Researchers extract firmware from early PlayStation 2 security chip
The 256KB dump opens a path to studying early PS2 security and emulation, but delivers no immediate console unlock.
Researchers have extracted the firmware from Sony’s SPC970 MechaCon, a security chip used in early PlayStation 2 consoles to authorise discs and handle other security functions. The release includes a dumper tool and 22 firmware images covering early PS2 models and Namco System 246 and 256 arcade boards.
DiscoStarslayer and collaborators, including Libby, used a flaw in the chip’s EEPROM write process to copy its fixed mask ROM code into EEPROM, then read it back. The chip stores only configuration and calibration data in that EEPROM; the full firmware image is 256KB.
The SPC970 was among the last unread components of early PS2 hardware after firmware from the newer Dragon MechaCon was dumped in 2021. The new images could help researchers investigate a chip-level unlock for older consoles and improve low-level emulation, but neither outcome is assured.
The dump does not immediately enable new capabilities, and the firmware alone is not enough to build an optical drive emulator. Early PS2s can already run backup discs through memory-card and hard-drive exploits, but MechaPwn’s chip-level unlock does not support these older models.
The dumper performs about 1,000 EEPROM rewrites to capture the firmware. Its developers warn that repeated writes can wear out the chip’s limited-write memory and may leave a console unable to operate normally or requiring hardware repair.
