Bizarrely that's one of the things that motivated me to post all my ramblings. I did find an open source PS2 modchip once & I can tell you they watch the ROMs data bus for the PS2 string during boot to identify the model, patch some bytes from the BIOS as its being read to RAM (no $#!t Sherlock) and there's some monkey business with the DVD Rom controller (for which I never did get a datasheet

).
I wish I could find it and the PSX FW I had - we should have an archive of retro hacks, I'd add my homebrewed XKlone XB1 chip....