Exploit allowing to load arbitrary code on the PSX using only a memory card (no game needed)

Related tags

Game FreePSXBoot
Overview

FreePSXBoot

Exploit allowing to load arbitrary code on the PSX (i.e. PlayStation 1) using only a memory card (no game needed).

In other words, it's a softmod which requires a memory card, and a way to write raw data to it.

To use it, you will need a way to copy full memory card images (not individual files) to a memory card. Some possibilities are:

  • A PS2 and the software Memory Card Annihilator v2 (use "Restore MC image")
  • Memcarduino. Requires soldering wires to the memory card.
  • Using a Memcard Pro, which lets you create your own virtual memory cards on an sdcard. Simply drop the card image file you want to use as Memory Card 1, Channel 1.
  • Using Unirom and NOTPSXserial with a serial/USB cable, using the command : nops /fast /mcup 0 FILE.mcd COMPORT where FILE is the mcd file corresponding to your model, and COMPORT corresponds to your computer serial port.
  • Memcarduino with MemcardRex (success not guaranteed)
  • A DexDrive with PSXGameEdit (success not guaranteed)

WARNING

By flashing FreePSXBoot to your Memory Card, you need to be aware of the following:

  • The .mcd image files replace the whole contents of your card, meaning that your Memory Card will be ENTIRELY WIPED after flashing a .mcd image, so creating a backup of your saves is compulsory.

  • Because the exploit has corrupt Memory Card filesystem on purpose for it to run, your card will become unusable for normal operations. That is, you won't be able to use this card for saving and loading game saves and it will cause crashes on your PS1 or your PS2 console (if you have any).

  • Once installed, it may become difficult to uninstall, as the normal software to re-format a memory card won't work, due to the exploit itself. You could end up with no means to recover the memory card; if for example your installation method was Memory Card Annihilator v2, then it will also crash. Memcarduino, Unirom, or using the Memcard Pro would currently be safe bets.

Usage

  • Copy the full memory card image corresponding to your model/BIOS to a memory card.
  • Insert it in slot 1.
  • If you have a SCPH-1002 with BIOS version 2.0: insert another memory card in slot 2 (its content doesn't matter).
  • Power up your PlayStation with the lid open, and go to the memory card manager.
  • After a few seconds, the screen will be filled with cyan. Wait ~30 seconds for the Unirom welcome screen to appear.
  • If the cyan screen doesn't appear, you have either used a wrong memory card image, or the memory card image was not written properly (the mcd file must be written as raw data to the memory card), or something else went wrong. If you are 100% certain that the memory card image was written properly, and that you are using the correct image, please open an issue.
  • Once Unirom is loaded, you can insert a CD, close the lid, and press R1 to load the game. Note: Japanese PlayStation cannot have their CD drive unlocked by Unirom, and thus cannot load backups.
  • Don't forget to remove your memory card, as its exploit will trigger into games as well. This isn't an issue when using the Memcard Pro, as it will automatically change the virtual card to the game you're booting.

Restoring the memory card

  • The most reliable way is to use Memcarduino and its FORMAT option.
  • Some games that have a save file manager (shows the contents of the memory card before saving) built into them, like OddWorld: Abe's Oddysee and Cool Boarders 4 (suffers from a caveat that keeps the game from loading the memory card with certain exploit versions) for example, can be used to overwrite FreePSXBoot when saving progress.
  • Some tools and games crash when attempting to format a memory card loaded with FreePSXBoot, but may be able to format it by first inserting a normal memory card, and switching it with the FreePSXBoot memory card just before the format operation starts.
  • We plan to bundle a complete version of Unirom in the memory card images in the future, with the ability to format memory cards.

Supported models

  • All models are supported and tested on emulator or real hardware, except the debug models (DTL-H) and Net Yaroze.
  • As of version 20210419, the exploit is 100% reliable on all supported models. Nevertheless, some exploit images were only tested on emulators and may not work on real hardware; feedback is welcome.
  • See the table below for more details and download links.

Changelog

  • 2021-04-22: Added support for BIOS 2.0 (1995-05-07), 4.0 and 4.1 (1997-11-14)
  • 2021-04-21: Added support for BIOS 1.1, and fixed BIOS 2.0 exploit (needs icache flush to work)
  • 2021-04-21: Progress bar added in stage2 payload (thanks Nicolas Noble)
  • 2021-04-20: Added support for BIOS 3.0 1996-09-09 (SCPH-5500) (thanks sickle)
  • 2021-04-19: Added support for BIOS 1.0 and 4.3 (SCPH-1000 and SCPH-100 respectively)
  • 2021-04-19: Exploit 100% reliable for every supported BIOS; now hooks an ISR (thanks sickle)
  • 2021-04-19: Unirom version updated to 8.0.F
  • 2021-04-14: Exploit uses fastload, which reads the memory card much faster than Sony's code (thanks Nicolas Noble)
  • 2021-04-12: New version of Unirom, able to load games. Huge thanks to the psxdev contributors.
  • 2021-04-11: 100% reliable exploit for the SCPH-7002, SCPH-7502 and SCPH-9002.

Information

Technical details

Demonstration

Downloads

These images are pre-built with Unirom.

There are different downloads for different BIOS versions. Please download the correct ROM for your BIOS version. If a model or BIOS version is missing, it means it is not supported yet.

As more reliable or faster versions of the exploit are developed, the images are updated. Older versions can be found in the images directory.

BIOS version/date Models 100% reliable exploit? Download Link
1.0 (1994-09-22) SCPH-1000 Yes 20210421
1.1 (1995-01-22) SCPH-3000 Yes 20210421
2.0 (1995-05-10) SCPH-1002 Yes; see note below 20210421
2.1 (1995-07-17) SCPH-1002
SCPH-3500
Yes 20210421
2.2 (1995-12-04) SCPH-1001
SCPH-1002
SCPH-5000
SCPH-5903
Yes 20210421
3.0 (1996-09-09) SCPH-5500 Yes 20210421
3.0 (1996-11-18) SCPH-5001
SCPH-5501
SCPH-5503
SCPH-7003
Yes 20210421
3.0 (1997-01-06) SCPH-5502
SCPH-5552
Yes 20210421
4.0 (1997-08-18) SCPH-7000 Yes 20210421
4.1 (1997-11-14) SCPH-7000W Yes 20210421
4.1 (1997-12-16) SCPH-7001
SCPH-7002
SCPH-7500
SCPH-7501
SCPH-7502
SCPH-7503
SCPH-9001
SCPH-9002
SCPH-9003
Yes 20210421
4.3 (2000-03-11) SCPH-100 Yes 20210421
4.4 (2000-03-24) SCPH-101
SCPH-102
Yes 20210421
4.5 (2000-05-25) SCPH-101
SCPH-102
SCPH-103
Yes 20210421

Note for BIOS 2.0 (SCPH-1002): the memory card containing FreePSXBoot must be inserted in slot 1, and another memory card must be present in slot 2. The memory card in slot 2 can have any content.

See the folder builder for a tool that can be used to generate your own payloads and memory cards.

Memory card images are raw data: your memory card must have the exact same content as the files. Use Memcarduino or something similar; don't use a memory card file manager, as it will try to correct the data we're altering.

If the exploit is successful, you will see the screen flashing orange. Otherwise, power cycle your PSX and try again after a minute or so. It may take a few tries.

The exploit works in emulators as well, and works all the time due to the memory being always initialized to 0. Tested with no$psx, pcsx-redux, and DuckStation.

Issues
  • Model and Motherboard revisions\working or not working

    Model and Motherboard revisions\working or not working

    Hello, I just wanted to share my findings with the SCPH-5501 model. I cannot find any reason why some of the PU-18 1-664-537-52 boards will not work with the exploit (Good candidates for an ODE!). They all have the following BIOS CRC-32 8d8cb7e4 BIOS Version: 3.0 Date 11/18/96. I would like others to share their findings, model, board revision, manufacture date on the bottom of the console, is the exploit working or not working, and BIOS version. Try to provide as much information as possible.

    These are all NTSC SCPH-5501 models.

    PU-18\1-664-537-62\September 1997\PSIO switchboard installed\exploit is working PU-18\1-664-537-52\September 1997\no mods\exploit is not working PU-18\1-664-537-52\September 1997\no mods\exploit is not working PU-18\1-664-537-72\March 1998\no mods\exploit is working PU-18\1-664-537-72\March 1998\no mods\exploit is working PU-18\1-664-537-52\December 1997\no mods\exploit is working PU-18\1-664-537-52\June 1997\XStation installed\exploit is working

    opened by whitezombie2000 22
  • Seizure-inducing orange screen

    Seizure-inducing orange screen

    While the payload is loading, the screen is painted orange using the 0x02 GP0 command. This works perfectly fine on an emulator, but I got a very annoying flickering on real hardware which I am not sure what could be causing it.

    This is also affecting tonyhax, which uses the same command for clearing the screen.

    opened by socram8888 14
  • I have some doubts can someone please clearified them please?

    I have some doubts can someone please clearified them please?

    When I create a Freepsxboot mc, can I use it in any ps1 and psone? (like freemcboot) or I only can use it in that model and bios version?

    This works on ntsc-j ps1 and psone consoles?

    opened by diamondhands97 13
  • Memory Card flashed with SCPH-101 BIOS v4.5 can't boot up UniROM

    Memory Card flashed with SCPH-101 BIOS v4.5 can't boot up UniROM

    I've reflashed the memory card various times with the correct .mcd image, and yet I cannot trigger a flashing orange screen and eventually a UniROM execution (the memory card icon remains filled in black). Also, I've tested the image on various PlayStation emulators including pcsx-redux, and what it only does is show a solid orange screen and then restart the BIOS when opening the memory card menu.

    opened by AdoggeWokkePupper 13
  • FFVIII Original Copy Not Booting With FreePSXBoot Memory Card in Slot 2

    FFVIII Original Copy Not Booting With FreePSXBoot Memory Card in Slot 2

    I happened upon an odd issue which I have not experienced with any other game. With version 2.0, I tend to keep my FreePSXBoot memory card plugged into slot 2 at all times. However, whenever I try to boot up an original copy of FFVIII, the game boots to a black screen. When I remove the FreePSXBoot memory card, the game boots up with no problems at all.

    opened by ParagonAlex 11
  • SCPH-5502 not working with 20210421

    SCPH-5502 not working with 20210421

    I have reformatted my cheapy Aliexpress memory card that I was using for TonyHax using MCA v2 on a ps2 (SCPH 50003). I performed a full format, selected to restore an image and used 'freepsxboot-unirom-fastload-20210421-bios-3.0-19970106.mcr'. I boot the PSX with the lid open, select the memory card manager and it just opens as normal. If I put the card back in to the PS2, MCA will see it and format it without a problem (I've tried full and fast). I tried the same process 3 times just to make sure it didn't work. I then booted an original copy of Tony Hawks 3 and started a new career with the FreePSXBoot card in slot 1 (to see what it would do if I tried to save a career). It detects the card as unformatted, asks me if I'd like to format it and saves the game, I can see the saved game block on the card after. I then tried to create the FreePSXBoot card again with MCA and the result is the same.

    opened by mjh17474 10
  • Third party MC

    Third party MC

    Hi, I'm planning to install FPSXB on a not original MC (I have a BILBO 1MB one and two 2MB MC I don't know the brand). They always worked flawlessly.

    I see there isn't any warning about third party MCs in the readme, so I should be good, right?

    One last question. After I install it (with MCA), in case there will be an update or I'd want another installation for use it on a different Ps1 model, I guess I can't just overwrite the installation, it's correct?

    I read in this other issue: https://github.com/brad-lin/FreePSXBoot/issues/31 about PSX Hacker Kit 18 in 1. If it is really reliable, I think it should be added (or at least the link on the readme).

    Thank you and sorry for grammatical mistakes (I'm not english).

    opened by Badore90 10
  • Tried 4.5 bios version on 2 PSone, able to restore memory card afterwards with PS2 and PS1 itself.

    Tried 4.5 bios version on 2 PSone, able to restore memory card afterwards with PS2 and PS1 itself.

    Just reporting that it is working fine on 2 PSOne consoles I've tried. Both with 4.5 version. With 4.4 wasn't working. Probably both consoles have latest bios revision. Tried with an old third party memory card flashed with PS2 Memory Card Annihilator v2. What I noticed is that I was able to reflash the memory card from 4.4 to 4.5 always using Memory Card Annihilator without it stopping from recognising the memory card and freezing. But then I flashed the memory card with the "bios 3.x" version to try on an SCPH-1002 PS1 and then I wasn't able to use Memory Card Annihilator anymore... Until I tried Memory Card Manager (MCM.EXE for PS1) and I was able to format the memory card and get it working normally again! You can find MCM on PAV_PSXHKB7 cd image collection to use on the console. I'll attach here only the MCM.exe MCM.zip Note: MCM won't load with the modified memory card inserted. Let the program load and then insert the memory card to format with the PS1. Tried this on a real PS1 model SCPH-1002.

    opened by Ichisuke83 10
  • Medievil 2 PAL save file corrupted on Memory card 1

    Medievil 2 PAL save file corrupted on Memory card 1

    Using Unirom with freepsxboot on Memory Card in slot 2, Medievil 2 won't allow you to load the save file from memory card 1, telling you that the save file is corrupted while is not. I'm using latest 8.0.J version. Medievil 2 is PAL version. Game works and load save file just fine if boot with Unirom through an action replay cartridge or other methods. So I think there is something wrong with how Freepsxboot disable slot 2.

    opened by Ichisuke83 8
  • Report about SCPH-102, SCPH-5502 not working

    Report about SCPH-102, SCPH-5502 not working

    Hi,

    firstly, thank you for the great project!

    Secondly, I can report that my chipped SCPH-102 PSOne works with the 4.5 payload flawlessly - only thing that is different is that the screen doesn't blink after the exploit runs. It takes approximately 10 seconds, then shows bleak yellow-ish colour and after another ~10 seconds unirom comes up. In addition, I was able to format the card back to stock with MC Annihilator v2 on my SCPH-50004 PS2, the card did not crash the console (I also wrote the exploit with this setup).

    I did the previous to test to see that my methodology is not incorrect, as the exploit does not work on my stock SCPH-5502 PAL system. I have been trying to make it work all of yesterday and even after a night with the console off and disconnected. I wasn't able to make it trigger at all, not even once.

    I have a few questions:

    • Is it possible that I have some uncommon BIOS revision on my SCPH-5502? I tried like 30 times and I didn't get the feeling that the exploit would be that unreliable.
    • Is the only blocker for the 100% reliable exploit that you need testers? If it is so, I'm willing to test whatever you throw out there.

    Thank you for any useful pointers :)

    // EDIT: Also I forgot to mention, on my SCPH-102, when I select the memory card icon, it fades to black and stays like that, on the SCPH-5502, the memory card square icon fades to black and then reappears, afterwards the console freezes.

    // EDIT2: Still no dice on the SCPH-5502. I have tried the 5501/5503/etc exploit version and it just goes into the memory card manager.

    opened by kubik369 8
  • Not working on a SCPH-102 (with modchip) - 5502 works fine !

    Not working on a SCPH-102 (with modchip) - 5502 works fine !

    I tested it in my SCPH-5502 (without modchip) and it works every time (I renamed the .mcd to .mcr and wrote it with my PS2 Slim using Memory Card Annihilator v2.0. I tested it many times in my SCPH-102 (with modchip) without success (hangs after hitting the memory card icon); I used the same writing method as for SCPH-5502. Is modchip a problem ?

    JFYI: I also managed to correctly format and restore the memory card using the full format under Memory Card Annihilator v2.0 so the memory card was usable again.

    opened by buggii 8
  • Boot disc not progressing

    Boot disc not progressing

    Stuck on the screen that appears after trying to boot the disc. Unirom is booting fine, but it cannot get past the boot disc screen and simply says "Seeking 2". Occurs with multiple types of CD R disc, written at different write speeds. Is not completely frozen either as unclosing the disc drive reverts it back to the initial stage in the booting process where it asks for the disc drive to be closed. SCHP 1002 2.2 bios PAL 2nd slot. Installed to Mcard via Mcardannihiliator on PS2.

    opened by PSXissues 0
  • SCPH-7502 does not proceed to cyan screen

    SCPH-7502 does not proceed to cyan screen

    I'm trying to make FreePSXBoot work on a thrift store SCPH-7502 which appears to be unmodded and otherwise functional.

    I burned what looks like a genuine Sony card with "Auto install" from the latest Unirom boot disc (8.0J, with swap trick), validation passes and the memory card manager shows FreePSXBoot installed. After booting with the lid open and card in slot 2, I press X on "memory card", the text turns black and then white as usual, and after that nothing happens. The BIOS menu remains on screen while the device appears hung. Device is connected with the stock composite cable to a TV which should be able to handle PAL and NTSC, OSD shows PAL 576i in the hung state.

    I tried reformatting the card and reinstalling in both slots, but behavior remains the same. I also tried running manual install with the .mcd file matching the BIOS CRC. In Unirom's memcard manager, the first slot has a white square, about half of the remaining slots have "noise", then blue squares and the final slot is again white.

    BIOS information from Unirom is shown below. Anything that I could do to debug this? I don't have a serial cable, but can burn an edited boot disc.

    ps1

    edit: a newer .mcd from Github burned onto the card with MCA 2.0 on a PS2 has the same result.

    edit 2: Tested builder-built images from master with a custom Unirom boot cd for both slot 1 and 2, always hangs at the same location. PS1 board is PU-22, memcard looks genuine on the inside with NEC and Atmel chips.

    opened by vuori 0
  • SCPH-1000 Requires Removing Exploited Memory Card In Slot 2 To Successfully Boot Games That Access Memory Cards

    SCPH-1000 Requires Removing Exploited Memory Card In Slot 2 To Successfully Boot Games That Access Memory Cards

    Hello, I have a SCPH-1000 with BIOS v1.0.

    Me and another developer MottZilla have come up with a custom Tonyhax loader that supports all Japanese PSX consoles, including the SCPH-1000 for the first time ever.

    Everything works great exploit wise from a Memory card in slot 2 on the SCPH-1000. But if I leave the memory card in slot 2 and have our loader boot something like Dead Or Alive (which checks memory card data at boot) the screen goes black and the game never boots. Our 'solution' is to prompt users to remove the memory card while in the loader before they swap discs and boot the game. Some games don't need this, AFAICT games that don't access the memory card. Those boot fine.

    The SCPH-1001 I have with BIOS v2.0 doesn't need this for any games and works as expected so this is a VC0 console issue. Our Tonyhax loader sources are at https://github.com/alex-free/tonyhax. More on our implementation is at https://alex-free.github.io/ps1demoswap. I am able to test anything on the 1000 that you can come up with to solve this issue.

    opened by alex-free 0
  • ntsc scph-9001 boots to orange screen and hangs

    ntsc scph-9001 boots to orange screen and hangs

    scph-9001, board PU-23, official sony memory card installation method: unirom 8.0.J boot disc swap method install to memcard slot2

    exploit seems to run, cyan screen, then hangs on an orange screen and never progresses? card writing verifies just fine on unirom boot disc, i've formatted and re-written it a couple times now, still failing.

    opened by Toxithot 0
  • RGB/HDMI support

    RGB/HDMI support

    I use a Bitfunx HDMI adapter (RGB signal), which works wonderfully. Unfortunately, there are problems when I start Unirom (screen stays black). I suspect that the resolution is no longer compatible from that point. Is it possible that the next update you choose a resolution that could then work with the Bitfunx? Thanks a lot!

    opened by RealBanlog 1
Releases(v2.0)
Online version of the greatest card game known to man

10Flips Online version of the greatest card game known to man Client The client is made using Emscripten. Installing # Get the emsdk repo git clone ht

Oskar Mendel 2 Oct 26, 2021
NeoGB Printer an SD card-based standalone Game Boy Printer emulator.

An open-source and standalone Gameboy Printer emulator 100% compatible with all officially released games (110 in total) that support the accessory. Just print and save the images as BMP

Rafael Zenaro 61 Jun 15, 2022
Magarena is a single-player fantasy card game played against a computer opponent.

Magarena is a single-player fantasy card game played against a computer opponent.

MagArena 351 Jun 26, 2022
How to use Live Update to improve the load speed of HTML5 game.

ResZip: use Live Update to improve load speed of HTML5 game In short, HTML5 games should load as fast as possible! Why -> https://vimeo.com/350139974

Indiesoft LLC 17 May 5, 2022
This tool allow you to create / load / edit models used for create a cinematic in game for World of Warcraft 3.3.5 version

CameraCinematic - Discord Introduction This tool allow you to create / load / edit models used for create a cinematic in game for World of Warcraft 3.

Intemporel 9 Mar 14, 2022
PS1 savegame exploit using THPS3

tonyhax Software backup loader exploit thing for the Sony PlayStation 1. For installing on a memory card, you'd need both the generic tonyhax SPL save

Marcos Del Sol Vives 344 Jun 9, 2022
Freecell Solver - a C library for automatically solving Freecell and some other variants of card Solitaire

The Freecell Solver Repository Root README Freecell Solver is an open source (distributed under the MIT/Expat licence) library, written in C, for atte

Shlomi Fish 48 May 31, 2022
A foobar2000 component which allows you to load and play ncm files directly.

Play NCM files directly with our favourite How to setup and build project Download foobar2000 SDK and extract into vendor/sdk Download WTL from source

null 33 Jun 7, 2022
Improved version of the X-Ray Engine, the game engine used in the world-famous S.T.A.L.K.E.R. game series by GSC Game World.

OpenXRay OpenXRay is an improved version of the X-Ray Engine, the game engine used in the world-famous S.T.A.L.K.E.R. game series by GSC Game World. S

null 2k Jun 29, 2022
Stealthy way to hijack the existing game process handle within the game launcher (currently supports Steam and Battle.net). Achieve external game process read/write with minimum footprint.

Launcher Abuser Stealthy way to hijack the existing game process handle within the game launcher (currently supports Steam and Battle.net). Achieve ex

Ricardo Nacif 74 May 8, 2022
Game Boy, Game Boy Color, and Game Boy Advanced Emulator

SkyEmu SkyEmu is low level cycle accurate GameBoy, GameBoy Color and Game Boy Advance emulator that I have been developing in my spare time. Its prima

Sky 60 Jun 19, 2022
A game made for the Game (Engineless) Jam using Raylib

Fastest Pizza Delivery A fun little 3D game made for the Game (Engineless) Jam. It is still is development but the basic gameplay is something l

Ryuzaki 2 Apr 3, 2022
VE Font Cache is a single header-only GPU font rendering library designed for game engines.

VE Font Cache is a single header-only GPU font rendering library designed for game engines. It aims to: Be fast and simple to integrate. Take advantag

Xi Ma Chen 340 Jun 22, 2022
A tic-tac-toe game made only in flutter

Tic Tac Toe Game A simple Flutter Tic tac toe game made for educational purpose. the main goal of this project is to teach the importance of data stru

Mouheb Boucherb 21 Jun 20, 2022
A cross-platform, top-down 2D space shooter written in C using only system libraries.

A cross-platform, top-down 2D space shooter written in C using only system libraries.

Tarek Sherif 1.3k Jun 25, 2022
A cycle-accurate Game Boy and Game Boy Color Emulator, with rewind feature.

Azayaka is a free and open-source Game Boy and Game Boy Color emulator written in C++. Features Cycle-Accurate emulation. Console based Debugg

Zach Collins 14 Dec 16, 2021
The Game Boy ROM of the Game Boy bitcoin miner!

game-boy-bitcoin-miner The Game Boy ROM of the Game Boy bitcoin miner! To build this, currently this patch needs to be applied to GBDK: https://gist.g

Ghidra Ninja 78 May 29, 2022
CLUSEK-RT is a complex game engine written in C++ and the successor of the CLUSEK game engine

CLUSEK-RT is a complex game engine written in C++ and the successor of the CLUSEK game engine. This engine has been designed with a cross-platform design in mind. Thanks to Vulkan API it delivers a next-gen experience with ray tracing to both Linux and Windows platforms

Jakub BiliƄski 27 Jun 12, 2022
Ground Engine is an easy to use Game Engine for 3D Game Development written in C++

Ground Engine is an easy to use Game Engine Framework for 3D Game Development written in C++. It's currently under development and its creation will b

 PardCode 51 Jun 10, 2022