What's new

[REQUEST]: SoulCalibur2 Conquest card dumps request!

El_isra

Enthusiast
Joined
May 22, 2024
Messages
80
Reaction score
252
Location
Buenos Aires, Argentina
Hello everyone. as some of you may know. I've began analyzing the SoulCalibur 2 conquest cards with the intention of replicating them as well as fixing damaged ones (and maybe other things in the future)

For investigation purposes. I need as much dumps as possible. so if you own both a conquest card and a PS3 mc adapter (Sorry! current lack of information at the moment keeps me scared enough to not even try making a dumper that works from a console. so for now, let's keep it at ps3 adapter dumps)


Another detail, I'm not only after the dump, but also from some data of the card...

The data I'm after is:
  • All the information provided by the -i command of ps3mca
  • The conquest card security vectors (CardIV, CardNonce and CardSeed)
  • The actual dump (with the -imgecc command)
  • an MD5 hash of the dump just in case
  • the number on the bottom right corner of the backside label (if possible)

NOTE1: if the dump is too slow (2 pages per second) please cancel the dump, unplug and replug the adapter and try again. as slow dumps seem to produce corrupted data

To obtain all the needed information, you will need to use My fork of ps3mca-tool

the config INI file must be set up to use retail magicgate, and also, remember to put the verbosity level at 5 so that all the important data is printed on screen


It should look something like this

Less:
Using 'retail' keys
CardIV: 01 11 A2 00 14 02 02 61
CardMaterial: 01 01 52 44 01 90 F5 71
context.UniqueKey: BD 5E 4F 72 52 88 5D FB 41 D2 40 A6 70 1C FE A3
CardNonce: 3C 83 8C A2 58 38 63 D9
MechaChallenge1: 5C 00 50 43 E2 08 58 A1
MechaChallenge2: D1 81 12 4C F9 A0 94 68
MechaChallenge3: 8A 9F F1 A4 42 9E 26 F8
CardResponse1: 04 1A 6D B7 5F D9 E2 34
CardResponse2: 7F 7B D4 0A 68 FC AC BC
CardResponse3: 58 42 5F CF 2A 1D C8 F5
context.SessionKey: 21 12 DD DA F9 E9 B7 2A
-- Conquest Card detected
System246 SoulCalibur2 Conquest Card Information
Page size  : 512 bytes
Block size : 16 pages
MC size    : 8 MB (16384 pages)
Card Flags : 0x2B:1|1|0|1|0|1|0|0|
-- MC claims to support ECC
-- MC claims to support bad blocks management
-- erase byte: 0xFF
 
Card Monitoring driver ready. Now I need to get the game running and modify the dongle to use ACUART for logging the data to my PC
 

Attachments

  • 1745688047985.png
    1745688047985.png
    214.8 KB · Views: 67
I have a conquest card, but no MC3 adapter. If anyone is in Orange County, CA and has an adapter I could borrow I am more than happy to pay for shipping to me, or if close enough, I can just grab it from you.

Matt
 
I've got a SoulCalibur 2 conquest card and a PS3 USB card reader.

I'm a little confused as to the process of setting up the keys in the .ini file

the read me lists which keys are needed and how to format them in the INI but I have no idea where/how to get the keys.


Nevermind, I found them by googling these are all standard keys that can be found.
 
Last edited:
  • All the information provided by the -i command of ps3mca
  • The conquest card security vectors (CardIV, CardNonce and CardSeed)
  • The actual dump (with the -imgecc command)
  • an MD5 hash of the dump just in case
  • the number on the bottom right corner of the backside label (if possible)

info:
Code:
PS3MCA-TOOL v1.5.0.0
Using 'retail' keys
CardIV: 01 11 A2 00 12 02 02 62
CardMaterial: 01 01 52 50 01 65 05 BD
context.UniqueKey: 99 08 59 9A B2 8E 33 ED 9D 23 5D F6 6B 0D B2 1A
CardNonce: 4F 73 06 BA 29 19 27 73
MechaChallenge1: 09 3B 7E 8A BF 5B E4 54
MechaChallenge2: 98 7A 4F F6 84 60 92 ED
MechaChallenge3: 6A 88 3A 74 71 2D 66 92
CardResponse1: 43 52 C3 F0 6E 9E 74 04
CardResponse2: B6 ED 4D C9 5B 32 9C A4
CardResponse3: AE BF 51 07 7C DC 73 1D
context.SessionKey: EB E2 8A EA C0 07 F0 6F
-- Conquest Card detected
PS2 Memory Card Informations
Page size  : 512 bytes
Block size : 16 pages
MC size    : 8 MB (16384 pages)
Card Flags : 0x2B:1|1|0|1|0|1|0|0|
-- MC claims to support ECC
-- MC claims to support bad blocks management
-- erase byte: 0xFF

  • The actual dump (with the -imgecc command)
  • an MD5 hash of the dump just in case
  • the number on the bottom right corner of the backside label (if possible)
MD5: 58030D53F5DCDC979C78A70FB61FC701
back side label: A03453

I will PM the dump
card_back.jpg


this card came part of a JP region set
 
Ohh, I don't have a reader, but I do have a SC2 memory card. I'd like to help get these figured out. Would you like to borrow one to dump? Or is that not helpful?
 
Ohh, I don't have a reader, but I do have a SC2 memory card. I'd like to help get these figured out. Would you like to borrow one to dump? Or is that not helpful?
@El_isra should be able to add the keys to memory card annihilator to make it so you can dump it without the need for a Sony PS3 Memory Card Adapter
 
Keys are not a problem

I can dump the memory card through a session authenticated with any of the 4 Magicgate keys supported by the official memory cards (developer1, retail1, arcade1 or the unknown key) and the dump will always be the same, because we're just dumping the encrypted data

The real problem for getting it dumped from a console is doing so without damaging the data inside, and that's something I haven't assessed yet. If the MCMAN driver from PS2SDK is safe enough for this. I'm particularly worried about any potential code path messing with the ECC data. Although, it should be safe if we use the DONGLEMAN.IRX from SoulCalibur2 dongle, since that one also reads retail memory card with normal filesystem without issues

The JVS to USB board I need is stuck on customs, I should get it before August ideally.

When I have it I'll resume the investigation.

In the meantime... If someone who owns the PS3MCA adapter is brave enough to try, I could aid on attempting a dump with memory card annihilator and compare with a dump from PS3MCA to determine if it's safe
 
Back
Top