PlayStation 2: Are There Any Hardware Mysteries Left?

These days, there's nothing you CAN'T do with a PS2. From a end-user standpoint, the system has been cracked six-ways to Sunday. But my question is are there still mysteries or details about the hardware that remain a mystery? Is there any element of the system or protection schemes that remain uncracked?

I'm mainly asking out of curiosity.

 

Uncracked or unknown?

Even with very stable and mature systems, there are still undocumented hardware "features" that come to light decades later. I'm sure the low-level libs and BIOS equivalent still have some interesting things that nobody has bothered to document.

 

FMCB still doesn't work on the last batch of Slim PS2s.

 

Nor with the SONY TV with PS2 built-in KDL-22PX300 (useless information :] ).

 

Not really a secret, SCE just removed the ability to have an update on the MC since it was pointless as they never used it.

 

There's still so much to know. Given that most of the parts are proprietary. Take the MECHACON for example; MagicGate was cracked because of the PS3 leaks... but nobody knows the inside-outs of the MECHACON because it is a proprietary SONY device that doesn't have its firmware dumped.
The later models seem to be physically identical across all regions (meaning that the region setting is likely in software), but it is not known whether it can be changed.

There's also that RS232C interface that is used for adjusting the optical drive. But because the leaked service tools only support up to the I-chassis SCPH-50000, the later models cannot be properly adjusted. This also means that nobody knows how the adjustement is done for all models.

The IOP is known to be a custom MIPS R3000A in older consoles, but they seemed to have changed it in the SCPH-75000 to be a PPC device.
It's also the SSBUSC (SS-BUS Controller), which controls access to all peripherals in the PS2. But I haven't seen anyone build a HDPro clone that actually interfaces with the unused PIO interface.

They used it for the SCPH-10000, SCPH-15000 and SCPH-18000.
On the other hand, the DVD Player updates were available in various regions, with the last version being v3.04.

They might have removed the feature because they no longer planned to release further updates. They also removed the expansion connector on the mainboards around that time too.

 

The muddy video output needs an explanation and I still haven't had one.
Or why there's a bios for PS1 specifically made for the PS2 (which handles emulation but why was a new PS1 bios needed?)
I'd also take a shot in the dark and ask what the prolonged effects of running in 1080i mode could have on the system.

PSX systems and the one integrated on the TV that one time are also interesting as they probably have some specific issues as well that main PS2 systems dont have (aside from the time bomb hard drives because they're just bad)

Alternatively why they needed so many non-retail models - and this isn't even up to date

 

Not to mention that some of these video issues seem to vary between models.

The hardware is not exactly a PlayStation's.

But one thing that I would ask, would be what PSNET was for. A TOOL has DECI1, DECI1DRP and DECI1DR1 modules, which seem to be for an interface to a DTL-H1500 for the EE-side.
PlayStation development was never done on a TOOL, so these modules probably belong to some disused system.

Given that the PS2 was designed for it, I don't think that anything bad would happen.
I would ask what would happen, if one was to push the pixel clock further... to get the hardware to output 1080P instead.

The DVRP! Someone needs to take a crack at that lol.

Not to mention that the software is very different, possibly because it was made by SONY and not SCE.

In general, so many models, even more chassis models and even-even more mainboard revisions.

The many models of the DEX seemed to be due to SCE not having complete specifications for the DEX. Or perhaps they changed their minds a few times...

 

I should learn to keep my mouth shut

 

And there is still alive PS2Ident project. Everyone can update it with submitting data.

 

Please don't. Even with redundant information sometimes people who don't know about something get to learn or such a statement could cause someone to brainstorm/ have a bright idea.

 

In the PS1, the CPU was a soft core. It mostly resembles the CW33300 from the LSI CoreWare library. It runs R3000 code, but it's not an R3000A in any meaningful sense. It appears that Sony wrote the HDL for the GTE, MDEC was based on LSI's JPEG decoder (possibly CW702), with different decompression and some other changes. The memory card and serial port HDL may be off the shelf, as they appear as cut down off the shelf UARTS (I forget which, but I assume they had been implemented in CoreWare).

I kinda expected the original PS2 IOP to be based off the same process, but I don't know that for sure. We could probably guess if one was decapped. When it came to the SCPH-75000 then they it may be that the cost reduction of the rest of the system required them to use an emulator, or they may have wanted to ditch LSI (I don't know if you can take a CoreWare project to another fab, as they essentially supply the library to lock you in).

Obviously the HDL source would be awesome to get hold of, especially for the people trying to "decompile" it from the decap. I tracked down one of the engineers that worked on it, but I haven't tried contacting him yet. I would doubt he'd kept a copy, or would be willing to share it though.

 

SCPH-75000 came to be around the time they were finalizing the baseline for the PS3 software design so it's possible they choose a Power PC chip to achieve two things at once: (kill two birds with one stone?)

Test the IOP and related subsystems emulation on field and ditch LSI LOGIC lock-in. That also had the side effect of deleting completely the ATA port on the PS2 motherboard making it really impossible to fit a IDE HDD on slim PS2s.

 

I don't think the ins and outs of 'ps1 mode' are well known. As someone who uses opl for ps2 games it would be amazing to unlock native ps1 capability to run isos from hdd instead of having to use emulators or physical backup media.

 

They were both in development at the same time as the PS3 was announced before the SCPH-75000 was released, however they were still fixing bugs in the PS3's PS1 emulations about a year after the SCPH-75000 launch (I visited them). The same issues may have affected the PS2.

According to the Sony engineers I spoke to the PS1 emulator for the PS3 was based off connectix virtual game station (they bought it years earlier to shut them down) and was still runnable on windows. If true then the cpu choice is largely irrelevant.

However Ken did love PowerPC though. So much that he approached IBM with the idea of a cpu that would end up in the PS3 and Xbox 360. It wasn't a great CPU, Microsoft deserved what they got.

I finally got round to ordering one of these

http://www.maxdiypower.com/index.php?main_page=product_info&cPath=20&products_id=80

Pity I have an SCPH-77xxx. Second hand SCPH-70xxx seem expensive.

If you can get your own code running on the PPC then that should definitely be possible. Earlier PS2's may be possible but is more likely to have compatibility issues. Red book audio is unlikely to be possible though. A PS3 running REBUG is probably your best bet.

 

Hacked PS3s do that for years, now. lol

"Recently" the same has been achieved for PS2 titles on BC PS3 units by modifying the PS2 emulator to mount isos instead of using the real discs, while still having the possibility of running real discs on consoles with backward compatibility... While non BC units can also do that they do it through the re-purposing of the PS2 full software emulator.

The full software PS2 emulator does not support the disc drive because it is meant to only run NPDRM content (stuff downloaded from PSN store).

 

If the mechacon happens to have functionality to spit out its firmware (led to N64 CIC firmware being dumped, and the recent Saturn developments), there could be potential backdoors. We'll never know without a dump or decap.

The inner-workings of the memory card's magic gate functionality hasn't been publicly documented, but counterfeit cards manage to "almost" do it in a dirty way that TEST consoles reject iirc. I hope someday we'll be able to create new COH cards based on any findings, or maybe create a memory card that writes its contents to an SD card.

I think the OSD has already been poked and prodded for vulnerabilities, but there could still be some potentially.

 

I think I have seen bootleg cards which actually work on TEST units. But most don't.

 

Any chance you can upload at least a pic of the cover of each of those documents? Or maybe their "item" number (ie. DTL-#####) if any?
Also, how many pages are they?
Thanks