PlayStation 2 MechaCon chip gives up its firmware after 26 years

The PlayStation 2 has spent more than two decades under microscopes, soldering irons and debuggers. Developers have documented huge parts of Sony’s console, from its Emotion Engine processor to its unusual graphics hardware. One component kept resisting close inspection: the early MechaCon controller. Hardware researcher and modder DiscoStarslayer has now extracted firmware from the CXP102064 MechaCon used in early PlayStation 2 systems, following roughly four years of reverse-engineering work. Researcher Libby played a key part too, finding an exploit from imperfect optical dumps which opened a software route into the chip. It’s a technical result, but the basic idea is simple. Researchers can finally inspect code stored inside one of the PS2’s more difficult controllers instead of working only from its external behaviour.

DiscoStarslayer spent four years getting inside MechaCon

DiscoStarslayer announced the result on social network X, after a project involving physical chip analysis, optical ROM dumping and software research. MechaCon stands for Mechanics Controller, a name which makes it sound like a glorified disc-drive assistant. It does far more.

The controller handles parts of the optical-drive system and participates in security operations used by the console. It deals with commands linked to disc operation, authentication and protected data. For researchers studying early PS2 hardware, its firmware represents a valuable missing piece.

Sony stored the program in Mask ROM. Unlike rewritable flash memory, Mask ROM stores information physically in the silicon during manufacturing. There isn’t a normal firmware file waiting to be copied with a programmer. So DiscoStarslayer went straight to the chip.

The project moved from chemicals and microscopes to software

Part of the process involved chemically decapping the CXP102064, stripping away the package and exposing the silicon die underneath. People can photograph the die at high magnification and reconstruct ROM data from physical structures inside the silicon. It’s slow work, and imperfect images can introduce errors. Those early dumps weren’t clean. They were useful.

Libby studied the data and identified an exploitable weakness connected to the controller. From there, the project gained a software method for extracting firmware directly. The optical work had exposed a route into the chip, and software could take over much of the remaining job.

Why the firmware dump matters

This isn’t a magic PS2 hack. Existing software methods already provide routes for running homebrew and copied software on original hardware. The new work has a narrower technical value: researchers can inspect firmware from older SPC970-based MechaCon chips directly.

Previously, developers could probe the controller, issue commands and study its responses. Firmware access gives them another layer of information. They can inspect routines inside the chip, compare behaviour across hardware revisions and search for undocumented commands or security functions. It may help explain differences between early retail PS2 models and related arcade hardware.

Emulation research could benefit too. Firmware analysis can answer low-level questions where developers previously relied on testing and approximation. Hardware projects are another possible area of interest. Better documentation of MechaCon communication could support experiments with replacement controllers or optical-drive substitutes.

Libby’s exploit changed the direction of the project

The optical dumps contained enough information to expose a weakness, but they weren’t a clean final copy of the firmware. Libby examined those dumps and found the exploit used for software extraction. This changed the project from a painstaking reconstruction exercise into something researchers could approach more directly through software.

The four-year timeline matters here. The software method came from physical work on the chip, optical dumping and analysis of imperfect data, with DiscoStarslayer and Libby tackling different parts of the problem.

The work reaches beyond retail PS2 consoles

The CXP102064 matters outside Sony’s standard home console hardware. PS2-derived arcade systems, including Namco System 246 and System 256 machines, share technology connected to the broader MechaCon family. Comparing firmware across these systems could help document differences in command handling, authentication and hardware behaviour.

Later PS2 revisions changed too, with newer machines moving to different MechaCon designs. For early SPC970-based models, researchers now have a clearer route into firmware which remained difficult to extract for more than two decades.

DiscoStarslayer’s four-year project hasn’t suddenly rewritten PS2 security. It has done something more precise: opened a previously difficult section of early PlayStation 2 hardware to direct software analysis. For a console examined for 26 years, there was still code buried deep inside its silicon waiting to be read. Now researchers can read it.

Spread the love