How Does PS2 Copy Protection Work?

Discussion in 'General Gaming' started by sharopolis, Jan 27, 2019.

  1. sharopolis

    sharopolis Member

    Joined:
    Apr 12, 2007
    Messages:
    6
    Likes Received:
    2
    There's quite a lot of info online about the original PlayStation copy protection and 'wobble' in the pregap, but I'm struggling to find anything definitive about the PS2. How did it detect burned discs and how did mod chips get around the protection?

    All I can find is a lot of wild speculation in ancient forum posts, nothing that really explains it. The best I can come up with is this single sentence on this Wikipedia page.

    "A map file that contains all of the exact positions and file size info of the disc is stored at a position that is beyond the file limit. The game calls this place directly so that burned copy with no data beyond file limit cannot be played."

    Is that correct? Can anyone expand on that?
     
    DSwizzy145 and LuizNai like this.
  2. Mord.Fustang

    Mord.Fustang Fiery Member

    Joined:
    Feb 17, 2013
    Messages:
    802
    Likes Received:
    180
    I'd love to hear the answer too.
     
    sharopolis likes this.
  3. PixelButts

    PixelButts Site Soldier

    Joined:
    Aug 19, 2014
    Messages:
    2,587
    Likes Received:
    1,753
    @sp193 mind sharing with us how it works
     
    Keiji Dragon likes this.
  4. HI_Ricky

    HI_Ricky Enthusiastic Member

    Joined:
    Jun 7, 2007
    Messages:
    531
    Likes Received:
    132
    PS1 : read disc info ring ->toc -> load game
    PS2 :read disc info ring ->toc -> read disc info ring -> toc-> load game

    first ps2 chip is work by timing ~
    1 read real disc info ring,-eject disc
    2 put copy disc read toc -eject disc
    3 read real disc info ring-eject disc
    4 put copy disc read toc - > load game

    there is very clean how it work :)
    you can try open ps2 on fly swap disc by hand with out any chip install :)
     
    Last edited: Jan 28, 2019
    sharopolis likes this.
  5. sharopolis

    sharopolis Member

    Joined:
    Apr 12, 2007
    Messages:
    6
    Likes Received:
    2
    What's the disc info ring? Is it the same kind of wobble groove that's on the PSX?
     
  6. MottZilla

    MottZilla Champion of the Forum

    Joined:
    Feb 1, 2006
    Messages:
    5,062
    Likes Received:
    102
    Pretty sure that is false and comes from the issues related to converting DVD games to CD which sometimes had issues because the game would access data at a particular LBA on the disc as opposed to looking at the disc file system to locate the file. Either way the comment has no source to back it up and doesn't really make sense.

    I'm not sure what the actual protection scheme is with the PS2 but it's quite likely similar in concept to the PS1 but developed further. There are some hints out there when reading about earlier methods to play burned games on the PS2. The PS2 BIOS/OSD which loads your game does some software controlled checks on the discs which are patched by later modchips. I'd certainly like to see some solid information on more specifics.
     
  7. sp193

    sp193 Site Soldier

    Joined:
    Mar 29, 2012
    Messages:
    2,201
    Likes Received:
    1,044
    I hate to disappoint, but I might not have the answer you seek because I am a software fellow.

    But I know for sure that the disc has licensing information stamped on it (in the wobble or not). It will have data that can allow the CD/DVD subsystem to know about the region, the boot filename (will get into this later) and support for other DRM functions like unscrambling and computing the LBAs of hidden files. This data certainly cannot be copied through normal means.

    The boot ROM itself has no real region-locking, other than usually being tailored (video mode, languages allowed etc) for the region of the PS2. They eventually redesigned the boot & DVD (player) ROMs to be universal, but this was only completed at the SCPH-75000.

    The booting of the disc requires the disc to be first recognized and accepted by the hardware, so the DRM is implemented in the hardware. If a regular disc is inserted into a CEX PS2, it will appear as type 0xff (illegal media) and all N-commands (reading etc) will fail. I am not sure what a disc without the right Masterdisc data will appear to a DEX, however.

    The CD/DVD drive is disabled by default, since the first expansion-bay PS2 model. It is unlocked (boot certification) with the boot ROM's version number, region and type. The MECHACON on the SCPH-10000 and SCPH-15000 (and possibly the A+ chassis SCPH-18000) do not support this. I don't really know why this was done, but perhaps this was to totally eliminate the possibility of replacing the boot ROM with another PS2's...nevermind that modifying it with a modchip is easier.

    The boot filename is visible in SYSTEM.CNF, but that is not used by the browser to boot the disc; the browser will query the MECHACON for the real filename, but uses the filename from SYSTEM.CNF to cross-check. PS discs have the boot filename parsed from SYSTEM.CNF, except on the SCPH-50009 (Sony might have stepped up the DRM game on the Chinese PS2).

    PS2LOGO, the software that display the PS2 logo, is run by the browser and is not actually required by anything to run (other than the overlords at Sony). It has a check on the scrambled logo stored within the first 12 sectors of the PS2 game disc. Early PS2s might still boot the game disc, even if PS2LOGO rejects the logo. The logo must also be appropriate for the video region (the PAL logo differs from NTSC).

    Game-wise, games call sceCdMmode() to tell CDVDMAN whether they were meant for a CD or DVD. If the wrong disc type is detected, then CDVDMAN will automatically fail all N-commands, in software. I don't know why this matters, however.

    So for these reasons, modchips usually modify the content of the boot ROM (and hook onto OSDSYS), so that they can prevent the software from consulting the hardware. The hardware must also be tricked into accepting the disc, as the appropriate type.

    As for PS discs, PS1DRV has no region lock on its own. But it was tailored for the region until the SCPH-75000, whereby it could only support either NTSC or PAL, and would have the compatibility list for the intended region. PS1DRV has no check on the disc type, so it is actually possible to boot a PS disc that is recognized as a PS2 CD-ROM (can happen with some modchips).

    As for DVD Video disc playback, there is no region locking in hardware. All DVD Video discs will appear as DVD Video Discs to the system.
    DVD Video disc playback (as in, cannot read sectors) is disabled on all PS2s by default, until a valid DVD player KELF is loaded. Since the early DEX consoles have no ability to boot a DVD player (even with foreign magic to wisk a DVD Player in), this feature is effectively disabled permanently for them.
     
    Last edited: Jan 29, 2019
    Taijigamer2, uyjulian, Jei and 9 others like this.
  8. Taucias

    Taucias Site Supporter 2014,2015

    Joined:
    Oct 11, 2005
    Messages:
    5,014
    Likes Received:
    17
    My understanding is as follows:

    PSX mode:
    Standard disc wobble SCEx code protection.

    PS2 CD mode:
    Product code is read from game disc SLxS ELF filename.
    There is a playstation 2 logo held on the first 16 sectors of the disc encrypted using a key held in the wobble area of the disc. The PS2 won't boot the disc until the BIOS decrypts the logo, checksum is passed (not sure that applies to US models) and displays it.
    The logo decryption key itself is encrypted using the product code of the disc.


    PS2 DVD (V8 and higher)
    As above except the mechacon validates the disc media format and will not continue boot routine if the disc is not DVD-ROM.
    Also some games perform this check in software, EA developed games for example.
     
  9. uyjulian

    uyjulian Active Member

    Joined:
    Jul 23, 2016
    Messages:
    46
    Likes Received:
    28
    I'm curious how the DVD Video check is done. Does the MECHACON have a filesystem driver checking for VIDEO_TS? Or is there other methods to mark a disc as for DVD Video?
     
    wisi likes this.
  10. rama

    rama Gutsy Member

    Joined:
    Dec 17, 2015
    Messages:
    475
    Likes Received:
    110
    There's at least the book type to go by.
     

Share This Page