PS2 Exploit Allows Running of Unsigned Code

DrEldarion writes "This man has figured out a way to make the PS2 run unsigned code without a modchip. "To make a long story short, the exploit allows anyone with a memory card and a valid, legal PS1 disc to hijack the boot process and run any piece of code.""

Comments

You can't use it to run out-of-region/copied games

[Aero Leviathan]

Calm down! First of all, if I understand correctly, this exploit takes a valid PSX game, stops it from booting, then loads 'any piece of code' _right off the memory card_. It does not provide for any sort of disc swap. This means you can not use it to load any game which the PS2 would not normally load; you can only load an .elf (I think) file which is _on the memory card_.

Meaning this is only useful for _small_ homebrew apps.

Second of all, it is unlikely this will ever be expanded to allow loading out-of-region/copied games. Sony uses a special copy-protection trick... as far as I know it involves a tiny sector in the beginning of a disc which has a checksum of zero. Inside this sector there is the data containing region information (should be impossible to contain any data if the checksum is zero, but it does). CD burners 'correct' this sector by writing the actual checksum, and hence PSX/PS2 games cannot be copied correctly. When you insert any disc into a PSX or PS2, the unmodified hardware checks that sector to see if the checksum is zero and if the region code is correct, and refuses to read any further data, _no matter what_, if that sector isn't just right. A mod chip works by injecting the correct data into the CPU at the right time.

This means, even though you could use the exploit to read abritrary data off something other than the disc the console was going to read from, you can't read it from another disc: if you eject that valid disc and put in another, the PS2 is going to check that special sector. Unless I misunderstand something, this exploit _does not_ address that, and so you can only load code off a memory card. Maybe someone will come out with a way to load stuff off a hard drive with it, but it's unlikely you'll ever be able to load stuff off a different (invalid) disc.

I should also point out that the terms 'signed' and 'unsigned' are possibly incorrect for this sort of thing, as the copy protection isn't really in the form of an encrypted key, per se... just a crazy sector containing simple data, with a checksum of zero.

This is how it has been explained to me over the years by a variety of people and is AFAIK the generally accepted understanding of the Sony copy protection method. I have never worked for Sony so I cannot verify it. If you have any corrections here, feel free to speak up :)

Clarifications

[mrossbrown]

I don't typically read or post on /. these days, but since you folks were so kind as to saturate my cable connection :P, I read through the comments and wanted to clarify a few things:

• The hack does not enable or facilitate mass, rampant, or Carribean piracy of PS2 or PS1 software. The design of the PS2 thwarts software from patching the system so that the hardware copy/region protection fails.
• I am aware that Sony will be furious over this release. I myself know that legally, I have not broken the law. I used clean room reversing techniques to find the exploit, and Open Source software to develop it. Also, the exploit does not circumvent any security measures in the PS2, this should be obvious since you need a legal PS1 disc to perform the hack in the first place.
• Yeah, I interviewed for Sony and didn't get the job (it was for a position on SCEA's R&D team). Me getting turned down was not my motivation for releasing ps2id. The Sony folks that I've dealt with are very cool, they've always treated me with respect (their office in Foster City, CA is amazing too :P). I hope that SCE* continues to produce consoles as fun to hack as the PS2.
• My primary motivation was in getting this in people's hands was so that the barriers that prevent all PS2 owners from experiencing what I experience (when I develop homebrew PS2 software, or use it) would be removed. My ulterior motive (heh, there is always one, isn't there?) was to try and land other console hacking jobs professionally.
• Yeah, the initial release was very rushed, but some wily hacker came up with the mantra Release Early, Release Often :P. A couple of people have already submitted tutorials and save files for other memcard adapters, and a ton of people have offered to mirror the site. Testament to the power of Open Source, blah, blah, blah... :P. I will be updating the site within the next few days with all of this, and working on the next ps2id release.
• Overall, I'd like to see all kind of fun apps come from this that average, gaming PS2 owners can use, not just hackers.

Oh, about all the Linux posts: I've been developing a way to get ps2linux to boot without Sony's kit, and it will all tie into this. No ETA on that yet.

Cheers to all who've stepped up with the positive posts.