Enthusiasts finally crack the original PlayStation 2 security chip
More than 25 years after the original PlayStation 2 launched, a group of enthusiasts has managed to extract the firmware from its SPC970 security chip, closing the last unexplored part of the console. The breakthrough could eventually support fuller emulation and new mod-chip hardware.
A developer known as DiscoStarslayer, working with a collaborator called Libby, has found a way to read out the code stored on the SPC970 "MechaCon" chip, the component responsible for authorizing discs and handling most security functions on the original, "fat" PlayStation 2.
Previous attempts spanned roughly four years and relied on physically stripping the chip's packaging, which only produced rough, incomplete readings. The new method exploits a software flaw: the chip is told that an incoming batch of configuration data will be empty, then sent more data than it can hold. This causes an internal counter to overflow, eventually tricking the chip into copying part of its own firmware into its rewritable EEPROM storage, from which it can be read back using a standard command. Producing a full 256KB firmware image requires repeating the process about 1,000 times, with the tool backing up and restoring the EEPROM each time to limit the risk of damaging the console.
Closing the last gap
All the data, along with 22 firmware images, has been published on GitHub. The images cover fat PS2 models from the Japan-only SCPH-15000 released in 2000 through to the 39000-series consoles from 2002, as well as the Namco System 246 and 256 arcade boards that used the same chip. These were the last unread parts of the PS2, after the later "Dragon" MechaCon chip used in newer consoles was dumped back in 2021.
Unlike that later chip, the SPC970 cannot be updated at all — its code has been permanently fixed since 2000 — meaning cracking it fully is expected to take longer than the one month it took researchers to break the updatable Dragon chip. The new firmware dumps open the door to eventually finding a way to unlock these early consoles at the chip level, something previously only possible through memory card and hard drive workarounds. Since PS2 games were never encrypted, the discovery doesn't unlock anything new for players immediately, but it could support more accurate emulation and new mod-chip hardware designs in the future.
