Why Did Sony Do Away With PS2 Swap-Checking Security in OSD?

Discussion in 'Sony Programming and Development' started by tkeely4777, Oct 29, 2016.

  1. tkeely4777

    tkeely4777 Rapidly Rising Member

    Joined:
    Mar 9, 2013
    Messages:
    77
    Likes Received:
    5
    Recently I pulled out my drive sensor-blocked PS2 slim to play some PS1 games via the swap trick at OSD (for anyone wondering, get yourself the GameShark PSone bonus archive disc. It offers a maxed-out ToC and will boot any game that doesn't require redbook audio).

    While I was swapping, I started to think about how the later model original PS and PSone models all had dual checks implemented to look for the SCEx code on the disc to help better protect against swaps at boot time. Why didn't they include (or bother improving) this check in the PS2? Surely Sony realized (with the slims, especially) people would block the sensors to gain access to some form of swapping. Why wouldn't they have beefed up that security?

    I've always been curious on this.
     
  2. sp193

    sp193 Site Soldier

    Joined:
    Mar 29, 2012
    Messages:
    2,235
    Likes Received:
    1,077
    It is a different system. But if you think about it, they didn't forget about it.

    Although this wasn't enforced in the earlier consoles, the PS2LOGO program attempts to decrypt the PlayStation 2 logo on the disc. So if you were to just swap discs before that, the logo cannot be decrypted because the logo was not encrypted with disc's key that the MECHACON retrieved. Earlier consoles with the older ROMs will not do anything about it, but the later ones will just boot the browser again.

    There is also a check on the disc's media. Games will specify the expected media type to sceCdMmode, which tells CDVDMAN which type the media the game should be on. If the media type does not match, then all accesses to the media will be unsuccessful.
    Although I have no idea what this might have been meant to prevent because the media type reflected by the hardware does not change unless you change the disc in the normal way.
     
    tkeely4777 and pool7 like this.
  3. LocalH

    LocalH Spirited Member

    Joined:
    Sep 2, 2007
    Messages:
    135
    Likes Received:
    13
    The media type check protects against exactly what it says - changes of media type. I imagine it would have protected from early DVD-to-CD rips or vice versa before there was the ability and knowledge to patch the checks. It still serves today as a minor barrier in making CD-based games bootable with ESR. I say minor as it's of course possible to patch those checks to the desired media type.
     
    tkeely4777 likes this.
  4. smf

    smf mamedev

    Joined:
    Apr 14, 2005
    Messages:
    1,259
    Likes Received:
    92
    Additional checks can always be removed, instead the slims were designed to slowly kill themselves if you used burnt dvd's.
     
  5. MottZilla

    MottZilla Champion of the Forum

    Joined:
    Feb 1, 2006
    Messages:
    5,073
    Likes Received:
    112
    Have anymore details on that? I've heard that general idea of needing some kind of "fix" to prevent laser problems.
     
    ploder likes this.
  6. sp193

    sp193 Site Soldier

    Joined:
    Mar 29, 2012
    Messages:
    2,235
    Likes Received:
    1,077
    I know that it is an old belief that the consoles were made that way, but seriously... it's not really practical in mass-production. As @rama once pointed out, you need to be able to design the system to fail when desired. That is hard to do, particularly because it is hard to ensure.
    I would be more inclined to think that it is a bad design, due to cost-cutting measures and because they've been redesigning the console so many times.

    Only the K-chassis (SCPH-70000) has the problems with the MECHACON crashing. The later models seem okay.
    The H, I and J-chassis models (SCPH-50000) are known to have failures in the spindle driver and optical block coils.
     
    pool7 and krHACKen like this.
  7. smf

    smf mamedev

    Joined:
    Apr 14, 2005
    Messages:
    1,259
    Likes Received:
    92
    They don't make it fail when desired, they make the chance of failing go up when presented with dvd-r's. They also added internal fuses to lines that would see increased current flow when a mod chip was fitted.

    The later consoles work with burnable media because people complained that their consoles were dying when playing their own home movies on dvd.
     
  8. sp193

    sp193 Site Soldier

    Joined:
    Mar 29, 2012
    Messages:
    2,235
    Likes Received:
    1,077
    When I wrote "when desired", it means when the user plays pirated games or whenever you think SCE would have believe is critical.

    This console was eventually designed (from SCPH-50000 onwards) to read recordable DVD-R and even DVD-RW discs later on, so it would have been hard to determine what is a burned game disc and what isn't. That happened before the the slimline consoles existed.

    But well, if you want to stick to the conspiracy theory that it's all rigged, go ahead. I used to think that way as well too, but now I feel that it's too far-fetched.
    It's not impossible, but it can't possibly be that every bad decision by SCE (or whatever company it is) was an anti-piracy measure either.

    Depends on the model. The SCPH-70000 series had a PIC fix that reset the MECHACON, whenever a crash is detected. That prevented the coils from being burnt whenever the MECHACON crashes, which doesn't have to be caused by modding and/or using burned discs.
     
    Last edited: Nov 2, 2016
    pool7 likes this.
  9. smf

    smf mamedev

    Joined:
    Apr 14, 2005
    Messages:
    1,259
    Likes Received:
    92
    I don't see it as a conspiracy theory, when it prevents something they specifically say you aren't allowed to do.

    It comes down to how clever you think they are. Has the Mechacon been dumped? It would be nice to see what caused it to crash.
     
  10. sp193

    sp193 Site Soldier

    Joined:
    Mar 29, 2012
    Messages:
    2,235
    Likes Received:
    1,077
    Unfortunately, no. :/
     
  11. rama

    rama Gutsy Member

    Joined:
    Dec 17, 2015
    Messages:
    477
    Likes Received:
    112
    I'm repairing lots of lasers on these consoles and I can tell you that it's impossible to design it to catastrophically fail only when playing burned disks.
    As the console ages and with all the different kinds of disks it sees, it will encounter everything from low reflectivity to high jitter.
    The margin of error is so big, some old lasers combined with a hazy original DVD will look like a DVD-R on the scope.
     
  12. smf

    smf mamedev

    Joined:
    Apr 14, 2005
    Messages:
    1,259
    Likes Received:
    92
    Assuming they did set out to do it, they wouldn't have known or cared that the lasers still worked now or not.
     
  13. rama

    rama Gutsy Member

    Joined:
    Dec 17, 2015
    Messages:
    477
    Likes Received:
    112
    Aging lasers are just an example.
    Another one would be bringing the console to a friend. It got cold and now there's a little condensation water on the lens.
    Do you believe Sony would have risked this rather common situation tripping their anti piracy 'burn the laser coils' mechanism? :)
     
  14. sp193

    sp193 Site Soldier

    Joined:
    Mar 29, 2012
    Messages:
    2,235
    Likes Received:
    1,077
    I think that the problem with the assumption that the hardware defects are results of a deliberate design problem with the console, is clouded by the fact that very few people used it as a DVD player. Without modding.

    The DEX and TOOL units were used with recordable media. But because they were only extensively used by SCE and licensed developers, we don't hear about the longitivity of these sets under everyday use.
    If you say that the design of the mainboard (not the microcode) also played a part in this, then the "sabotage" shouldn't exist in DEX consoles (i.e. DTL-H50000).
     
    pool7 likes this.
  15. smf

    smf mamedev

    Joined:
    Apr 14, 2005
    Messages:
    1,259
    Likes Received:
    92
    What we know is that the laser coils did burn, which was caused either by:

    1. stupidity by sony by accident
    2. stupidity by sony on purpose

    You can't argue that sony are really clever so they wouldn't do it on purpose and then use that as proof that they are really dumb for designing it badly.

    If the DTL's suffered the same laser coils burning then it does point to them being just plain stupid, although it could still be a deliberate attempt and then they forgot to remove it from the DTL.

    A dump of the mechacon from a SCPH and DTL-H would be good.
     
    Last edited: Nov 5, 2016
  16. rama

    rama Gutsy Member

    Joined:
    Dec 17, 2015
    Messages:
    477
    Likes Received:
    112
    What?
    I think we don't understand each other :)
     
  17. smf

    smf mamedev

    Joined:
    Apr 14, 2005
    Messages:
    1,259
    Likes Received:
    92
    What don't you understand?

    The slims have a problem with burnt out coils which happens way more often if you use recordable dvd's. Either Sony made a dumb mistake or they did it on purpose & didn't think of the consequences (i.e. a dumb mistake). Your argument boils down to they must have made a dumb mistake because they wouldn't make a dumb mistake.

    Therefore we need evidence to settle this & not just more conjecture.
     
  18. sp193

    sp193 Site Soldier

    Joined:
    Mar 29, 2012
    Messages:
    2,235
    Likes Received:
    1,077
    Not sure if you are referring to only the SCPH-70000, but that was the only slimline model with the MECHACON crashes and hence burned coils.
    On the other hand, the problems with the optical drive persisted for a couple of models before that (I.e. spindle motor driver burning out, tracking coils burned, golden disc syndrome).
    It was also known that SCE partially fixed the burning coils problem on a later revision of the SCPH-70000 (Unofficially known as the "v13").
     
    pool7 likes this.
  19. l_oliveira

    l_oliveira Officer at Arms

    Joined:
    Nov 24, 2007
    Messages:
    3,895
    Likes Received:
    252
    On older hardware (PS1 and earlier CD stuff) they delegated functions such as control of the coils to a dedicated DSP on the main CD drive LSI. On the PS2 they moved the tracking control onto the mechanics controller (perhaps to have better tracking control as the mechacon also directly controls the motor which moves the optical pickup back and forth on the disc surface) and the damage happens when the software thread in the mechanics controller crash leaving the servos and the laser diode on in a high power mode for a extended time. It's a design flaw. If it was hardware driven the circuit would be able to make a quick recovery and you would not see burnt tracking coils, ever.

    Unfortunately this is an inherent design flaw. To go around this without need to redesign the whole thing SONY added a external hardware monitor watchdog circuit on PS2 slim boards starting at GH-032 (GH-035 came before GH-032 I dunno why) and all boards after that do shut down the servos if the mechacon crashes (it watches the IRQ signal between the mechacon and the DVP DSP chips).

    If it was impossible as you say to have catastrophic failures on the laser pickups, SONY would not have bothered with adding that watchdog circuitry, at all.

    All PS2 consoles, even the 10k can blow the tracking coils this way.
     
    pool7 and krHACKen like this.
  20. rama

    rama Gutsy Member

    Joined:
    Dec 17, 2015
    Messages:
    477
    Likes Received:
    112
    Oh, please read again.
    I meant to say that it's impossible to design the error in deliberately so that it triggers on playing backups (and make this reliable in the real world).
    Of course design errors can happen and they do, it's just not deliberate (because that would have hurt a lot via aftermarket warrantee returns).
    I need to word my stuff better, I know ;p
     

Share This Page