Info from guru

PlayStation 2 Memory Card File System

Memory Card

The NAND flash chip is organized into:

• 1024 Blocks
• 16 Pages per block
• 528 bytes pr page,consisting of
  • 256 bytes of the 1st half page
  • 256 bytes of the 2nd half page
  • 16 bytes spare

1024*16*528=8650752 bytes. This is the size a raw dump of the chip should have. The 16 bytes spare part of the page should be used for some kind of system level ECC/error correction algorithm. For the PS2/System246 this algorithm is Hamming.

Some dumps do not include the spare/ECC portion, as this is not seen by the host system (it is handled by the MCU on the memory card), or they include it in a separate file. These files will be 1024*16*512=8388608 bytes, and 1024*16*16=262144 respectively.

The different way to store dumps is very similar to the ISO vs RAW/BIN of optical discs.

NAND flash chips seen:

• File:K9F6408UOC.pdf - Samsung K9F6408U0C datasheet
• File:MBM30LV0064.PDF - Fujitsu MBM30LV0064 datasheet

Dumping the memory card

Desoldering method

Wellon VP-490 programmer with Adapter WL-PSOP44-U001 is confirmed to make correct raw dumps.

listing/extracting files

http://www.csclub.uwaterloo.ca:11068/mymc/ works great under linux, get the python source and run it from linux for zero issues:

This is the dump of SuperDragonBallZ

~/python mymc.py NM00027.BIN ls
rwx--d----+----      33 2005-12-07 09:49:58 .
-wx--d----+--H-       0 2005-01-19 12:46:14 ..
rwx-f--8--+----   46912 2005-01-19 12:46:16 boot.bin
rwx-f--8--+----   86561 2005-01-19 12:46:17 ACLOAD
rwx-f--8--+----   91265 2005-01-19 12:46:19 IOPRP214A
rwx-f--8--+----      50 2005-01-19 12:46:19 title.txt
rwx-f--8--+---- 3686320 2005-12-07 09:49:24 DBALOAD
rwx-f--8--+----  105346 2005-12-07 09:49:26 DBAGAME
rwx-f--8--+----  126002 2005-12-07 09:49:27 FPGA
rwx-f--8--+----   32644 2005-12-07 09:49:29 JVFIRM
rwx-f--8--+----  261261 2005-12-07 09:49:31 IOPRP300A
rwx-f--8--+----   83725 2005-12-07 09:49:33 MCMANAC
rwx-f--8--+----    6509 2005-12-07 09:49:34 ACCORE
rwx-f--8--+----    2501 2005-12-07 09:49:34 ACFPGALD
rwx-f--8--+----   15874 2005-12-07 09:49:35 ACJVLD
rwx-f--8--+----    1745 2005-12-07 09:49:36 ACJV
rwx-f--8--+----    4901 2005-12-07 09:49:37 ACRAM
rwx-f--8--+----    1369 2005-12-07 09:49:38 ACSRAM
rwx-f--8--+----    2665 2005-12-07 09:49:39 ACMEM
rwx-f--8--+----    5997 2005-12-07 09:49:40 ACMEME
rwx-f--8--+----    2817 2005-12-07 09:49:41 ACTIMER
rwx-f--8--+----   11957 2005-12-07 09:49:42 ACATA
rwx-f--8--+----   36065 2005-12-07 09:49:43 ACCDVD
rwx-f--8--+----    6781 2005-12-07 09:49:44 ACCDVDE
rwx-f--8--+----    6501 2005-12-07 09:49:45 ACUART
rwx-f--8--+----   44869 2005-12-07 09:49:46 PADMAN
rwx-f--8--+----   10542 2005-12-07 09:49:47 MNCARDIF
rwx-f--8--+----   17067 2005-12-07 09:49:48 IOPMAIN
rwx-f--8--+----   28661 2005-12-07 09:49:49 LIBSD
rwx-f--8--+----   70925 2005-12-07 09:49:50 ACARKD_DVD
rwx-f--8--+----   76469 2005-12-07 09:49:52 CRI_ADXI
rwx-f--8--+----    1370 2005-12-07 09:49:53 INFODAT
rwx-f--8--+----  726162 2005-12-07 09:49:58 RAMDISK

To be verified

• only boot.bin is affected by magic gate on system246, it loads another file within the FS which is a lamely xored ELF file, and that one is the game boot

Magic Gate on 246:

• prevent that people can read the contents of the card, be it using a PC or other computer or a retail PS2.
• In case the card can still be read, prevent that the encrypted file works on other dongle cards
• protect the contents of the file against analysis and tampering