Editing MechaCon
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
MechaCon is short for Mechanics Controller. | MechaCon is short for Mechanics Controller. This chip is the security ic of the PlayStation 2 that implements game disk security, Magic Gate and KELF file decryption. | ||
There are two known main variants of it. | There are two known main variants of it. | ||
The earlier one is based on | The earlier one is based on SPC 9700 and used till GH-016. | ||
The newer one is ARM | The newer one is ARM based, codenamed "Dragon". | ||
The | The chip includes an 512 word eeprom. The content is different between the two main reversions. | ||
= SCP = | |||
TODO | |||
Dragon | = Dragon = | ||
== EEPROM layout == | |||
{| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;" | |||
== | |||
|- bgcolor="#cccccc" | |- bgcolor="#cccccc" | ||
!Start (word)!!End (word)!!Size (byte) | ! Start (word) !! End (word) !! Size (byte) !! Description | ||
|- | |- | ||
| | | 0 || 48 || 96 || | ||
|- | |- | ||
| | | 48 || 90 || 84 || | ||
|- | |- | ||
| | | 96 || 128 || 64 || | ||
|- | |- | ||
| | | 128 || 150 || 44 || | ||
|- | |- | ||
| 160 || 190 || 60 || | |||
| | |||
| | |||
|- | |- | ||
| | | 192 || 198 || 12 || Region params | ||
|- | |- | ||
| | | 204 || 208 || 8 || MAC address | ||
|- | |- | ||
| | | 211 || 216 || 10 || wake up time | ||
|- | |- | ||
| | | 216 || 225 || 18 || model number | ||
|- | |- | ||
| 227 || 232 || 10 || Region code key seed | |||
| | |||
| | |||
|- | |- | ||
| | | 232 || 237 || 10 || Region code ciphertext | ||
|- | |- | ||
| | | 240 || 245 || 10 || iLink id | ||
|- | |- | ||
| | | 245 || 248 || 6 || (used by scmd 3, subcmd 48 and 49) | ||
|- | |- | ||
| | | 248 || 253 || 10 || Console id | ||
|- | |- | ||
| 253 || 256 || 6 || (used by scmd 3, subcmd 48 and 49) | |||
| | |||
| | |||
|- | |- | ||
| | | 256 || 312 || 112 || config 2 | ||
|- | |- | ||
| | | 312 || 344 || 64 || config 0 | ||
|- | |- | ||
| | | 344 || 400 || 112 || config 1 | ||
|- | |- | ||
| | | 400 || 512 || 224 || Rom patches ciphertext | ||
|- | |- | ||
|} | |} | ||
== Region code == | |||
=== Decryption === | |||
<pre> | <pre> | ||
Line 363: | Line 95: | ||
return *(uint32_t *) plaintext; | return *(uint32_t *) plaintext; | ||
retrun 0; | |||
} | } | ||
</pre> | </pre> | ||
=== Bits === | |||
{| | {| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;" | ||
|- bgcolor="#cccccc" | |- bgcolor="#cccccc" | ||
! Bit!!Description | ! Bit !! Description | ||
|- | |- | ||
| 1 || Japan | |||
|- | |- | ||
| | | 2 || USA | ||
|- | |- | ||
| | | 3 || Europe | ||
|- | |- | ||
| | | 4 || Oceania | ||
|- | |- | ||
| | | 5 || Asia | ||
|- | |- | ||
| | | 6 || Russia | ||
|- | |- | ||
| | | 7 || China | ||
|- | |- | ||
| | | 8 || Mexico | ||
|- | |- | ||
| | | 17 || Development (changes KELF keys) | ||
|- | |- | ||
| | | 18 || Retail KELF keys on Development | ||
|- | |- | ||
| | | 19 || Arcade (changes KELF keys) | ||
|- | |- | ||
| | | 20 || Prototype? (changes KELF keys) | ||
|- | |- | ||
| | | 21 || ? (dvd related) | ||
|- | |- | ||
|} | |} | ||
== Rom patch == | |||
=== Decryption === | |||
<pre> | <pre> | ||
Line 615: | Line 176: | ||
</pre> | </pre> | ||
=== Content === | |||
The patch can contain up to 4 patches. | The patch can contain up to 4 patches. | ||
Line 627: | Line 188: | ||
payload = Arbitrary, could be code or data as well. | payload = Arbitrary, could be code or data as well. | ||
{| | {| border="1" cellspacing="0" cellpadding="5" border="#999" class="wikitable" style="border:1px solid #999; border-collapse: collapse;" | ||
|- bgcolor="#cccccc" | |- bgcolor="#cccccc" | ||
! Offset!!Size!! Name | ! Offset !! Size !! Name | ||
|- | |- | ||
|0x00||0x04|| address0 | | 0x00 || 0x04 || address0 | ||
|- | |- | ||
|0x04 || 0x04||address1 | | 0x04 || 0x04 || address1 | ||
|- | |- | ||
|0x08||0x04||address2 | | 0x08 || 0x04 || address2 | ||
|- | |- | ||
|0x0C||0x04||address3 | | 0x0C || 0x04 || address3 | ||
|- | |- | ||
|0x10||0x04 ||value0 | | 0x10 || 0x04 || value0 | ||
|- | |- | ||
|0x14||0x04||value1 | | 0x14 || 0x04 || value1 | ||
|- | |- | ||
|0x18|| 0x04||value2 | | 0x18 || 0x04 || value2 | ||
|- | |- | ||
| 0x1C||0x04||value3 | | 0x1C || 0x04 || value3 | ||
|- | |- | ||
|0x20||0x04||svc_address0 | | 0x20 || 0x04 || svc_address0 | ||
|- | |- | ||
| 0x24|| 0x04||svc_address1 | | 0x24 || 0x04 || svc_address1 | ||
|- | |- | ||
|0x28||0x04||svc_address2 | | 0x28 || 0x04 || svc_address2 | ||
|- | |- | ||
|0x2C||0x04 ||svc_address3 | | 0x2C || 0x04 || svc_address3 | ||
|- | |- | ||
| 0x30 ||0xA8||payload | | 0x30 || 0xA8 || payload | ||
|- | |- | ||
|0xD8|| 0x04||crc | | 0xD8 || 0x04 || crc | ||
|- | |- | ||
|} | |} |