Thanks to extraweb1 for the pictures
This memory card was used by the namco system 246 release of SoulCalibur II for storing the progress of the “Conquest Mode”.
A game mode exclusive to this release of the game.
The memory cards used come from the recall campaign sony did during PS2 launch on japan. these cards, had a bug on their controller chips (usually CXD9585R & CXD9585AR) that corrupted the FAT table of the card filesystem.
SoulCalibur II recycles these cards using a custom filesystem (or raw data?) encrypted page-by-page. as well as custom ECC format (it seems)
This card uses a different magic string
Memory Card for SoulCaliburII (C)1995 1998 2002 NAMCO LTD.
the first block of the conquest card only holds this magic string. all the rest is filled (byte filler is 0xFF usually)
Based on talks with ExtraWeb1. it seems like the following files inside the SoulCalibur II Dongle are directly related to the conquest card
mc0:PSAC04A
mc0:PSAC05
Soulcalibur2 Dongles carry the MCSERV module on the dongle root. and the dongleman module goes inside one of the 3 IOPRP images found on the dongle, more specifically: mc0:IOPRPACM
Both Dongleman and MCSERV have all the same MD5 Hash across the 3 versions of SC2
SC21, Ver.A10
SC22, Ver.A10
SC23, Ver.A10
MCSERV is the RPC service that allows the EE to call MCMAN (DONGLEMAN in this case) exports directly
it seems to be just MCSERV from SCE SDK 3.0.x. without additional modifications
DONGLEMAN is a modified version of MCMAN wich has minor modifications to keep up with the changes done to the arcade mechacon, arcade SECRMAN and others.
There are two versions of dongleman. the one found on bootrom rom0:MCMAN wich only reads cards on port 0 (dongles) and the game DONGLEMAN. wich reads both ports without issues.
| function label | export number |
|---|---|
| mcman_stub | 0 |
| mcman_stub | 1 |
| mcman_stub | 2 |
| mcman_stub | 3 |
| mcman_stub | 4 |
| McDetectCard | 5 |
| McOpen | 6 |
| McClose | 7 |
| McRead | 8 |
| McWrite | 9 |
| McSeek | 10 |
| McFormat | 11 |
| McGetDir | 12 |
| McDelete | 13 |
| McFlush | 14 |
| McChDir | 15 |
| McSetFileInfo | 16 |
| McEraseBlock | 17 |
| McReadPage | 18 |
| McWritePage | 19 |
| McDataChecksum | 20 |
| McDetectCard2 | 21 |
| McGetFormat | 22 |
| McGetEntSpace | 23 |
| McReplaceBadBlock | 24 |
| McCloseAll | 25 |
| mcman_sio2_mtap_get_sl | 26 |
| mcman_stub | 27 |
| mcman_stub | 28 |
| McReadPS1PDACard | 29 |
| McWritePS1PDACard | 30 |
| mcman_stub | 31 |
| mcman_stub | 32 |
| mcman_stub | 33 |
| mcman_stub | 34 |
| mcman_stub | 35 |
| McUnformat | 36 |
| McRetOnly | 37 |
| McGetFreeClusters | 38 |
| McGetMcType | 39 |
| McSetPS1CardFlag | 40 |
| mcman_stub | 41 |
| McGetModuleInfo | 42 |
| McGetCardSpec | 43 |
| McGetFATentry | 44 |
| McCheckBlock | 45 |
| McSetFATentry | 46 |
| McReadDirEntry | 47 |
| Mc1stCacheEntSetWrFlag | 48 |
| McCreateDirentry | 49 |
| McReadCluster | 50 |
| McFlushCache | 51 |
| McSetDirEntryState | 52 |
| mcman_stub | 53 |
Events related to new discoveries about the card will be placed here, to keep a chronological order
After doing some checks, I realized dongleman module used by SC2 is not unique, actually, scanning a package of several dongle Dumps yielded more than 60 matches with the same hash arised (0a6ca23ae87aba1d0a12641435f84327)
today I got my hands on a conquest card. thanks so much to @kuze from www.arcade-projects.com/ for this amazing donation. this will allow me to continue with more invasive tests. like manipulating the game dongle to inject software to track down all sent commands to the card and log them into the console UART