Info from guru

PlayStation 2 Memory Card File System

Memory Card

Image should be 8 650 752 bytes.

NAND flash chips seen:

• File:K9F6408UOC.pdf - Samsung K9F6408U0C datasheet

Dumping the memory card

Desoldering method

Wellon VP-490 programmer with Adapter WL-PSOP44-U001 is confirmed to make correct dumps.

listing/extracting file

http://www.csclub.uwaterloo.ca:11068/mymc/ works great under linux, get the python source and run it from linux for zero issues:

This is the dump of SuperDragonBallZ

~/python mymc.py NM00027.BIN ls
rwx--d----+----      33 2005-12-07 09:49:58 .
-wx--d----+--H-       0 2005-01-19 12:46:14 ..
rwx-f--8--+----   46912 2005-01-19 12:46:16 boot.bin
rwx-f--8--+----   86561 2005-01-19 12:46:17 ACLOAD
rwx-f--8--+----   91265 2005-01-19 12:46:19 IOPRP214A
rwx-f--8--+----      50 2005-01-19 12:46:19 title.txt
rwx-f--8--+---- 3686320 2005-12-07 09:49:24 DBALOAD
rwx-f--8--+----  105346 2005-12-07 09:49:26 DBAGAME
rwx-f--8--+----  126002 2005-12-07 09:49:27 FPGA
rwx-f--8--+----   32644 2005-12-07 09:49:29 JVFIRM
rwx-f--8--+----  261261 2005-12-07 09:49:31 IOPRP300A
rwx-f--8--+----   83725 2005-12-07 09:49:33 MCMANAC
rwx-f--8--+----    6509 2005-12-07 09:49:34 ACCORE
rwx-f--8--+----    2501 2005-12-07 09:49:34 ACFPGALD
rwx-f--8--+----   15874 2005-12-07 09:49:35 ACJVLD
rwx-f--8--+----    1745 2005-12-07 09:49:36 ACJV
rwx-f--8--+----    4901 2005-12-07 09:49:37 ACRAM
rwx-f--8--+----    1369 2005-12-07 09:49:38 ACSRAM

To be verified

• only boot.bin is affected by magic gate on system246, it loads another file within the FS which is a lamely xored ELF file, and that one is the game boot

Magic Gate on 246:

• prevent that people can read the contents of the card, be it using a PC or other computer or a retail PS2.
• In case the card can still be read, prevent that the encrypted file works on other dongle cards
• protect the contents of the file against analysis and tampering