PlayStation 2
PlayStation 2 |
---|
Developer: Sony Computer Entertainment
![]() |
This page is loooong... Consider grouping related content into additional subpages to ease readability. |
The PlayStation 2 (abbreviated as PS2) is Sony's second home console, notable for being the best-selling video game console of all time. It has DVD playback (a major factor in its success), some cool menu designs, and over 4,000 games in its library.
To do:
|
Contents
- 1 Sub-Pages
- 2 Hidden Credit
- 3 Possible Debug Menu
- 4 Startup Screen Easter Egg
- 5 System Version Tag
- 6 Test Mode
- 7 Oddities
- 8 Version Differences
- 8.1 Red Error Screen
- 8.2 Time Notation/Format
- 8.3 Leaving Time Options Menu Sound
- 8.4 Blurred Cubes On Display
- 8.5 Time Zone Listing
- 8.6 System Configuration and Browser Text
- 8.7 Shift-JIS Character Set
- 8.8 Selectable Languages
- 8.9 Hardware/Firmware
- 8.10 System Updates
- 8.11 DVD Player versions
- 8.12 1.xx
- 9 Security Implementation Overview
Sub-Pages
Notes |
Build Info |
Development Text |
Hidden Credit
This needs some investigation. Discuss ideas and findings on the talk page. Specifically: Who or what is "M.T."? |
Present at 0x120C of the ROM file, or 0x12C of RESET inside the ROM filesystem:
PS compatible mode by M.T.
In TOOL firmwares, this message appears as:
GmainX(MINIRA) by M.T.
GmainX refers to the PS2 development hardware.
It's worth noting that this string is the second human-readable string in the ROM (right after "Sony Computer Entertainment Inc"), meaning that M.T. got some pretty high billing!
Possible Debug Menu
To do: Verify that these entries actually are part of a menu. |
Somewhere around 00002BD0 in the BIOS 01.00 files is what appears to be a debug menu, containing the options:
System_Memory_Manager Module_Manager Exception_Manager Interrupt_Manager ssbus_service Timer_Manager dmacman System_C_lib Heap_lib Multi_Thread_Manager Vblank_service IO/File_Manager Moldule_File_loader ROM_file_driver Stdio IOP_SIF_manager RebootByEE SyncEE IOP_SIF_rpc_interface LoadModuleByEE sio2man mcserv FILEIO_service secrman_for_cex padman cdvd_driver cdvd_ee_driver EEConfig
Startup Screen Easter Egg
The Sony Computer Entertainment boot screen can show "towers" (blocks appearing in different numbers and different heights) in the background, as long as a PS2 Memory Card is inserted. While undocumented in the manual, these blocks represent the different titles launched on the system, and the respective number of launches with that Memory Card inserted.
This data is stored in the B?DATA-SYSTEM folder of the Memory Card, displayed in the Browser (using a ROM-builtin icon not actually stored on the card) as the misleadingly-named "Your System Configuration"; the actual system settings are stored in built-in EEPROM (and HDD system partitions for HDDOSD/PSBBN-exclusive settings such as keyboard repeat rate).
Only a limited number of titles can be recorded: if exceeded, the least-recently-played one will be dropped. When using HDDOSD, both disc and HDD titles will be recorded (however most unofficial uses of the HDD do not conform to the appropriate partition naming scheme required for this functionality). Modern versions of Open PS2 Loader will update this play history as well.
System Version Tag
To do: Add more version strings and put them in a table ala the PSX article. |
The compatibility ROM within the PS2 BIOS contains a unique string:
System ROM Version 5.0 10/27/00 J Copyright 1993-1999 (C) Sony Computer Entertainment Inc.
Test Mode
To do: Explain more in-depth on how this can be accessed on real hardware for as many revisions as possible. |
The BIOS allows booting either OSDSYS (the menu interface you'd usually see), as well as TESTMODE. It can be accessed in multiple ways: by shorting a certain mechacon pin to ground on the board, using a custom-built ELF to load it, or just simply editing EELOAD in the BIOS itself and preventing rom0:OSDSYS from being loaded by replacing it with rom0:TESTMODE, which is what the following video and screenshots use to achieve it.
When booted, it sits on a blank screen playing a 1kHz sine wave tone until any button is pressed on the controller. Afterwards, it lets you cycle between 6 different test cards. Some of these cards also let you change its properties.
The controls are as follows:
Select | Next test card |
---|---|
X | Change color (2nd, 4th, 5th test card) * |
O | Dithered gradient/solid steps (6th test card) |
R1 | Increase resolution |
R2 | Decrease resolution |
Up | Increase brightness (2nd test card) |
Down | Decrease brightness (2nd test card) |
Left | Increase density (2nd test card) |
Right | Decrease density (2nd test card) |
Test Mode demonstration |
---|
Volume warning: Beware of the 1kHz sine wave tone at the beginning! |
A list of available resolutions can be found in the TESTMODE executable file in the BIOS:
- VESA4B 1280x1024 N-Inter
- VESA4A 1280x1024 N-Inter
- VESA3E 1024x768 N-Inter
- VESA3D 1024x768 N-Inter
- VESA3C 1024x768 N-Inter
- VESA3B 1024x768 N-Inter
- VESA2E 800x600 N-Inter
- VESA2D 800x600 N-Inter
- VESA2C 800x600 N-Inter
- VESA2B 800x600 N-Inter
- VESA2A 800x600 N-Inter
- VESA1D 640x480 N-Inter
- VESA1C 640x480 N-Inter
- VESA1B 640x480 N-Inter
- VESA1A 640x480 N-Inter
- DTV1080I 1920x1080 Inter
- DTV720P 1280x720 N-Inter
- DVD480P 720x480 N-Inter
- DTV480P 720x480 N-Inter
- DVDPAL 720x576 Inter
- PAL 640x512 Inter
- DVDNTSC 720x480 Inter
- NTSC 640x448 Inter
Oddities
Invalid System Configuration
The OSDSYS executable has three icon.sys presets loaded at all times: "Your System Configuration", "あなたのシステム設定ファイル", and a third nameless preset, all three pointing to the _SCE8 (\ICOIMAGE\ICOBYSYS) BIOS icon. The first two named ones have an unused red background and the 3rd unnamed preset has the regular dark blue background usually seen with the System Configuration file (as well as with Corrupted Data, Network Settings, and other system files) which is used to override the red background. It is possible to make an "invalid" system configuration file which would skip the nameless blue preset from being loaded, letting it display the unused red background that presumably would've been seen if something had gone horribly wrong with the file.
Normal Configuration | Invalid Configuration |
---|---|
![]() |
![]() |
![]() |
![]() |
Version Differences
Red Error Screen
SCPH-1xxxx consoles | SCPH-3xxxx consoles and newer |
---|---|
![]() |
![]() |
SCPH-1xxxx consoles use an older version of the red error screen when the language is set to English. (Japanese was not changed.) The text is centered differently between the two versions and the wording of the error is updated with to make more grammatical sense starting with the 3xxxx consoles. The word "disc" is also not capitalized on this screen starting on the 3xxxx consoles (but it still is on the browser screen). The earlier Japanese models (with BIOS versions 01.00J through 01.10J) do not leave the red error screen when the Eject button is pressed, but rather the only way to leave this screen is by pressing the Reset button.
SCPH-xxx005-8 consoles | SCPH-50009 console |
---|---|
![]() |
![]() |
Additionally, on SCPH-xx005/06/07/08 consoles, the "PlayStation" and "PlayStation 2" texts are written in the same Helvetica font as the rest of the message rather than as their respective logos; the same applies to the SCPH-50009 where the whole message, again including the names of the consoles, is written in a Times New Roman-like serif font. This applies to all languages that said consoles respectively contain.
Time Notation/Format
SCPH-30001 (v01.10) | SCPH-35001 (v01.20) Onward |
---|---|
![]() |
![]() |
![]() |
![]() |
In PlayStation 2 models with BIOS version 01.10, "Time Notation" and "Date Notation" are used to identify the options for time and date formats respectively. In all later BIOS revisions, every instance of the word "Notation" was replaced with the word "Format".
Leaving Time Options Menu Sound
In BIOS versions 01.60 and earlier, the Confirm sound can be heard when backing out of the Time Options menu. This is corrected in BIOS versions 01.70 and later, where the Cancel sound is heard when backing out of the Time Options menu.
Blurred Cubes On Display
Through SCPH-39001 (v01.60) | SCPH-50001 (v01.70) Onward |
---|---|
![]() |
![]() |
One very minor change between the BIOS versions on the PlayStation 2 models SCPH-39001 (and earlier) and SCPH-50001 (and later) is the way the cubes on the System Configuration menu behave when the Square button is pressed. On earlier revisions, upon pressing the Square button on the System Configuration menu, the cubes on the left part of the screen become blurry, as the entire background deblurs, before they shrink. Pressing the Square button again restores the cubes and then deblurs them as the background becomes blurry. Oddly, in later BIOS revisions, the cubes do not become blurry at all when they shrink or before fully returning to normal. Additionally, only the seven orbs, along with the twelve prisms surrounding them, deblur when the Square button is pressed to hide the squares, then they become blurry again when the cubes are restored. Nonetheless, this interesting change most likely has something to do with every model with the IR sensor built in allowing the player to toggle whether or not the PlayStation 2 Remote Control should control the game that is being played.
Time Zone Listing
Through BIOS v01.70 | BIOS v01.90 Onward |
---|---|
![]() |
![]() |
The time zones are listed differently between PlayStation 2 models with BIOS versions 01.70 (and earlier) and 01.90 (and later). On models with the earlier BIOS revisions, the regions are on the main list. Regions with multiple time zones list the time zones underneath. Everything on these models is sorted alphabetically. As for the models with the later BIOS revisions, all time zones are on a single list. The time zones are sorted by their GMT value, then time zones with the same GMT value are sorted alphabetically. Interestingly, this change was made between two versions of the PlayStation 2 model SCPH-500xx, so whichever way the time zones are organized will determine the revision of this specific PlayStation 2 model.
System Configuration and Browser Text
To do:
|
Early PS2 models (v01.90 and earlier) | Slim PS2 models (v02.00 and later) |
---|---|
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
When transitioning from large to small, several text changes were made to the Browser menu. For instance, "No data" on the larger models was replaced with "There is no data." Additionally, if the system is unable to read anything from the disc (and not in a way that causes the Red Screen (of Death) to appear), the larger models say "Disc read error." while the slim models say "The disc could not be read." In fact, the change was done following a lawsuit.
On earlier PS2 models, the startup screen spins slower when the PlayStation 2 Network Adapter is attached. Furthermore, just pressing the Reset button while playing software that makes use of the Network Adapter will not reset the console but instead put it in Standby mode (as if the Reset button was being pressed and held instead of pressed and released) - to reset the game, one has to press the Reset button quickly twice. The BIOS versions on the slims are programmed to negate the aforementioned effects of the PlayStation 2 Network Adapter because of having the Ethernet controller and connector on the main board as well as no (official) support for a hard disk drive. The slims also list the system MAC address when pressing Triangle to display the Version Information screen, a feature originating in HDDOSD.
Shift-JIS Character Set
The initial Japan-only BIOS revisions used a single Shift-JIS character set for both the Memory Card and the OSDSYS. It also meant that you could use ASCII characters for Memory Card icon.sys files in BIOS 01.00 and 01.01. Starting from BIOS 01.10 it was split off and made into a separate independent character set just for the OSDSYS, which was updated multiple times across the many PlayStation 2 releases out there.
This spreadsheet should have all of the changes documented.
The changes pointed out in the spreadsheet above are listed below:
- While most versions have no visible difference between an invalid character and a blank character, BIOS 01.00/01.01 displays a somewhat corrupt graphic if an invalid character is entered.
- Blocks 85xx, 86xx and 87xx in BIOS 01.00 and 01.01 have characters that only appear in these two revisions.
- Starting from 01.10 these blocks were repurposed for extended Greek, Cyrillic and Latin characters, which were taken and slightly rearranged from the EUC-JP encoding layout blocks 8FA2xx - 8FABxx.
- A large amount of these characters were never used, as the PlayStation 2 didn't get localised in many different languages. In particular, despite a Greek character set being fully encoded, a Greek translation was never officially made.
- The extended Cyrillic letter Ў/ў is incorrectly rendered as У́/у́ in all revisions.
- The Czech and Slovak letters ď, Ľ, ľ and ť are incorrectly rendered with a caron diacritic, just like Ď, Ť and other letters would be.
Since neither a Belarusian, Czech, Slovak nor an Uzbek translation was ever officially made, it's likely nobody at Sony noticed this.
- A large amount of these characters were never used, as the PlayStation 2 didn't get localised in many different languages. In particular, despite a Greek character set being fully encoded, a Greek translation was never officially made.
- Some of the 01.00/01.01-only characters were brought back in the last revision of BIOS 01.20 (ROM date 20001027) onward, but only for OSDSYS and a good amount overwritten by the extended characters.
- BIOS 01.10 and initial revisions of 01.20 (ROM date 20000902) crash if those characters are attempted to be put on-screen.
- Starting from 01.10 these blocks were repurposed for extended Greek, Cyrillic and Latin characters, which were taken and slightly rearranged from the EUC-JP encoding layout blocks 8FA2xx - 8FABxx.
- The Russian Cyrillic block 84xx and the Greek characters in block 83xx initially used a different font for BIOS 01.00 and 01.01, which didn't look very good. It was changed for OSDSYS starting from 01.10.
- Only OSDSYS received the updated font, meaning Memory Card icon.sys Cyrillic letters, would look the same as BIOS 01.00/01.01 in all revisions.
- The new font was also misaligned, causing the first 16 Cyrillic characters А - О and the 1st Greek character Α to become unavailable.
- The misalignment causing missing characters was fixed in BIOS 01.80 onward.
- The Hangul and Hanzi blocks, F0xx - F3xx, were introduced in BIOS 01.80 and were slightly revised in 02.00 with the release of Slim consoles.
(A decent amount of the Hanzi characters have duplicate Kanji counterparts found in the regular SJIS blocks 81xx - 98xx)- The Hangul character 됨 (F06E) was removed.
- The Hangul character 공 (F04B) was added.
- The Hangul character 았 (F0D8) was added.
- The Hanzi character 「 (F241) was removed and has a duplicate character in 8175.
- The Hanzi character 」 (F242) was removed and has a duplicate character in 8176.
- The Hanzi character 媒 (F2A4) was removed and has a duplicate character in 947D.
- The Hanzi character 於 (F2E6) was removed and has a duplicate character in 8997.
- The Hanzi character 址 (F289) was added.
A bunch of the "duplicate" Hanzi characters are drawn and rendered slightly differently due to differences in the stroke order between Hanzi and Kanji.
![]() |
![]() |
Difference between the BIOS 01.00/01.01/Memory Card and the OSDSYS Cyrillic and Greek character font for BIOS 01.10+.
![]() |
![]() |
![]() |
![]() |
The SCPH-50009 used a different font, similar to Times New Roman, for both Simplified Chinese and English UI languages. Said font was contained in the DVD player ROM for some reason.
Selectable Languages
In the history of the PS2, twelve languages were implemented - Japanese, English, French, Spanish, German, Italian, Dutch, Portuguese, Russian, Korean, Traditional Chinese, and Simplified Chinese.
However, not all languages are available on all models, with fat consoles having Japanese or the latter four languages only having one of them and English. The languages contained, aside from English which was available on all consoles, depended on the region number in the model number:
- 00 (Japan) - Japanese
- 05 (South Korea) - Korean. However, the SCPH-30005 R and SCPH-39005, while supporting Korean characters, did not have Korean as a selectable UI language.
- 06 (Hong Kong and Macau) and 07 (Taiwan) - Traditional Chinese. However, the SCPH-30006/7 R and SCPH-39006/7, while supporting Trad. Chinese characters, did not have Trad. Chinese as a selectable UI language.
- 08 (CIS and Ukraine) - Russian. However, the SCPH-39008, while supporting Russian characters, did not have Russian as a selectable UI language.
- 09 (Mainland China) - Simplified Chinese
All others included French, Spanish, German, Italian, Dutch and Portuguese. Slimline consoles - at least the developer kits - include all languages, although not all selectable at once.
Most languages (Chinese, Korean and Russian being exceptions) can be passed to running software, but most games allow this to be overridden in their settings.
Partially due to these limitations, few titles actually follow the console's settings (and when they do, they tend to allow overriding them in the game's options). In one case, Grand Theft Auto III uses the UI language being set to German or French to determine not only the game's default UI language (which can still be changed in the game's menu) but also the censorship, which will apply to all of the game's locales if the PS2 system language is German or French.
Hardware/Firmware
See also: PS2DevWiki for pictures and motherboard model numbers.
Note that these version numbers (referring to the entire boot ROM) are not directly visible in the "Version" screen: homebrew like PS2Ident is required.
"Chassis" refers to the official model family numbering (lettering?) system, which is printed as a lone uppercase letter in the bottom-right corner of the sticker followed by a four-letter manufacturer ID (except for C and earlier types). Together with the motherboard model (GH-*) they identify the exact internal design, and should be preferred to the unofficial and inaccurate V0 through V18 numbering system.
- SCPH-10xxx: Japanese launch model. Lacks many built-in modules present in later consoles, like HDD boot support (a CD bundled with these consoles includes an update installable to memory card to upgrade their ROM kernel in memory on every boot) and DVD-Video support (also installable from the same disc or newer); not the last console to leave the factory incomplete, either... ROM 1.00 or 1.01 (the "protokernel"). A chassis.
- SCPH-15xxx: Another Japanese model with ROM 1.01.
- SCPH-18xxx: First non-protokernel model. A transition model that, despite only taking PCMCIA hard drives, only supports booting from Expansion Bay drives without a system update. Made with A+ or AB chassis and ROM 1.20.
- SCPH-30xxx: First export model of PS2. Replaced PCMCIA slot with proprietary Expansion Bay, allowing for internally-fitting HDD. Most use ROM 1.20 and are C or D chassis.
- Exclusive to the B chassis (only used on early American 30001 models), there is a skew motor: if the "Diagnosis" option is enabled (which resets on every boot), the console will physically angle the optical drive head for optimum readability of the inserted disc. Otherwise equivalent to a C.
- SCPH-30xxxR: Revised model, F or rarely D chassis, ROM 1.60.
- SCPH-37000: Exclusive to Japan; very quickly replaced by 39000 with same motherboards. G chassis, ROM 1.60.
- SCPH-39xxx: Louder fan than previous and following models. ROM 1.60, G chassis.
- SCPH-5xxxx: Cost-reduced console without FireWire (used for early LAN games, not interchangeable with Ethernet) and cheaper build quality, but added internal infrared receiver (between power/eject buttons). New "Dragon" combined mechacon and syscon, restricting write access to EEPROM (to prevent serial number changing) and introducing a bug - known as the "Mechacon Crash" - associated with hard-to-read discs that can result in burnout of the focus/tracking coils (and if unlucky of the amplifier chip driving them). Ironically the first model officially supporting homemade CD-Audio and DVD-Video, as well being exploitable years later through MechaPwn. H, I, or J chassis, 1.70 or 1.90 ROM (1.80 seen on DEX variants).
- While not the first non-Japanese-built model, it is with the 5xxxx that the almost total majority of production moved to China, chiefly to Foxconn factories.
- SCPH-5xxxxN is not a separate model, but rather identifies a console bundled with a Network Adapter. Other two-letter suffixes identify color variants.
- The combination of this model being the first to be vulnerable to the "Mechachon Crash" and the first to support homemade media discs without a modchip or swap disc sparked speculation that this was an intentional change to "booby trap" consoles for people who used unlicensed discs.
- SCPH-70xxx: First Slim model. Fixed the Independence Exploit. Removed HDD boot support, but still has a full Network Adapter onboard, allowing for installation of an IDE port. Initial steps taken towards making a future ROM version the same the world over. K chassis with ROM 2.00.
- Only 70x1x models have a connector for an internal 56k modem. (Pictures)
- Different motherboards for either separate or combined CPU/GPU. Later units have a safety circuit as a hotfix for the mechacon problem (comparable to the unofficial "Matrix/PIC fix"), properly fixed in following models.
- SCPH-75xxx: Region locking made fully EEPROM controlled; new redesigned "Deckard" coprocessor with built-in Ethernet, HDD support completely removed, slightly inferior compatibility. L chassis with ROM 2.20.
- SCPH-77xxx: Another obscure model built on ROM 2.20; M chassis.
- SCPH-79xxx: Smallest motherboard. N chassis with ROM 2.20.
- SCPH-9xxxx: Superslim: internal power supply, "2-piece" top case with a less-striped front. P or R chassis with (often-but-not-always respectively) ROM 2.20 or 2.30.
- Later 9xxxx models have ROM 2.30, which removes support for updates from memory card (only officially used on significantly older models, and being reused at the time for Memento/FreeVast/FreeMCBoot).
- Bravia KDL-22PX300: a TV with a very questionably integrated PS2, with exclusive ROM 2.50. Only available in European regions.
- Chronologically located around the 5xxxx and 70xxx, a compendium of all PSX models would be disruptive to this list; all however are X chassis.
System Updates
To do: DVD Player versions. |
Most models of the PS2 can load (appropriately signed) updates from memory card and/or HDD: while today best known as the basis of FreeMCBoot and FreeHDBoot respectively, unlike the PS1 parallel port they did get some official uses:
- Actual kernel patches and DVD Player for protokernel systems.
- DVD Player updates (infamously removing inherently-Macrovision-free RGB output, adding some features, adding remote control support)
- All consoles with 2.30+ (at least) ROM have the newest DVD Player, 3.11.
- All consoles supporting updates from memory card can be updated to an unofficial patched version of 3.11; all consoles capable of running homebrew can also run a differently patched version from USB.
- A list of officially released updates is as follows:
- Japan: 1.00, 1.01, 2.01, 2.10, 2.12, 2.14, 2.16, 3.00, 3.04 (bundled with PSBBN 0.32)
- North America: 2.10, 2.12, 2.14, 3.02 (only bundled with the HDD Utility Disc 1.10)
- Europe: 2.10, 2.14 (dedicated discs)
- Australia/Oceania: 2.10, 2.14 (dedicated discs)
- China, Asia/HK, Russia, Mexico/South America: None
- HDDOSD (3 versions: 2 Japanese, 1 American), adds HDD support (save backup to/from Memory Card, displaying application partitions, deleting them, running them if applicable) and the MAC address to the "Version" screen, on which "Browser: 2.00" is also displayed.
- The early Japanese version passes to HDD-booted software the argument of their path in a different format, incompatible with some homebrews.
- PlayStation Broadband Navigator: a Japan-exclusive complete UI replacement, adding online "channels" (minisites), CD-Audio ripping, downloadable videos, limited support for USB (photo) cameras, e-mail features, and management of feega subscriptions. Despite being a NTSC-J disc, the installation discs will not boot on Asian or Korean PlayStation 2 models. Online services associated with the UI closed on March 31, 2016.
System updates are loaded from memory card from the path mc?/B?EXEC-SYSTEM/??????.elf
, where the variables are:
- 0 and 1: either port.
- One of I, A, E, or C depending on the region (Japan, Asia or America, Europe or Oceania, China).
osdsys.elf
on 1.00; the version number rounded up to the next x.x for most later versions (e.g.osd110.elf
for 1.01→"1.10",osd130.elf
for 1.20→1.30, ...);osdmain.elf
for 1.50 through 2.20;xosdmain.elf
for all PSXes; and none for 2.30 or 2.50.
DVD Player versions
In Japan, the J regional suffix was not used officially, but it is used here for the purpose of differentiation and clarity. Cheat discs like DVD Region X modify the DVD player by saving new settings (removing Macrovision and region coding) to a memory card file.
1.xx
- 1.00J - March 4, 2000
- Only available as an installation to memory card from Utility Disc 1.00 bundled with early SCPH-10000 consoles produced until March 25, 2000 (about 1.25 million units).
- Blocked on later SCPH-10000 and all SCPH-15000 and other consoles (see the Blacklisted discs section).
- Contains a specific button code (a development feature that was mistakenly left in) to bypass the DVD region code check (though it still needs to be 60 Hz video).
- Can output DVD video via RGB, which when combined with peripherals, was used to circumcise Macrovision in order to copy films to VHS.[1]
- 1.01J - April 1, 2000
- Available as an installation to memory card from Utility Disc 1.01 bundled with late SCPH-10000 and all SCPH-15000 consoles or as a free mail-in replacement for Utility Disc 1.00.
- Fixed some bugs (e.g. some audio skipping on optical output).
- Analog audio output level can be adjusted when optical output is disabled.
- Aspect ratio can be changed even during playback.
- The "secret" region-free button codes from 1.00 have been removed.
Security Implementation Overview
To do:
|
Copy Protection
The PS2, taking inspiration from its predecessor, primarily prevents access to foreign and/or non-original discs by rejecting them in hardware: the mechacon identifies discs as PS1 or PS2 CDs with or without Redbook audio tracks, PS2 DVDs, audio CDs, movie DVDs, or "other" on its own. The CD-ROM Backdoor trick can be used, but only for PS1 games and is only usable on PS2 systems up to model number SCPH-39xxx, due to subsequent models having a different mechacon.
- On most models, if a rudimentary login procedure (called "boot certification") is not done, no disc can be read at all. This attempts to obstruct the development of third-party ROMs and system updates.
- PS1 CDs still have to pass the PS1 wobble-based security system. Once authenticated, PS1 discs can be swapped with PS2 CDs or vice versa (this means a simple PS1 modchip can be fitted in a PS2 to run PS1, as well as PS2 CD backups when combined with homebrew access; typically, however, it is not possible to switch between PS1 or PS2 modes at runtime).
- "Other" discs are always rejected.
- DVD-Video discs are blocked by default (and after every reset by official firmware) until the mechacon successfully decrypts a KELF declaring itself to be a DVD Player.
- On regular consumer consoles, FreeMCBoot normally circumvents this by loading such a dummy KELF.
- Developer consoles, instead, are not licensed as DVD players and will refuse to load such a KELF.
- Developer consoles with DVD player support did exist, but were only used internally by Sony and did not see any other release.
- DVD-Video discs are also locked by whether they are NTSC or PAL. (This is also the reason why two Asian versions exist - the version for Hong Kong/Macau is PAL whereas the version for Taiwan is NTSC)
- DVD-Video discs discolour the screen to green on RGB cables without YPbPr input or when the console is plugged in via composite into a VCR as a form of copy protection. This is because the first version of the DVD player allowed RGB playback, which was exploited through the use of peripherals to copy films to VHS. Cheat discs patch this. The console also outputs traditional analogue Macrovision.
- Consoles with modchips may attempt to load unsupported discs such as VCDs as they identify them as valid PS2 game discs; this leads to an error where the beginning part of the Red Screen (before the texts appear) is looped.[2] This can also happen with discs in officially-supported formats should they be erroneously identified as PS2 game discs. Meanwhile, stock consoles will simply give a standard error message when attempting to read these unsupported discs.
Note that PlayStation discs exclusively use the ISO9660 filesystem. This is exploited by ESR, where PS2 DVD disc images have an UDF filesystem with the shortest possible DVD movie added, making them pass the mechacon's checks, and are then started by a homebrew running them with appropriately modified optical drive drivers.
Additionally, the official firmware verifies the logo (seen at the top of this page) embedded in PS2 discs after being encrypted with a key based on the titleID. This poses a significant challenge to manufacturers of unlicensed discs - who need to master them with part of the data track literally pasted over their own, with data from the American version of Crazy Taxi (SLUS-20202) being one of the most used ones because of being the CD-ROM PS2 game with the largest table of contents - but can be easily be bypassed by homebrew running the main executable without going through rom0:PS2LOGO. Since PAL and NTSC logos differ, this also acts as a supplementary region check, comparable to the one in 3000 and newer Japanese fat PS1s and European slim PS1s.
Developer consoles will also accept master discs, which feature a special header intended to be recordable with standard computer optical drives. Different models may or may not be region free with respect to original and master discs, culminating with the 75xxx and newer series, where the region can be changed by turning on the power while holding all L/R buttons.
It is clear from the above why PS2 modchips have to operate on both the mechacon (via the pins usually named with letters near the beginning of the alphabet) and the ROM (via the lower-lettered pins), and to generate the PS1 region string (via the "SX" pin) too. Their interaction with the BIOS (including memory-resident modules loaded from it and potentially replaced by disc software) also greatly complicates their design and compatibility, especially when builtin-OSDSYS alternatives (such as Free*Boot, HDDOSD, and PSBBN) are involved.
Blacklisted Discs
DVD Player version 1.00 - because it contained the ability to play NTSC discs from any region Macrovision-free - was blacklisted on all consoles except the very first version of the SCPH-10000. The disc itself is not blocked from booting but the KELF signature is blocked. This also happened to several unlicensed discs - particularly cheat discs such as Action Replay - which were blocked from booting in new console revisions via a blacklist contained in the mechacon, of the aforementioned discs' fingerprints (unique properties to the data, like a file hash) in the mechacon. Manufacturers of unlicensed discs attempted to circumvent this by releasing newer versions of the discs, which would subsequently be blacklisted again.
Memory Cards
Memory Cards are protected from access by unlicensed devices by the MagicGate login system (also having obstructed 3rd party Memory Cards); as implied above, any official executables stored on Memory Cards must also be protected by the tangentially related MagicGate signatures, which are linked to the card's serial number. Older unlicensed cards, such as those by Datel and InterAct, were bundled with discs (such as Memory Manager Plus) that needed to be inserted to activate the cards each time they were used.
Whereas some rudimentary exploits were already known (already allowing for Vast/Memento, later imitated by FreeVast and developed into FreeMCBoot), the high-profile exploitation of the PS3 (on which PS2 modes, the mechacon is always emulated in software) resulted in the leak of MagicGate keys and code, resulting in PC drivers for the PS3's USB Memory Card reader and the ability to sign FMCB for any memory card without a modded PS2. (This software, called PS3MCA, and especially its mecha_emu.c file implementing MagicGate, are to date occasionally subject to takedowns from Sony.)
Equivalently, unpatched Sony drivers will only accept Sony OEM hard drives, and hard disk executables are KELFs protected by DNAS encryption, which may or may not be tied at the developer's discretion to the DNAS ID of the system, but it is to the disk's (unverified claim). This does not apply to the disk's boot partition, which use a different system closer to MagicGate.
HDD partitions may have rudimentary password protection, which however must be enforced at the driver level.
Finally, while arguably not a deliberate change against unlicensed accessories, later models (75xxx onwards?) do not supply 7.5V to the memory card slots, preventing operation of older unlicensed memory cards with 5V flash chips.
Chinese edition
The SCPH-50009, made for Mainland China, contains additional protections due to widespread piracy in the country. It has its own dedicated game region, NTSC-C, rather than the NTSC-J region that is used on other East Asian PS2 consoles (Japan, Korea, Hong Kong and Taiwan). The region-exclusive additional ROM section, containing a Chinese character set, is required to boot most NTSC-C games due to software checks. CDVDMAN included in games for the region perform an additional check for a valid value in 0x1F402038 register. This model is also the only one known to utilize the CDVD S command 0x27 to launch PS1 games. This was eventually circumvented with a region-specific modchip, leading Sony to stop producing Chinese consoles.
- Pages missing developer references
- Games developed by Sony Computer Entertainment
- Pages missing publisher references
- Games published by Sony Computer Entertainment
- Pages missing date references
- Games released in 2000
- Games released in March
- Games released on March 4
- Games released in October
- Games released on October 26
- Games released in November
- Games released on November 24
- Games released in December
- Games released on December 2
- Games with hidden developer credits
- Games with hidden development-related text
- Games with unused graphics
- Games with revisional differences
- Games with anti-piracy methods
- Long pages to be condensed
- To do
- To investigate
- PlayStation 2 games
- BIOS/Firmware ROMs
Cleanup > Long pages to be condensed
Cleanup > Pages missing date references
Cleanup > Pages missing developer references
Cleanup > Pages missing publisher references
Cleanup > To do
Cleanup > To investigate
Games > BIOS/Firmware ROMs
Games > Games by content > Games with anti-piracy methods
Games > Games by content > Games with hidden developer credits
Games > Games by content > Games with hidden development-related text
Games > Games by content > Games with revisional differences
Games > Games by content > Games with unused graphics
Games > Games by developer > Games developed by Sony Corporation > Games developed by Sony Interactive Entertainment > Games developed by Sony Computer Entertainment
Games > Games by platform > PlayStation 2 games
Games > Games by publisher > Games published by Sony > Games published by Sony Interactive Entertainment > Games published by Sony Computer Entertainment
Games > Games by release date > Games released in 2000
Games > Games by release date > Games released in December
Games > Games by release date > Games released in December > Games released on December 2
Games > Games by release date > Games released in March
Games > Games by release date > Games released in March > Games released on March 4
Games > Games by release date > Games released in November
Games > Games by release date > Games released in November > Games released on November 24
Games > Games by release date > Games released in October
Games > Games by release date > Games released in October > Games released on October 26