PS2 SPC970 Firmware Dumped After 25 Years

A quarter-century after Sony launched the original PlayStation 2, security researchers have extracted the firmware from the console’s earliest disc-authentication chip, closing one of the last major gaps in the hardware’s reverse-engineering history.

Developer DiscoStarslayer published 22 firmware images to GitHub covering the SPC970 MechaCon, the custom silicon that governed disc verification and copy protection on fat PS2 models manufactured between 2000 and 2002. The release spans Japan-exclusive launch hardware like the SCPH-15000 through the 39000-series revisions, as well as Namco System 246 and 256 arcade boards built on the same architecture.

The extraction required bypassing a fundamental hardware constraint. Unlike later console security chips, the SPC970 stores its operating code in mask ROM — memory physically etched during semiconductor fabrication that cannot be rewritten or patched by software updates. The only writable storage on the chip is a 1KB EEPROM reserved for calibration and configuration data.

To read the immutable ROM, a collaborator identified as Libby engineered a buffer overflow exploit targeting that tiny EEPROM write process. By initiating a configuration session with a declared block count of zero, the chip’s internal counter underflows. Feeding more data than the seven-block buffer can absorb overwrites adjacent RAM holding the EEPROM write task. Manipulating the task’s source address redirects it toward the mask ROM, forcing the MechaCon to copy 256 bytes of its own firmware into the readable EEPROM.

Reconstructing the full 256KB image requires repeating this sequence roughly 1,000 times via USB. Because the EEPROM lacks the wear-leveling controllers found in modern flash storage, each pass permanently degrades the memory cells. The open-source dumper tool mitigates this by backing up the EEPROM before execution and restoring it word-by-word afterward, verifying integrity against the chip’s power-on checksum routine. Even with these safeguards, the documentation warns the process carries a risk of bricking the console or requiring hardware-level repair.

This breakthrough ends a four-year effort by the enthusiast group spc970-dumper-union, which previously relied on physically decapping the silicon and reading its contents under microscopy — a destructive technique that yielded only partial, corrupted data.

The availability of the SPC970 firmware fundamentally alters what is possible for early PS2 hardware modification. In 2021, researchers dumped the “Dragon” MechaCon used in slim and late-model fat consoles, leading directly to MechaPwn, an exploit that disabled region locking and allowed backup discs to run natively. However, MechaPwn’s developers explicitly excluded roughly 20 early model numbers because they lacked the underlying SPC970 code. While those launch consoles could already run unsigned software through memory card exploits like FreeMcBoot or hard drive loaders, true chip-level optical unlocking remained impossible without understanding the authentication logic.

Cracking the SPC970 will not follow the rapid timeline of the Dragon exploit. Sony designed the later MechaCon to accept field firmware updates, providing researchers with an update mechanism to attack. They broke it within a month. The SPC970 has no update pathway; its logic was finalized at the factory in 2000. Finding a vulnerability now requires analyzing static assembly rather than intercepting a patch process.

Beyond console modification, the dump accelerates low-level emulation accuracy. Current emulators such as PCSX2 do not execute MechaCon code. Instead, they simulate its responses using C++ re-implementations, substituting the real hardware’s cryptographic behavior with a 1KB NVRAM file and a four-byte version number. This approach works for running games but fails when software inspects console identity or relies on Sony’s MagicGate encryption, which secures memory cards and KELF executable boot files.

DiscoStarslayer maintains Reliquary, a PCSX2 fork specifically targeting authenticated system paths, noting in its documentation that generated stand-in data cannot satisfy hardware-level security checks. Contributor uyjulian stated that the newly available firmware images will eventually feed full-system low-level emulation efforts capable of replicating the actual silicon behavior rather than approximating it.

The 22 firmware dumps are currently available in the spc970-dumper-union repository on GitHub.