PS2 System Update documentation

Memory card updates

the PlayStation2 was capable of loading encrypted executables from both memory card slots to be used as system and DVDPLayer software updates, from paths that vary depending on console model and region (as described on the tables below)

Those updates are encrypted based on a set of keys provided by the console itself.

those keys are system specific (eg: retail, TEST, and namco arcade systems all have their unique set of keys).

this means that an update encrypted on one type of machine won't run on the others.

(eg: install on a retail machine and plug the card into a TEST one and the update will not be accepted).

In adition. On the memory card update encryption process, the memory card ID code is also used. wich means that the card is not only tied to the machine type that was used on install, it will only decrypt on the memory card used for the installation. hence why system/DVDPlayer update folders have the copy protection property applied most of the time

Memory card System folders

The directories where PS2 looks for updates and local settings.

Memory card System executables

The filenames of the system updates depending on the console model

the number is calculated by rounding the ROM version to the nearest ten. for example: a SCPH-70xxx has ROMVER 0200 (2.00). so the name of the specific update will be osd210.elf

HDD Updates

Updates from the HardDrive

Updates loaded from the HDD behave in a different way.

the actual update is not loaded by the console itself. instead, a specifically crafted headerless ELF (encrypted as a KELF) is written into the __mbr partition. when an expansion bay model detects the HDD is connected and working, it will try to load this KELF file.

the usual behaviour of the Sony HDD-OSD MBR program is something like this:

flowchart LR
C[MBR.KELF Starts];
C --> D{Perform HDD integrity check};
D -->|If errors detected| F;
D -->|if everything is OK| H;
F[Execute FSCK];
H[Execute System update];

The mentioned integrity checks are:

• Checking if HDD is deemed as connected, formatted and usable by the system
• Check S.M.A.R.T status
• Check Sector errors
• Check if any PFS Partition is marked as damaged

The mentioned FSCK is a diagnosis tool designed to “repair” any fixable damage to the filesystem. under sony design, this tool is stored on the __system partition. along with the update

Consoles that dont boot HDD updates autonomously

The following PS2 models dont load HDD updates on their own:

• SCPH-10000
• SCPH-15000
• SCPH-18000
• SCPH-70xxx (sony didn’t want it on this model)

for the PCMCIA models (from 10k to 18k) sony provided a bootloader that was installed to the memory card along with the HDD Software (Either HDD-OSD or PSBBN)

what those updates did was operate the HDDLOAD module, responsible of finding the MBR bootstrap. then copying it to RAM at 0x010000 adress for further execution by the update itself.

since SCPH-18000, the HDDLOAD module is included amongst the BOOT ROM (““BIOS””) files. but only the expansion bay models (SCPH-3xxxx & SCPH-5xxxx) have an OSDSYS program that can use this driver autonomously. also this module was removed on the first slim, along with all the HDD software.

although this update was made for PCMCIA machines. it’s design implicitly allowed support for the SCPH-70xxx models, wich still have the HDD connection hardware

FreeMcBoot and PS2BBL offer homebrew alternatives for the HDDLOAD system, wich can be used for the mentioned models at the list on beginning of this topic

PSX DESR

Memory card update

PSX DESR Systems have a unique filename for their updates, wich was already mentioned on this article. in adition, PSX-DESR KELF Files have a diferent machine type flag. meaning that most of the time a PS2 KELF wont run on a PSX and vice versa.

However, there is a “small” trick to bypass this issue on the PSX. using a KELF with the DNASLoad user header. wich is whitelisted on the PSX Mechacons, allowing it to be accepted even being flagged as PS2 KELF

XFROM

PSX-DESR has an internal flash memory (same hardware and filesystem than PS2 common memory cards). This flash memory is part of the DEV9 system. and an update is booted from there before running the HDD MBR Bootstrap.

the path is xfrom:/BIEXEC-SYSTEM/xosdmain.elf

DONT TOUCH THE CONTENTS OF xfrom IF YOU DONT KNOW WHAT YOU’RE DOING!