL-H, and specifically looks for this code to run the ForbidDVDV command. In fact, if the NVRAM is manually changed (for example, to something like "DTL-T"), this can be undone.
::*Developer consoles with DVD player support did exist, but were only used internally by Sony and did not see any other release.
:*DVD-Video discs are also locked by whether they are NTSC or PAL. (This is also the reason why two Asian versions exist - the version for Hong Kong/Macau is PAL whereas the version for Taiwan is NTSC)
::**PAL/50Hz versions of the DVD Player will also play 60Hz DVDs, as long as the region code matches (e.g. Japanese DVDs can be played back on European consoles, since both Japan and Europe use DVD region 2). Video output will be in 60 Hz (true NTSC, not PAL60). NTSC/60Hz consoles on the other hand will refuse playback of 50 Hz DVDs, even if the region code matches.
:*DVD-Video discs discolor the screen to green on RGB cables without YPbPr input or when the console is plugged in via composite into a VCR as a form of copy protection. This is because the first version of the DVD player allowed RGB playback, which was exploited through the use of peripherals to copy films to VHS. Cheat discs patch this. The console also outputs traditional analogue Macrovision.
- Consoles with modchips may attempt to load unsupported discs such as VCDs as they identify them as valid PS2 game discs; this leads to an error where the beginning part of the Red Screen (before the texts appear) is looped.1 This can also happen with discs in officially supported formats should they be erroneously identified as PS2 game discs. Meanwhile, stock consoles will simply give a standard error message when attempting to read these unsupported discs.
Note that PlayStation discs exclusively use the ISO9660 filesystem. This is exploited by ESR, where PS2 DVD disc images have an UDF filesystem with the shortest possible DVD movie added, making them pass the mechacon's checks, and are then started by a homebrew running them with appropriately modified optical drive drivers.
The program PS2LOGO, as the name suggests, displays the PlayStation 2 logo embedded in the inserted disc. The Sony OSDSYS boots PS2 games through this program, though this is not required to run games themselves and can be bypassed by homebrew that runs software straight from the executable. On Deckard systems, it is also in charge of operating rom0:XPARAM. The official firmware verifies the scrambled logo stored within the first sectors of the game disc after being encrypted with a key based on the titleID. This poses a significant challenge to manufacturers of unlicensed discs, who need to master them with part of the data track literally pasted over their own, with data from the American version of Crazy Taxi (SLUS-20202) being one of the most used ones as it is the CD-ROM PS2 game with the largest table of contents. Since PAL and NTSC logos differ, this also acts as a check for the video region, comparable to the one in 3000 and newer Japanese fat and European slim PS1s. The boot filename is visible in SYSTEM.CNF, but only used to cross-check with the mechacon, and not required for booting.
If one swaps discs before the logo is decrypted, the game cannot run as the logo was not encrypted with the disc key that the mechacon received, although there are no specific anti-swap protections unlike the PS1. Games also call sceCdMmode() to tell CDVDMAN whether they were meant for a CD or DVD. From V8 (specify?) onwards, in DVD games, the mechacon stops boot routine if the disc is not validated as a DVD-ROM. Some games, such as EA-developed games, also perform this check in software.
Modchips send fake disc keys to the mechacon and patch PS2LOGO and OSDSYS to not require a disc key. This alone blocks the ability to detect whether a disc is for PS1 or PS2. In the case of Matrix Infinity, a trojan is installed to the RAM(?) which checks the boot file for whether it is PS1 or PS2 software. If detected as PS1 software or DVD-Video, the drive is reset, making the blue light on the eject button flash. On the second read, the SCEX pulse for PS1 mode is injected.
PS2 modchips have to operate on both the mechacon (via the pins usually named with letters near the beginning of the alphabet) and the ROM (via the lower-lettered pins), and to generate the PS1 region string (via the "SX" pin) too. Their interaction with the BIOS (including memory-resident modules loaded from it and potentially replaced by disc software) also greatly complicates their design and compatibility, especially when builtin-OSDSYS alternatives (such as Free*Boot, HDDOSD, and PSBBN) are involved.
Developer consoles will also accept master discs, which feature a special header intended to be recordable with standard computer optical drives. Different models may or may not be region free with respect to original and master discs, culminating with the 75xxx and newer series, where the region can be changed by turning on the power while holding all L/R buttons.
From the SCPH-30xxx onwards, the disc drive is technically disabled by default and only unlocked by certifying the boot ROM's version number, region, and type. This is in order to prevent ROM swapping.
The DVD Video could initially have the region lock removed through the use of a controller combination, a debug feature which accidentally shipped in the earliest SCPH-10000s. The DVD would still have to contain 60Hz video. This was quickly removed.
Blacklisted Discs#
DVD Player version 1.00 - because it contained the ability to play NTSC discs from any region Macrovision-free - was blacklisted on all consoles except the very first version of the SCPH-10000. This also happened to several unlicensed discs - particularly cheat discs such as Action Replay - which were blocked from booting in new console revisions via a blacklist contained in the mechacon, of the aforementioned discs' fingerprints (unique properties to the data, like a file hash) in the mechacon. Manufacturers of unlicensed discs attempted to circumvent this by releasing newer versions of the discs, which would subsequently be blacklisted again.
Specifically, the disc itself is allowed to boot, but fails the 'cdvdkey' check when unique properties to the disc are detected, thus blocking the executable from starting. At least in the case of DVD Player 1.00, this is the KELF signature.
Memory Cards#
Memory Cards are protected from access by unlicensed devices by the MagicGate login system (also having obstructed 3rd party Memory Cards); as implied above, any official executables stored on Memory Cards must also be protected by the tangentially related MagicGate signatures, which are linked to the card's serial number. Older unlicensed cards, such as those by Datel and InterAct, were bundled with discs (such as Memory Manager Plus) that needed to be inserted to activate the cards each time they were used.
Whereas some rudimentary exploits were already known (already allowing for Vast/Memento, later imitated by FreeVast and developed into FreeMCBoot), the high-profile exploitation of the PS3 (on which PS2 modes, the mechacon is always emulated in software) resulted in the leak of MagicGate keys and code, resulting in PC drivers for the PS3's USB Memory Card reader and the ability to sign FMCB for any memory card without a modded PS2. (This software, called PS3MCA, and especially its mecha_emu.c file implementing MagicGate, are to date occasionally subject to takedowns from Sony.)
Equivalently, unpatched Sony drivers will only accept Sony OEM hard drives, and hard disk executables are KELFs protected by DNAS encryption, which may or may not be tied at the developer's discretion to the DNAS ID of the system, but it is to the disk's (unverified claim). This does not apply to the disk's boot partition, which use a different system closer to MagicGate.
HDD partitions may have rudimentary password protection, which however must be enforced at the driver level.
Finally, while arguably not a deliberate change against unlicensed accessories, later models (75xxx onwards?) do not supply 7.5V to the memory card slots, preventing operation of older unlicensed memory cards with 5V flash chips.
Chinese edition#
The SCPH-50009, made for Mainland China, contains additional protections due to widespread piracy in the country. It has its own dedicated game region, NTSC-C, rather than the NTSC-J region that is used on other East Asian PS2 consoles (Japan, Korea, Hong Kong and Taiwan). The region-exclusive additional ROM section (ROM2, residing in the physical DVD ROM IC, which is a 64 Mbit/8MByte part in these consoles), containing a Chinese character set, is required to boot most NTSC-C games due to software checks. CDVDMAN included in games for the region perform an additional check for a valid value in 0x1F402038 register. This model is also the only one known to utilize the CDVD S command 0x27 (sceCdReadPS1BootParam) to launch PS1 games.
'C' region games have additional data after the logo sectors: The title ID (e.g. SCCS-40019) is placed at offset 0x6000 (sector 12 + byte 0), and is the value returned by sceCdReadPS1BootParam (S command 0x27). The MechaCon (firmware version 5.02 and later) will check for the following string when determining validity only when 'C' region is used at offset 0x6020 (sector 12 + byte 32) (CP936/GBK encoded): "Library programs: Copyright (C) Sony Computer Entertainment Inc. This is an authorized product of Sony Computer Entertainment Inc. 本产品由索尼电脑娱乐公司授权生产 "
This was eventually circumvented with the region-specific Dragon modchip, leading Sony to stop producing Chinese consoles; later editions from other countries still contain the region parameter 'Csch' (Simplified Chinese) in the EEPROM, but the lack of ROM2's character set causes it to crash.