Memory Card

Overview

The main console storage device for user data. It is used to store game saves, DVD Player updates, gameplay history records and more on the system.

Normal memory cards from Sony, labeled as SCPH-10020, come in different colors and store 8MB. Officially licensed memory cards from Katana can store up to 16MB and 32MB; these memory cards store up to 8MB on each page. Unlicensed cards with different capacities also exist.

Official cards are capable of using both the developer and retail MagicGate keys. By default they use the developer keys, until they receive the 0xF7 card command, which issues a card key change on the card controller.

The SECRMAN driver from DTL-H models does not issue this command, allowing retail cards to work on them. Arcade and developer cards are coded to completely ignore the 0xF7 command.

Hardware

There are several variants of memory card (functionality wise)

TDB StartUp Card

A special memory card reserved exclusively for executing some basic debugger on DTL-H models. more information can be found on it's own dedicated article: TDB Start-up Card It uses the developer MagicGate keys. wich makes it's contents inacessible from non developer hardware

Arcade Memory Card COH-H10020

Used by Namco System 246/256 as security dongles. these cards served as Storage for arcade games executables, as well as IRX drivers, IOPRP images and similar files. being plugged to the slot 1 exclusively

These cards are also needed to keep those systems working. (system shutdowns if dongle is not authenthicated in a span of 5 mins)

Soul Calibur 2 Campaign Card

A normal memory card that seems to use a custom memory card filesystem paired with special encryption that ties it to the soul calibur security dongle it came with. it is still unknown how to bypass this.

• It uses a different ECC data format than normal cards
• Sectors are encrypted using the per card seed/key from it's security dongle.
• It uses the retail magicgate keystore because the Namco system 246/256 only auths retail cards on slot 2

The units destined to america had an additional sticker warning about card corruption/data loss if plugged to a retail ps2

Development TOOL Memory Card

It is unknown if it had any special purpose/functionality.

It most likely uses the developer magicgate keystore, to avoid filesystem access on non developer hardware

File System

The PS2 memory card file system has a fairly simple design, with some allowances made for the limitations of flash memory. It's overall structure is similar to the well known MS-DOS FAT file system. It uses a file allocation table (FAT) to keep track of allocated space and a hierarchical directory system where all of a file's metadata is stored in its directory entry. Like the FAT file system, which groups disk sectors into clusters, the PS2 memory card file system groups flash memory pages in to clusters. On standard PS2 memory cards, the cluster size 1024 bytes, or 2 pages long.

• The Superblock

The key to the PS2 memory card file system is the superblock. Located in the first page of the memory, this is the only part of the file system with a fixed location. While some things like the do end up in fixed locations on standard 8M memory cards, you shouldn't rely on this.

Block Nº	Cluster Nº	Page Nº	Offset	Length	Name	Example	Description
0 superblock	0	0	0x000000	0x01C (28 bytes)	magic	Sony PS2 Memory Card Format	Memory Card identifyer
			0x00001C	0x00C (12 bytes)	version	1.2.0.0	Memory Card format version. (1.2.0.0 = full support for bad_block_table map)
			0x000028	0x002 (2 bytes)	page_len	512	Page size in bytes (without ECC)
			0x00002A	0x002 (2 bytes)	pages_per_cluster	2	Number of pages in a cluster
			0x00002C	0x002 (2 bytes)	pages_per_block	16	Number of pages in an block
			0x00002E	0x002 (2 bytes)	not used	FF00
			0x000030	0x004 (4 bytes)	clusters_total	8192	Total number of clusters
			0x000034	0x004 (4 bytes)	alloc_start	41	First allocatable cluster number. Cluster values in the FAT and directory entries are relative to this
			0x000038	0x004 (4 bytes)	alloc_end	8135	Cluster offset number after the highest allocatable cluster. Relative to alloc_start. Not used.
			0x00003C	0x004 (4 bytes)	cluster_rootdir	0	Cluster offset of the first cluster of the root directory. Relative to alloc_start. Must be zero.
			0x000040	0x004 (4 bytes)	bblock1	1023	Backup1 block number
			0x000044	0x004 (4 bytes)	bblock2	1022	Backup2 block number
			0x000050	0x080 (128 bytes)	ind_fat_table	8	Indirect FAT Table cluster number
			0x0000D0	0x080 (128 bytes)	bad_block_table	-1	Bad blocks table (damaged blocks index)
			0x000150	0x001 (1 byte)	card_type	2	Memory card type (2 = PS2 memory card)
			000x0151	0x001 (1 byte)	card_flags	0x52	Memory Card features (0x01 = ECC support, 0x08 = Bad Block support, 0x10 = Erased state zeroed)
			0x000152	0x002 (2 byte)	not used	FF
			0x000154	0x0BC (188 bytes)	unknown
			0x000200	0x010 (16 bytes)	ECC		Error Correction Code. The last 16 bytes of all the pages are reserved for this code. See explain below
		1			not used
	Up to 7	Up to 15			not used
1	8 ind_fat_table	16	0x002100	0x210 (528 bytes)	Indirect FAT Table		FAT File System
		17
	9	18	0x002520	0x210 (528 bytes)	FAT Table
		19
	Up to 15	Up to 31
Up to 4
5	40	80
		81
	41 alloc_start cluster_rootdir	82	0x00A920	0x210 (528 bytes)	Allocatable Clusters
		83
	Up to 47	Up to 95
Up to 1004
1005	8040	16080
		16081
	8041	16082	0x819120	0x210 (528 bytes)	Reserved Clusters
		16083
	Up to 8047	Up to 16095
Up to 1021
1022 bblock2	8176 alloc_end	16352	0x83BE00	0x210 (528 bytes)	Temporal Data		Backup Block 2 Used to store the number of the block that is going to be programmed
		16353
	Up to 8183	Up to 16367
1023 bblock1	8184	16368	0x83DF00	0x210 (528 bytes)	Temporal Data		Backup Block 1 Used to store a copy of the data that is going to be programmed to a block
		16369
	Up to 8191 clusters_total	Up to 16383

A standard Ps2 Memory Card is composed by 1024 blocks, each block contains 16 pages of 528 bytes, for a total of 528*16*1024=8.650.752 bytes (0x840000)

Total ECC data is 16*16*1024=262.144 bytes

This gives an available space to store data of: Total-ECC = 8650752-262144 = 8388608 bytes = 8mb

• Backup Blocks

Two complete blocks are reserved to deal with the possibility of the memory card being removed by the user when data is being saved. Writing data to card requires erasing and reprogramming an entire block

Before writing a block, both bblock1 and bblock2 are erased. Then a copy of the new data that is going to be written is stored in bblock1, and the number of the block that is going to be written is stored in bblock2. The block being programmed is then erased and writed. Finally, bblock2 is erased

Recovery caused by removal of the memory card is implemented whenever a memory card is inserted into the PS2 by checking bblock2, if it's not erased, then programming is assumed to have not been completed. The contents of bblock1 are then copied to the block given in bblock2. Then bblock2 is erased

• Error Correction Code (ECC)

The data area of each page (512 bytes) is divided into 128 byte long chunks and for each chunk a simple [20-bit Hamming code] is calculated and stored in three bytes

The first byte contains the column (or bit-wise) parity bits, with the even groups in the lower nibble and the odd groups in the upper nibble. The second and third bytes contain the even and odd groups respectively for the line (or byte-wise) parity bits

The 3 ECC bytes for each of the 4 chunks are stored in order in the page's spare area for a total of 12 bytes

Source: [PlayStation 2 Memory Card File System - By Ross Ridge]