Julian Uy uyjulian

Info relating to PS2 SPC970 MechaCon dumps

Related to https://x.com/DiscoStarslayer/status/2099132300390744320

I an involved in reverse enginnering the PlayStation 2's MechaCon. See https://www.psdevwiki.com/ps2/MechaCon

I see a lot of mis-information regarding the news regarding the dumping of the SPC970 MechaCon. Here are some notes:

It is already possible to run backup/copied discs entirely using software methods (from memory card, HDD, or DVD video player exploit), and in the case of the 50k series and newer (Dragon MechaCon), can use the "force unlock" patch that does not require any patches to copied discs.
Most interesting information has been extracted from the PS3 PS2 emulator (ps2_emu) and the Dragon MechaCon already.

Android Stagefright/libstagefright OpenMAX IL library usage

Information based on commit 103f9d584ba053bce9bf9726de63f8469c5a74e2 from https://android.googlesource.com/platform/frameworks/av before removal

aacdec: https://github.com/mstorsjo/fdk-aac
aacenc: https://github.com/mstorsjo/fdk-aac
amrnb: https://android.googlesource.com/platform/frameworks/av/+/refs/heads/main/media/module/codecs/amrnb/
amrwbenc: https://android.googlesource.com/platform/frameworks/av/+/refs/heads/main/media/module/codecs/amrwb/
avcdec (H.264, MPEG-4 Part 10): https://github.com/ittiam-systems/libavc
avcenc (H.264, MPEG-4 Part 10): https://github.com/ittiam-systems/libavc

DivX Ultra related info

Keywords

DivX Media Format (DMF)
DivX 6
DivX Ultra
DivX Ultra Certified
DX50
XSUB

Making XOSD 2.11 (PSX2) work in more cases

PSX2 DVRP firmware allows ATA access above 28bit limit, and XOSD from 2.11 uses this to access the filesystem.
The atad module stores the 28-bit and 48-bit sizes from the ATA IDENTIFY data separately, and the apa/hdd module uses this information to determine where bhdd0: should start searching for __extend and __xcontents partitions.
The 28-bit offset can also be retrieved using HDIOC_GETMAXLBA48 / (0x683B) devctl on dvr_hdd0:.

If the __xcontents partition cannot be found, the system will remain on a black screen, bootloop (the HDD access LED will blink periodically), and the following will be output over EE debug:

The HDD could not be started.
I have not added support for auto-formatting the HDD yet.

Notes on OpenMAX Development Layer

(aka OMX DL)

omxACMP3 - N/A
omxACAAC - N/A
omxIPBM - N/A
omxIPPP - N/A
omxIPCS - VLC, mediastreamer2
omxICJP - libjpeg-kinoma-openmax

DVRP DVR-SPEED workaround for HDD authentication

Usually, DVR-SPEED does not allow DMA commands (e.g. DMA read/write) until the 0x8e command is received.
However, the ATA state machine in DVR-SPEED does not reset or take into account primary/secondary device selection when receiving results after setting ATA command register.
The following is done:

Set 0xe8 command to primary (write buffer)
Write wanted ID (or null bytes) to device
Set 0xe4 command to primary (read buffer)
Set 0x8e command to secondary (sce auth)

FC1307A pin description

Numbers and names from https://archive.org/download/sd2ide_fc1307a_fw/FC1307_TFx2_TO_CF_V1.0_schematic.pdf.zip
Descriptions from https://www.alldatasheet.com/datasheet-pdf/download/1132338/ETC2/FC1306T.html

Pin	IC	PCB	Description
1	GND	GND
2	RESET	RESET	Chip Reset. (Schmidt)

FC1307A notes for SCE security

The firmware, stored in the SPI flash connected to FC1307A, is 8051 architecture.
It is unencrypted and unsigned, with checksums.

When loading the firmware in Ghidra as a raw 8051 binary, truncate the flash to 0x10000 bytes.

In firmware 3.72 of the FC1307A, the ATA command dispatch table is at 0x9482, laid out as the following:

	#!/usr/bin/env python3
	# SPDX-License-Identifier: MIT

	# This program does the following equivalents on offline IOP memory dumps:
	# thmon thlist
	# dsidb mlist, memlist

	import sys

	a = None


	NOTE: will remain unfinished

	XHA-001

	40 pin ide opposite /// x pin to top lid