Thanks to extraweb1 for the pictures
This memory card was used by the namco system 246 release of SoulCalibur II for storing the progress of the “Conquest Mode”.
A game mode exclusive to this release of the game.
The memory cards used come from the recall campaign sony did during PS2 launch on japan. these cards, had a bug on their controller chips (usually CXD9585R & CXD9585AR) that corrupted the FAT table of the card filesystem.
SoulCalibur II recycles these cards using a custom filesystem (or raw data?) encrypted page-by-page. as well as custom ECC format
This card uses a different magic string
Memory Card for SoulCaliburII (C)1995 1998 2002 NAMCO LTD.
the first block of the conquest card only holds this magic string. all the rest is filled (byte filler is 0xFF usually)
the actual data differences begin at card page 32. before this. the contents are exactly the same accross all conquest cards I’ve seen
the following files are directly related and a target to REing
mc0:SCSLOAD: game launcher. setups some stuff and launches PS2AC05 file (looking for it in the security dongle, developer flash and the game DVD. In that order)mc0:PSAC05: main game binary blob, encrypted and RLE compressed.mc0:IOPRPACM: decoy IOPRP image containing an unused DONGLEMAN driverThe SIO2MAN, MCSERV and DONGLEMAN drivers used to interface with the conquest card are embedded inside the PS2AC05 binary blob.
mc0:IOPRPACM is actually a decoy. the image is not even used, and the dongleman driver inside is most likely left to confuse
Events related to new discoveries about the card will be placed here, to keep a chronological order
After doing some checks, I realized dongleman module used by SC2 is not unique, actually, scanning a package of several dongle Dumps yielded more than 60 matches with the same hash arised (0a6ca23ae87aba1d0a12641435f84327)
today I got my hands on a conquest card. thanks so much to @kuze from www.arcade-projects.com/ for this amazing donation. this will allow me to continue with more invasive tests. like manipulating the game dongle to inject software to track down all sent commands to the card and log them into the console UART
I used to believe that arcade PS2s were authenticating cards on slot2 with retail magicgate... I was Wrong. SCPH-10020 official cards support several keys (Developer, Retail, Arcade and another unknown set of keys) if the cryptography is done by the memory card chip and not the game software, this discovery will prove to be very useful. not to mention that it will be needed for handling conquest cards outside of an arcade PS2 (Be it retail PS2 or the PS3 CECHZM1)
sorry for the delay. I've been waiting all this time for a JVS adapter board (those MP007-IONA-US things) from aliexpress, took like 2 months shipping... Well, I'm back on track. so you may see more entries here from time to time.
Conquest cards dont use the same algo for ECC data... I've figured out how to calculate this ECC
with some help, now PS2AC05 (the main game code binary blob) can be decrypted and unpacked. a tool to do this will be released eventually
the DONGLEMAN driver inside IOPRPACM was a decoy at the end, the conquest card access is done with customized versions of SIO2MAN, MCSERV and DONGLEMAN embedded on the game there is still a lot to do, specially considering those CPUDAT files also seem to be more code blobs...
for the first time in 23 years, soulcalibur2 conquest mode has been enabled without an original conquest card here you have a recording of the second time it worked
I have successfully converted a normal SCPH-10020 to a conquest card, software only, no need for hardware modifications or anything Tools for converting them from the PS3 CECHZM1 Adapter, a retail PS2 and even from the system246 itself will be eventually released