cloud

Native Google Drive Cloud Backup

Optional PS2-native OAuth 2.0 device sign-in and HTTPS upload of your MMCE backup history to your own Google Drive, with no PC in the loop.

At a glance

• Opt-in and demand-loaded: nothing touches the network until you open Tools > Google Drive backups, run an upload, or enable automatic sync.
• Uses the Ethernet (ETH) stack, so you need a network adapter, a working IP configuration and a roughly correct PS2 clock.
• Copy-only: uploads add files to Drive; Launchstation never deletes local or Drive history.
• Needs a build with native cloud support (the official ZIP/PSU packages have it; the legacy Makefile does not).

What it does

The feature links a Google account with Google's device authorization flow, stores a refresh token, and uploads missing versions from your local WLE-MMCE-Backups history (the folders created by MMCE backups) into a WLE-MMCE-Backups folder in the root of your Drive. It requests only the drive.file scope, so it can see just the files and folders it creates, never the rest of your Drive. It never deletes anything.

Linking

1. Open Tools > Google Drive backups and choose Link Google Drive.
2. Scan the QR code with a phone, or open the address shown (Google supplies it, normally google.com/device) on any phone or computer, and type the code shown on the PS2.
3. Sign in and choose Allow. The PS2 checks with Google at the interval Google requests (it slows down when asked) and shows a confirmation when the account is linked. Back cancels; an unused code expires at Google's time limit (Launchstation assumes 30 minutes if Google does not say).

No Google Cloud project, setup files or payment details are needed: official builds include Launchstation's own OAuth client (type TVs and Limited Input devices) and the Google Trust Services root certificates. A build compiled without that client (for example a fork or local build) shows This build has no built-in Google client and needs a custom client; see Advanced setup.

The Google Drive backups menu

Item	What it does
Back up cards & upload	Backs up every changed MMCE card (both slots) into local history, then uploads the history. Asks for a backup folder first if none is saved.
Link / Relink Google Drive	Starts the device sign-in above. Relinking requests a fresh authorization.
Upload existing backups	Uploads history already in the saved backup folder without touching live MMCE cards. Needs a linked account and a saved folder; the IGR helper is not required.
Browse cloud history...	Read-only, paged view (12 entries per page) of the app-created Drive folders and snapshots, with verified recovery. See below.
Backup folder...	Chooses the parent folder of WLE-MMCE-Backups and saves it immediately. Changing an existing folder asks for confirmation; Cancel or picking the current folder changes nothing. Reinstall the IGR helper afterwards because it embeds its destination.
Disconnect Google Drive / Clear saved Google token	Deletes the local token files and turns off automatic IGR cloud sync. Drive files are untouched and Google is not contacted; to revoke Launchstation at Google too, remove it under Google Account > Third-party access.
Advanced setup...	Custom OAuth client and CA bundle overrides.

The same account actions appear under Settings > Storage & devices > MMCE backups > Google account, beside the backup policy. They use the same native client; there is no second implementation.

Backup folder and automatic sync

In Settings > Storage & devices > MMCE backups, Backup folder is the parent of WLE-MMCE-Backups; it does not move existing history, and you must save Settings before leaving. Automatic sync has three modes: Off, Local backup, and Local + Google Drive. It is off by default, applies only after an OPL game returns through the WLE-IGR helper, and the Drive step runs only after the local backup pass. Drive upload cannot be selected until an account is linked. The sync source cannot be a udpfs: path, because Drive needs the ETH network stack and UDPFS uses the other one. The card status Locally backed up describes local history only, not Drive.

What gets uploaded

• Layout: the local tree under WLE-MMCE-Backups is mirrored folder-for-folder (up to 16 levels deep) below a Drive folder of the same name in the Drive root. Only files named WLE-*.mcd or WLE-*.ps2 are considered; .PART files from interrupted backups are never uploaded.
• Validation first: before each file crosses to the cloud its PS2 memory-card header, geometry and exact size are re-checked, so a truncated final-named file from a power loss is rejected and counted as failed.
• Content-aware skip: every upload carries a private Drive appProperties value wle_sha256. A file is skipped only when the same Drive folder already holds an item with the same name and SHA-256. A same-name file with different content is kept as a separate Drive item. Legacy uploads without the property may be uploaded once more, after which syncs are content-aware.
• Same-handle hashing: the local file is hashed and then streamed from the same open file handle, so it cannot be swapped between hashing and upload.
• Transport: Drive API v3 with a resumable upload session whose URL must stay on https://www.googleapis.com/ before the bearer token is sent. The result screen reports uploaded, already present and failed counts.

Remote history browsing and verified recovery

Browse cloud history... shows metadata from the app-created history only. Entries without a stored wle_sha256 can be inspected but not used for verified download. Select a completed, digest-qualified .mcd or .ps2 snapshot and a destination on USB, mass or HDD (not an MMCE card) to create a separate RECOVER-CLOUD-###.mcd (numbered up to 999). The download is authenticated, limited to 96 MiB and written to a .PART file; its SHA-256 must match the uploaded digest, the card geometry is validated, PCSX2 .ps2 images are converted and the converted copy is verified before anything is published. A failed download or check cannot leave a final card. Existing Drive history and active MMCE cards are never changed, and the recovered image is not activated for you. MMCE recovery and safety matrix.

Cloud sidecars

Launchstation keeps these beside DASHBOARD.CNF (the dashboard settings folder, for example mc0:/SYS-CONF/):

File	Purpose
WLE-CLOUD.TOK	The refresh token, written after linking as plain text. Anyone who can read your storage can read it, so never share or publish it.
WLE-CLOUD.TOK.NEW	Crash-safe staging copy used only while the token is replaced.
WLE-CLOUD.CNF	Optional (Advanced setup): a custom OAuth client ID and secret that replace the built-in client as a pair. Template: res/WLE-CLOUD.CNF.example (Google_Client_ID, Google_Client_Secret).
WLE-CLOUD-CA.PEM	Optional (Advanced setup): custom trust roots that replace the built-in Google roots for Google connections; the loader accepts at most 256 KiB.

Crash-safe token replacement

The new token is first written to WLE-CLOUD.TOK.NEW with an explicit completion marker, read back and compared, and only then written to WLE-CLOUD.TOK; the staging file is removed last. After a power loss, a complete .NEW file is preferred on the next start, and an incomplete one is ignored instead of superseding a valid primary token.

TLS and entropy

HTTPS uses Mbed TLS 3.6.7 over IPv4 on port 443, built from upstream source for the same compiler as the ELF. Certificate and hostname verification are mandatory. Because the PS2SDK random path alone is not trusted, Launchstation mixes it with full-width cycle-counter samples, the RTC, runtime timing, a local counter and DNS/TCP timing through SHA-256 before seeding the CTR-DRBG. This is defense-in-depth, not a claim that the PS2 has a certified hardware random source. Validation uses the PS2 clock, so a badly wrong date can make valid certificates look expired or not yet valid.

Failure behavior

TCP connect, TLS handshake, reads and writes use a 15-second no-progress timeout. DNS lookup is the synchronous PS2IP call and is outside that timeout, so bad DNS remains a real-hardware edge case. Link polling tolerates a few transient network errors but treats a Google answer such as access denied or expired as final. Responses are capped at 64 KiB each; large files are streamed, not buffered.

Advanced setup (custom client or CA)

Advanced setup... lets you substitute your own Google Cloud OAuth client (type TVs and Limited Input devices, Drive API enabled, drive.file scope) or your own CA bundle. A custom client ID is used only together with its own secret; the built-in secret is never sent with a custom ID. Google's device flow needs the client secret, so enter both even though the editor does not block an empty one. Changing the client first disconnects the account, because refresh tokens belong to the client that issued them, and turns off automatic Drive sync. Use built-in Launchstation client removes WLE-CLOUD.CNF. A custom CA bundle must be a PEM file containing at least one certificate. Maintainers who build their own binaries should read Building the Google client into a build.

Update checks (separate from Drive)

Check for updates (Settings > Storage & devices > MMCE backups) is a different feature that happens to share the HTTPS client. It uses WLE-UPDATE-CA.PEM (found beside the running ELF, or in the dashboard settings folder) as its trust anchor for GitHub, never the Google CA files, and your Google token is not involved. Behavior and verification steps are on Downloads & Releases.

Troubleshooting

• Link unavailable / HTTP error right away: confirm the Ethernet link and IP settings, then the PS2 date and time (Settings > Network can sync it).
• Certificate errors: wrong clock, or a stale custom WLE-CLOUD-CA.PEM. Remove the override to return to the built-in Google roots (valid until 2036).
• Sync reports failures: unreadable or truncated backup files are skipped and counted; run a fresh local backup and retry.
• Stuck on DNS: there is no DNS setting; test the same network with another network feature and see Troubleshooting.
• Prefer another provider or keep credentials on the PC? Use the optional PC-side rclone relay.