Exploit allowing to load arbitrary code on the PSX using only a memory card (no game needed)

Last update: Jan 2, 2023

Related tags

Overview

FreePSXBoot

Exploit allowing to load arbitrary code on the PSX (i.e. PlayStation 1) using only a memory card (no game needed).

In other words, it's a softmod which requires a memory card, and a way to write raw data to it.

To use it, you will need a way to copy full memory card images (not individual files) to a memory card. Some possibilities are:

A PS2 and the software Memory Card Annihilator v2 (use "Restore MC image")
Memcarduino. Requires soldering wires to the memory card.
Using a Memcard Pro, which lets you create your own virtual memory cards on an sdcard. Simply drop the card image file you want to use as Memory Card 1, Channel 1.
Using Unirom and NOTPSXserial with a serial/USB cable, using the command : nops /fast /mcup 0 FILE.mcd COMPORT where FILE is the mcd file corresponding to your model, and COMPORT corresponds to your computer serial port.
Memcarduino with MemcardRex (success not guaranteed)
A DexDrive with PSXGameEdit (success not guaranteed)

WARNING

By flashing FreePSXBoot to your Memory Card, you need to be aware of the following:

The .mcd image files replace the whole contents of your card, meaning that your Memory Card will be ENTIRELY WIPED after flashing a .mcd image, so creating a backup of your saves is compulsory.
Because the exploit has corrupt Memory Card filesystem on purpose for it to run, your card will become unusable for normal operations. That is, you won't be able to use this card for saving and loading game saves and it will cause crashes on your PS1 or your PS2 console (if you have any).
Once installed, it may become difficult to uninstall, as the normal software to re-format a memory card won't work, due to the exploit itself. You could end up with no means to recover the memory card; if for example your installation method was Memory Card Annihilator v2, then it will also crash. Memcarduino, Unirom, or using the Memcard Pro would currently be safe bets.

Usage

Copy the full memory card image corresponding to your model/BIOS to a memory card.
Insert it in slot 1.
If you have a SCPH-1002 with BIOS version 2.0: insert another memory card in slot 2 (its content doesn't matter).
Power up your PlayStation with the lid open, and go to the memory card manager.
After a few seconds, the screen will be filled with cyan. Wait ~30 seconds for the Unirom welcome screen to appear.
If the cyan screen doesn't appear, you have either used a wrong memory card image, or the memory card image was not written properly (the mcd file must be written as raw data to the memory card), or something else went wrong. If you are 100% certain that the memory card image was written properly, and that you are using the correct image, please open an issue.
Once Unirom is loaded, you can insert a CD, close the lid, and press R1 to load the game. Note: Japanese PlayStation cannot have their CD drive unlocked by Unirom, and thus cannot load backups.
Don't forget to remove your memory card, as its exploit will trigger into games as well. This isn't an issue when using the Memcard Pro, as it will automatically change the virtual card to the game you're booting.

Restoring the memory card

The most reliable way is to use Memcarduino and its FORMAT option.
Some games that have a save file manager (shows the contents of the memory card before saving) built into them, like OddWorld: Abe's Oddysee and Cool Boarders 4 (suffers from a caveat that keeps the game from loading the memory card with certain exploit versions) for example, can be used to overwrite FreePSXBoot when saving progress.
Some tools and games crash when attempting to format a memory card loaded with FreePSXBoot, but may be able to format it by first inserting a normal memory card, and switching it with the FreePSXBoot memory card just before the format operation starts.
We plan to bundle a complete version of Unirom in the memory card images in the future, with the ability to format memory cards.

Supported models

All models are supported and tested on emulator or real hardware, except the debug models (DTL-H) and Net Yaroze.
As of version 20210419, the exploit is 100% reliable on all supported models. Nevertheless, some exploit images were only tested on emulators and may not work on real hardware; feedback is welcome.
See the table below for more details and download links.

Changelog

2021-04-22: Added support for BIOS 2.0 (1995-05-07), 4.0 and 4.1 (1997-11-14)
2021-04-21: Added support for BIOS 1.1, and fixed BIOS 2.0 exploit (needs icache flush to work)
2021-04-21: Progress bar added in stage2 payload (thanks Nicolas Noble)
2021-04-20: Added support for BIOS 3.0 1996-09-09 (SCPH-5500) (thanks sickle)
2021-04-19: Added support for BIOS 1.0 and 4.3 (SCPH-1000 and SCPH-100 respectively)
2021-04-19: Exploit 100% reliable for every supported BIOS; now hooks an ISR (thanks sickle)
2021-04-19: Unirom version updated to 8.0.F
2021-04-14: Exploit uses fastload, which reads the memory card much faster than Sony's code (thanks Nicolas Noble)
2021-04-12: New version of Unirom, able to load games. Huge thanks to the psxdev contributors.
2021-04-11: 100% reliable exploit for the SCPH-7002, SCPH-7502 and SCPH-9002.

Information

Technical details

Demonstration

Downloads

These images are pre-built with Unirom.

There are different downloads for different BIOS versions. Please download the correct ROM for your BIOS version. If a model or BIOS version is missing, it means it is not supported yet.

As more reliable or faster versions of the exploit are developed, the images are updated. Older versions can be found in the images directory.

BIOS version/date	Models	100% reliable exploit?	Download Link
1.0 (1994-09-22)	SCPH-1000	Yes	20210421
1.1 (1995-01-22)	SCPH-3000	Yes	20210421
2.0 (1995-05-10)	SCPH-1002	Yes; see note below	20210421
2.1 (1995-07-17)	SCPH-1002 SCPH-3500	Yes	20210421
2.2 (1995-12-04)	SCPH-1001 SCPH-1002 SCPH-5000 SCPH-5903	Yes	20210421
3.0 (1996-09-09)	SCPH-5500	Yes	20210421
3.0 (1996-11-18)	SCPH-5001 SCPH-5501 SCPH-5503 SCPH-7003	Yes	20210421
3.0 (1997-01-06)	SCPH-5502 SCPH-5552	Yes	20210421
4.0 (1997-08-18)	SCPH-7000	Yes	20210421
4.1 (1997-11-14)	SCPH-7000W	Yes	20210421
4.1 (1997-12-16)	SCPH-7001 SCPH-7002 SCPH-7500 SCPH-7501 SCPH-7502 SCPH-7503 SCPH-9001 SCPH-9002 SCPH-9003	Yes	20210421
4.3 (2000-03-11)	SCPH-100	Yes	20210421
4.4 (2000-03-24)	SCPH-101 SCPH-102	Yes	20210421
4.5 (2000-05-25)	SCPH-101 SCPH-102 SCPH-103	Yes	20210421

Note for BIOS 2.0 (SCPH-1002): the memory card containing FreePSXBoot must be inserted in slot 1, and another memory card must be present in slot 2. The memory card in slot 2 can have any content.

See the folder builder for a tool that can be used to generate your own payloads and memory cards.

Memory card images are raw data: your memory card must have the exact same content as the files. Use Memcarduino or something similar; don't use a memory card file manager, as it will try to correct the data we're altering.

If the exploit is successful, you will see the screen flashing orange. Otherwise, power cycle your PSX and try again after a minute or so. It may take a few tries.

The exploit works in emulators as well, and works all the time due to the memory being always initialized to 0. Tested with no$psx, pcsx-redux, and DuckStation.

Comments

$Model and Motherboard revisions\working or not working$

Model and Motherboard revisions\working or not working

Hello, I just wanted to share my findings with the SCPH-5501 model. I cannot find any reason why some of the PU-18 1-664-537-52 boards will not work with the exploit (Good candidates for an ODE!). They all have the following BIOS CRC-32 8d8cb7e4 BIOS Version: 3.0 Date 11/18/96. I would like others to share their findings, model, board revision, manufacture date on the bottom of the console, is the exploit working or not working, and BIOS version. Try to provide as much information as possible.

These are all NTSC SCPH-5501 models.

PU-18\1-664-537-62\September 1997\PSIO switchboard installed\exploit is working PU-18\1-664-537-52\September 1997\no mods\exploit is not working PU-18\1-664-537-52\September 1997\no mods\exploit is not working PU-18\1-664-537-72\March 1998\no mods\exploit is working PU-18\1-664-537-72\March 1998\no mods\exploit is working PU-18\1-664-537-52\December 1997\no mods\exploit is working PU-18\1-664-537-52\June 1997\XStation installed\exploit is working

opened by whitezombie2000 22
Stuck on Cyan Screen

Hello, I've been trying to softmod my NTSC-J SCPH-7000 using tonyhax intl. and FreePSXBoot. After following the instructions on orca.pet, I successfully restored the MCR image to my PSX memory card in MCA. But I panicked and formatted the card because I realized my games had anti-modchip. After failing to find other softmod methods, I double-took and restored the image. I'm afraid now that I may have screwed up because the application freezes at the cyan screen. Did I brick the memory card? Will I have to use another image instead of the one that corresponds with my console model?

opened by HonkHonkBich 19
Seizure-inducing orange screen

While the payload is loading, the screen is painted orange using the 0x02 GP0 command. This works perfectly fine on an emulator, but I got a very annoying flickering on real hardware which I am not sure what could be causing it.

This is also affecting tonyhax, which uses the same command for clearing the screen.

opened by socram8888 14
I have some doubts can someone please clearified them please?

When I create a Freepsxboot mc, can I use it in any ps1 and psone? (like freemcboot) or I only can use it in that model and bios version?

This works on ntsc-j ps1 and psone consoles?

opened by diamondhands97 13
Memory Card flashed with SCPH-101 BIOS v4.5 can't boot up UniROM

I've reflashed the memory card various times with the correct .mcd image, and yet I cannot trigger a flashing orange screen and eventually a UniROM execution (the memory card icon remains filled in black). Also, I've tested the image on various PlayStation emulators including pcsx-redux, and what it only does is show a solid orange screen and then restart the BIOS when opening the memory card menu.

opened by AdoggeWokkePupper 13
FFVIII Original Copy Not Booting With FreePSXBoot Memory Card in Slot 2

I happened upon an odd issue which I have not experienced with any other game. With version 2.0, I tend to keep my FreePSXBoot memory card plugged into slot 2 at all times. However, whenever I try to boot up an original copy of FFVIII, the game boots to a black screen. When I remove the FreePSXBoot memory card, the game boots up with no problems at all.

opened by ParagonAlex 11
SCPH-5502 not working with 20210421

I have reformatted my cheapy Aliexpress memory card that I was using for TonyHax using MCA v2 on a ps2 (SCPH 50003). I performed a full format, selected to restore an image and used 'freepsxboot-unirom-fastload-20210421-bios-3.0-19970106.mcr'. I boot the PSX with the lid open, select the memory card manager and it just opens as normal. If I put the card back in to the PS2, MCA will see it and format it without a problem (I've tried full and fast). I tried the same process 3 times just to make sure it didn't work. I then booted an original copy of Tony Hawks 3 and started a new career with the FreePSXBoot card in slot 1 (to see what it would do if I tried to save a career). It detects the card as unformatted, asks me if I'd like to format it and saves the game, I can see the saved game block on the card after. I then tried to create the FreePSXBoot card again with MCA and the result is the same.

opened by mjh17474 10
Third party MC

Hi, I'm planning to install FPSXB on a not original MC (I have a BILBO 1MB one and two 2MB MC I don't know the brand). They always worked flawlessly.

I see there isn't any warning about third party MCs in the readme, so I should be good, right?

One last question. After I install it (with MCA), in case there will be an update or I'd want another installation for use it on a different Ps1 model, I guess I can't just overwrite the installation, it's correct?

I read in this other issue: https://github.com/brad-lin/FreePSXBoot/issues/31 about PSX Hacker Kit 18 in 1. If it is really reliable, I think it should be added (or at least the link on the readme).

Thank you and sorry for grammatical mistakes (I'm not english).

opened by Badore90 10
Tried 4.5 bios version on 2 PSone, able to restore memory card afterwards with PS2 and PS1 itself.

Just reporting that it is working fine on 2 PSOne consoles I've tried. Both with 4.5 version. With 4.4 wasn't working. Probably both consoles have latest bios revision. Tried with an old third party memory card flashed with PS2 Memory Card Annihilator v2. What I noticed is that I was able to reflash the memory card from 4.4 to 4.5 always using Memory Card Annihilator without it stopping from recognising the memory card and freezing. But then I flashed the memory card with the "bios 3.x" version to try on an SCPH-1002 PS1 and then I wasn't able to use Memory Card Annihilator anymore... Until I tried Memory Card Manager (MCM.EXE for PS1) and I was able to format the memory card and get it working normally again! You can find MCM on PAV_PSXHKB7 cd image collection to use on the console. I'll attach here only the MCM.exe MCM.zip Note: MCM won't load with the modified memory card inserted. Let the program load and then insert the memory card to format with the PS1. Tried this on a real PS1 model SCPH-1002.

opened by Ichisuke83 10
Medievil 2 PAL save file corrupted on Memory card 1

Using Unirom with freepsxboot on Memory Card in slot 2, Medievil 2 won't allow you to load the save file from memory card 1, telling you that the save file is corrupted while is not. I'm using latest 8.0.J version. Medievil 2 is PAL version. Game works and load save file just fine if boot with Unirom through an action replay cartridge or other methods. So I think there is something wrong with how Freepsxboot disable slot 2.

opened by Ichisuke83 8
Report about SCPH-102, SCPH-5502 not working
Hi,

firstly, thank you for the great project!

Secondly, I can report that my chipped SCPH-102 PSOne works with the 4.5 payload flawlessly - only thing that is different is that the screen doesn't blink after the exploit runs. It takes approximately 10 seconds, then shows bleak yellow-ish colour and after another ~10 seconds unirom comes up. In addition, I was able to format the card back to stock with MC Annihilator v2 on my SCPH-50004 PS2, the card did not crash the console (I also wrote the exploit with this setup).

I did the previous to test to see that my methodology is not incorrect, as the exploit does not work on my stock SCPH-5502 PAL system. I have been trying to make it work all of yesterday and even after a night with the console off and disconnected. I wasn't able to make it trigger at all, not even once.

I have a few questions:

Is it possible that I have some uncommon BIOS revision on my SCPH-5502? I tried like 30 times and I didn't get the feeling that the exploit would be that unreliable.

Is the only blocker for the 100% reliable exploit that you need testers? If it is so, I'm willing to test whatever you throw out there.

Thank you for any useful pointers :)

// EDIT: Also I forgot to mention, on my SCPH-102, when I select the memory card icon, it fades to black and stays like that, on the SCPH-5502, the memory card square icon fades to black and then reappears, afterwards the console freezes.

// EDIT2: Still no dice on the SCPH-5502. I have tried the 5501/5503/etc exploit version and it just goes into the memory card manager.
opened by kubik369 8

std::memcpy -> memcpy

Current code is causing compilation errors in Debian bookworm. Replacing std::memcpy with just memcpy (as the rest of the memcpy calls are) fixed the issue.

builder.cc: In function ‘void createImage(ImageSettings, const uint8_t*, uint32_t)’:
builder.cc:693:14: error: ‘memcpy’ is not a member of ‘std’; did you mean ‘wmemcpy’?
  693 |         std::memcpy(out.data() + out.size() / 2, out.data(), out.size() / 2);
      |              ^~~~~~
      |              wmemcpy

opened by socram8888 3

i flashed the wrong file

my dumbass flashed the wrong file to my card there was 2 files for scph-101 i used the first one and when i pressed the memory card tab on my ps1 it just made the memory card icon black how do i reformat the card because every time i load up mca it just crashes if i have the card in my ps2

opened by pillowyfish98 6
Fix compiling on Fedora Linux

Fixes this error:

g++ -o builder builder.cc -std=c++17 -I. builder.cc: In function ‘void createImage(ImageSettings, const uint8_t*, uint32_t)’: builder.cc:693:14: error: ‘memcpy’ is not a member of ‘std’; did you mean ‘wmemcpy’? 693 | std::memcpy(out.data() + out.size() / 2, out.data(), out.size() / 2); | ^~~~~~ | wmemcpy make[2]: *** [Makefile:4: builder] Error 1

When compiling on Fedora Linux 36 using standard g++ from dnf. Output of Fedora's g++ with the -v argument is below:

Using built-in specs. COLLECT_GCC=g++ COLLECT_LTO_WRAPPER=/usr/libexec/gcc/x86_64-redhat-linux/12/lto-wrapper OFFLOAD_TARGET_NAMES=nvptx-none OFFLOAD_TARGET_DEFAULT=1 Target: x86_64-redhat-linux Configured with: ../configure --enable-bootstrap --enable-languages=c,c++,fortran,objc,obj-c++,ada,go,d,lto --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --with-bugurl=http://bugzilla.redhat.com/bugzilla --enable-shared --enable-threads=posix --enable-checking=release --enable-multilib --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-gnu-unique-object --enable-linker-build-id --with-gcc-major-version-only --enable-libstdcxx-backtrace --with-linker-hash-style=gnu --enable-plugin --enable-initfini-array --with-isl=/builddir/build/BUILD/gcc-12.2.1-20220819/obj-x86_64-redhat-linux/isl-install --enable-offload-targets=nvptx-none --without-cuda-driver --enable-offload-defaulted --enable-gnu-indirect-function --enable-cet --with-tune=generic --with-arch_32=i686 --build=x86_64-redhat-linux --with-build-config=bootstrap-lto --enable-link-serialization=1 Thread model: posix Supported LTO compression algorithms: zlib zstd gcc version 12.2.1 20220819 (Red Hat 12.2.1-1) (GCC)

opened by alex-free 0
i have 5552 with freepsxboot, games don't work (SOLVED)

i have 5552 with freepsxboot, after press boot with back up cd it doesn't work.( İt stucks screen at that writing ou remain memory slot 2...) i tried same cd with epsxe, it worked. And also i have a original cd. It worked with freepsxboot. The only thing that i wonder: i need a new lens? Or is there another problem?

opened by Soner555 1
Certain games won't load

My psone 4.5 model only seems to load up toy story and very few games. I've installed the exploit onto those cheap fake memcards sold on eBay.

It loads up fine on unirom. But the resident evil trilogy refuses to work.

What am I doing wrong? The games are NTSC from vimmr lair and I burn on verbatim CD-R at the lowest speed possible

opened by CloudTF25 2
SCPH-7001

Does this version of the console have issues with "Backup Disks"? My PSone (SCPH-101) can read backup disks both Japan and USA fine burned at 8x. The 7001 reads USA disks but stutters doing it. Japan, it stops reading at the publishing credit. Otherwise it reads real PS disks just fine. Do I need to start burning at 2x or something like that?

Thanx

opened by acidrain97 1

Releases(v2.1)

v2.1(Sep 19, 2022)

This release comes with a new version of Unirom (8.0.K).

It also fixes a bug with slot 2 images: the kernel patch now emulates the absence of the memory card, rather than sending unexpected responses (which some gam es can't handle and hang).

Finally, the memory card images now contain the payload duplicated. This allows FreePSXBoot to work even with fake memory cards with a capacity of 64 kB instead of 128 kB.

| BIOS version/region | BIOS CRC32 | Models | Image file | |---------------------|------------|--------|------------| | 1.0 (1994-09-22) I | 3b601fc8 | SCPH-1000 | freepsxboot-unirom-fastload-20220919-bios-1.0-1994-09-22-I-3b601fc8 | | 1.1 (1995-01-22) I | 3539def6 | SCPH-3000 | freepsxboot-unirom-fastload-20220919-bios-1.1-1995-01-22-I-3539def6 | | 2.0 (1995-05-07) A | 55847d8c | SCPH-1001 | freepsxboot-unirom-fastload-20220919-bios-2.0-1995-05-07-A-55847d8c | | 2.0 (1995-05-10) E | 9bb87c4b | SCPH-1002 | freepsxboot-unirom-fastload-20220919-bios-2.0-1995-05-10-E-9bb87c4b | | 2.1 (1995-07-17) A | aff00f2f | SCPH-1001 | freepsxboot-unirom-fastload-20220919-bios-2.1-1995-07-17-A-aff00f2f | | 2.1 (1995-07-17) E | 86c30531 | SCPH-1002 | freepsxboot-unirom-fastload-20220919-bios-2.1-1995-07-17-E-86c30531 | | 2.1 (1995-07-17) I | bc190209 | SCPH-3500 | freepsxboot-unirom-fastload-20220919-bios-2.1-1995-07-17-I-bc190209 | | 2.2 (1995-12-04) A | 37157331 | SCPH-1001
SCPH-5003 | freepsxboot-unirom-fastload-20220919-bios-2.2-1995-12-04-A-37157331 | | 2.2 (1995-12-04) E | 1e26792f | SCPH-1002 | freepsxboot-unirom-fastload-20220919-bios-2.2-1995-12-04-E-1e26792f | | 2.2 (1995-12-04) I | 24fc7e17 | SCPH-5000 | freepsxboot-unirom-fastload-20220919-bios-2.2-1995-12-04-I-24fc7e17 | | 3.0 (1996-09-09) I | ff3eeb8c | SCPH-5500 | freepsxboot-unirom-fastload-20220919-bios-3.0-1996-09-09-I-ff3eeb8c | | 3.0 (1996-11-18) A | 8d8cb7e4 | SCPH-5001
SCPH-5501
SCPH-5503
SCPH-7003 | freepsxboot-unirom-fastload-20220919-bios-3.0-1996-11-18-A-8d8cb7e4 | | 3.0 (1997-01-06) E | d786f0b9 | SCPH-5502
SCPH-5552 | freepsxboot-unirom-fastload-20220919-bios-3.0-1997-01-06-E-d786f0b9 | | 4.0 (1997-08-18) I | ec541cd0 | SCPH-7000
SCPH-7500
SCPH-9000 | freepsxboot-unirom-fastload-20220919-bios-4.0-1997-08-18-I-ec541cd0 | | 4.1 (1997-11-14) A | b7c43dad | SCPH-7000W | freepsxboot-unirom-fastload-20220919-bios-4.1-1997-11-14-A-b7c43dad | | 4.1 (1997-12-16) A | 502224b6 | SCPH-7001
SCPH-7501
SCPH-7503
SCPH-9001
SCPH-9003
SCPH-9903 | freepsxboot-unirom-fastload-20220919-bios-4.1-1997-12-16-A-502224b6 | | 4.1 (1997-12-16) E | 318178bf | SCPH-7002
SCPH-7502
SCPH-9002 | freepsxboot-unirom-fastload-20220919-bios-4.1-1997-12-16-E-318178bf | | 4.3 (2000-03-11) I | f2af798b | SCPH-100 | freepsxboot-unirom-fastload-20220919-bios-4.3-2000-03-11-I-f2af798b | | 4.4 (2000-03-24) A | 6a0e22a0 | SCPH-101 | freepsxboot-unirom-fastload-20220919-bios-4.4-2000-03-24-A-6a0e22a0 | | 4.4 (2000-03-24) E | 0bad7ea9 | SCPH-102 | freepsxboot-unirom-fastload-20220919-bios-4.4-2000-03-24-E-0bad7ea9 | | 4.5 (2000-05-25) A | 171bdcec | SCPH-101
SCPH-103 | freepsxboot-unirom-fastload-20220919-bios-4.5-2000-05-25-A-171bdcec | | 4.5 (2000-05-25) E | 76b880e5 | SCPH-102 | freepsxboot-unirom-fastload-20220919-bios-4.5-2000-05-25-E-76b880e5 |

Please read the README.md file for installation instructions (and warnings).
Source code(tar.gz)
Source code(zip)
freepsxboot-2.1.zip(4.57 MB)
v2.0(Jul 7, 2021)
This release provides memory card image files containing FreePSXBoot with Unirom 8.0.I.

Memory card images are now provided for slot 1 and slot 2. The memory card must then be plugged in the corresponding slot. Using slot 2 images is recommended, as the memory card can be left plugged in while playing. When launched, FreePSXBoot patches the PlayStation kernel to make games believe there is no memory card in slot 2, avoiding issues when loading or saving games.

Slot 1 images should be used only when using a Memcard Pro, or in case of problem with the slot 2 image. More information can be found in the README.

Changes since last version:

2021-07-03: FreePSXBoot patches the kernel when run from slot 2 (memory card can remain inserted)

2021-07-03: Exploit updated to work on slot 2

2021-07-03: Unirom version updated to 8.0.I

Use the image file corresponding to your model. If a model has multiple BIOS versions, they can be tried one by one, or the Unirom bootdisc can be used in conjunction with the disc swap trick.

| BIOS version/region | BIOS CRC32 | Models | Image file | |---------------------|------------|--------|------------| | 1.0 (1994-09-22) I | 3b601fc8 | SCPH-1000 | freepsxboot-unirom-fastload-20210703-bios-1.0-1994-09-22-I-3b601fc8 | | 1.1 (1995-01-22) I | 3539def6 | SCPH-3000 | freepsxboot-unirom-fastload-20210703-bios-1.1-1995-01-22-I-3539def6 | | 2.0 (1995-05-07) A | 55847d8c | SCPH-1001 | freepsxboot-unirom-fastload-20210703-bios-2.0-1995-05-07-A-55847d8c | | 2.0 (1995-05-10) E | 9bb87c4b | SCPH-1002 | freepsxboot-unirom-fastload-20210703-bios-2.0-1995-05-10-E-9bb87c4b | | 2.1 (1995-07-17) A | aff00f2f | SCPH-1001 | freepsxboot-unirom-fastload-20210703-bios-2.1-1995-07-17-A-aff00f2f | | 2.1 (1995-07-17) E | 86c30531 | SCPH-1002 | freepsxboot-unirom-fastload-20210703-bios-2.1-1995-07-17-E-86c30531 | | 2.1 (1995-07-17) I | bc190209 | SCPH-3500 | freepsxboot-unirom-fastload-20210703-bios-2.1-1995-07-17-I-bc190209 | | 2.2 (1995-12-04) A | 37157331 | SCPH-1001
SCPH-5003 | freepsxboot-unirom-fastload-20210703-bios-2.2-1995-12-04-A-37157331 | | 2.2 (1995-12-04) E | 1e26792f | SCPH-1002 | freepsxboot-unirom-fastload-20210703-bios-2.2-1995-12-04-E-1e26792f | | 2.2 (1995-12-04) I | 24fc7e17 | SCPH-5000 | freepsxboot-unirom-fastload-20210703-bios-2.2-1995-12-04-I-24fc7e17 | | 3.0 (1996-09-09) I | ff3eeb8c | SCPH-5500 | freepsxboot-unirom-fastload-20210703-bios-3.0-1996-09-09-I-ff3eeb8c | | 3.0 (1996-11-18) A | 8d8cb7e4 | SCPH-5001
SCPH-5501
SCPH-5503
SCPH-7003 | freepsxboot-unirom-fastload-20210703-bios-3.0-1996-11-18-A-8d8cb7e4 | | 3.0 (1997-01-06) E | d786f0b9 | SCPH-5502
SCPH-5552 | freepsxboot-unirom-fastload-20210703-bios-3.0-1997-01-06-E-d786f0b9 | | 4.0 (1997-08-18) I | ec541cd0 | SCPH-7000
SCPH-7500
SCPH-9000 | freepsxboot-unirom-fastload-20210703-bios-4.0-1997-08-18-I-ec541cd0 | | 4.1 (1997-11-14) A | b7c43dad | SCPH-7000W | freepsxboot-unirom-fastload-20210703-bios-4.1-1997-11-14-A-b7c43dad | | 4.1 (1997-12-16) A | 502224b6 | SCPH-7001
SCPH-7501
SCPH-7503
SCPH-9001
SCPH-9003
SCPH-9903 | freepsxboot-unirom-fastload-20210703-bios-4.1-1997-12-16-A-502224b6 | | 4.1 (1997-12-16) E | 318178bf | SCPH-7002
SCPH-7502
SCPH-9002 | freepsxboot-unirom-fastload-20210703-bios-4.1-1997-12-16-E-318178bf | | 4.3 (2000-03-11) I | f2af798b | SCPH-100 | freepsxboot-unirom-fastload-20210703-bios-4.3-2000-03-11-I-f2af798b | | 4.4 (2000-03-24) A | 6a0e22a0 | SCPH-101 | freepsxboot-unirom-fastload-20210703-bios-4.4-2000-03-24-A-6a0e22a0 | | 4.4 (2000-03-24) E | 0bad7ea9 | SCPH-102 | freepsxboot-unirom-fastload-20210703-bios-4.4-2000-03-24-E-0bad7ea9 | | 4.5 (2000-05-25) A | 171bdcec | SCPH-101
SCPH-103 | freepsxboot-unirom-fastload-20210703-bios-4.5-2000-05-25-A-171bdcec | | 4.5 (2000-05-25) E | 76b880e5 | SCPH-102 | freepsxboot-unirom-fastload-20210703-bios-4.5-2000-05-25-E-76b880e5 |

Please read the README.md file for installation instructions (and warnings).
Source code(tar.gz)
Source code(zip)
freepsxboot-2.0.zip(1.80 MB)
v1.2(May 5, 2021)
This release provides memory card image files containing FreePSXBoot with Unirom 8.0.H.

Changes since last version:

2021-05-05: Unirom version updated to 8.0.H

2021-04-28: Fixed exploit for BIOS versions 2.1 (A) and 2.2 (A) (read dummy frame to avoid errors)

2021-04-27: Added support for more BIOS versions, which are now identified by their CRC32

2021-04-22: Added support for BIOS 2.0 (1995-05-07), 4.0 and 4.1 (1997-11-14)

Please read the README.md file for installation instructions (and warnings).

| BIOS version/region | BIOS CRC32 | Models | 100% reliable exploit? | Image file | |---------------------|------------|--------|------------------------|------------| | 1.0 (1994-09-22) I | 3b601fc8 | SCPH-1000 | Yes | freepsxboot-unirom-fastload-20210505-bios-1.0-1994-09-22-I-3b601fc8.mcd | | 1.1 (1995-01-22) I | 3539def6 | SCPH-3000 | Yes | freepsxboot-unirom-fastload-20210505-bios-1.1-1995-01-22-I-3539def6.mcd | | 2.0 (1995-05-07) A | 55847d8c | SCPH-1001 | Yes; see note below | freepsxboot-unirom-fastload-20210505-bios-2.0-1995-05-07-A-55847d8c.mcd | | 2.0 (1995-05-10) E | 9bb87c4b | SCPH-1002 | Yes; see note below | freepsxboot-unirom-fastload-20210505-bios-2.0-1995-05-10-E-9bb87c4b.mcd | | 2.1 (1995-07-17) A | aff00f2f | SCPH-1001 | Yes | freepsxboot-unirom-fastload-20210505-bios-2.1-1995-07-17-A-aff00f2f.mcd | | 2.1 (1995-07-17) E | 86c30531 | SCPH-1002 | Yes | freepsxboot-unirom-fastload-20210505-bios-2.1-1995-07-17-E-86c30531.mcd | | 2.1 (1995-07-17) I | bc190209 | SCPH-3500 | Yes | freepsxboot-unirom-fastload-20210505-bios-2.1-1995-07-17-I-bc190209.mcd | | 2.2 (1995-12-04) A | 37157331 | SCPH-1001
SCPH-5003 | Yes | freepsxboot-unirom-fastload-20210505-bios-2.2-1995-12-04-A-37157331.mcd | | 2.2 (1995-12-04) E | 1e26792f | SCPH-1002 | Yes | freepsxboot-unirom-fastload-20210505-bios-2.2-1995-12-04-E-1e26792f.mcd | | 2.2 (1995-12-04) I | 24fc7e17 | SCPH-5000 | Yes | freepsxboot-unirom-fastload-20210505-bios-2.2-1995-12-04-I-24fc7e17.mcd | | 3.0 (1996-09-09) I | ff3eeb8c | SCPH-5500 | Yes | freepsxboot-unirom-fastload-20210505-bios-3.0-1996-09-09-I-ff3eeb8c.mcd | | 3.0 (1996-11-18) A | 8d8cb7e4 | SCPH-5001
SCPH-5501
SCPH-5503
SCPH-7003 | Yes | freepsxboot-unirom-fastload-20210505-bios-3.0-1996-11-18-A-8d8cb7e4.mcd | | 3.0 (1997-01-06) E | d786f0b9 | SCPH-5502
SCPH-5552 | Yes | freepsxboot-unirom-fastload-20210505-bios-3.0-1997-01-06-E-d786f0b9.mcd | | 4.0 (1997-08-18) I | ec541cd0 | SCPH-7000
SCPH-7500
SCPH-9000 | Yes | freepsxboot-unirom-fastload-20210505-bios-4.0-1997-08-18-I-ec541cd0.mcd | | 4.1 (1997-11-14) A | b7c43dad | SCPH-7000W | Yes | freepsxboot-unirom-fastload-20210505-bios-4.1-1997-11-14-A-b7c43dad.mcd | | 4.1 (1997-12-16) A | 502224b6 | SCPH-7001
SCPH-7501
SCPH-7503
SCPH-9001
SCPH-9003
SCPH-9903 | Yes | freepsxboot-unirom-fastload-20210505-bios-4.1-1997-12-16-A-502224b6.mcd | | 4.1 (1997-12-16) E | 318178bf | SCPH-7002
SCPH-7502
SCPH-9002 | Yes | freepsxboot-unirom-fastload-20210505-bios-4.1-1997-12-16-E-318178bf.mcd | | 4.3 (2000-03-11) I | f2af798b | SCPH-100 | Yes | freepsxboot-unirom-fastload-20210505-bios-4.3-2000-03-11-I-f2af798b.mcd | | 4.4 (2000-03-24) A | 6a0e22a0 | SCPH-101 | Yes | freepsxboot-unirom-fastload-20210505-bios-4.4-2000-03-24-A-6a0e22a0.mcd | | 4.4 (2000-03-24) E | 0bad7ea9 | SCPH-102 | Yes | freepsxboot-unirom-fastload-20210505-bios-4.4-2000-03-24-E-0bad7ea9.mcd | | 4.5 (2000-05-25) A | 171bdcec | SCPH-101
SCPH-103 | Yes | freepsxboot-unirom-fastload-20210505-bios-4.5-2000-05-25-A-171bdcec.mcd | | 4.5 (2000-05-25) E | 76b880e5 | SCPH-102 | Yes | freepsxboot-unirom-fastload-20210505-bios-4.5-2000-05-25-E-76b880e5.mcd |

Note for BIOS 2.0 (SCPH-1001 or SCPH-1002): the memory card containing FreePSXBoot must be inserted in slot 1, and another memory card must be present in slot 2. The memory card in slot 2 can have any content.
Source code(tar.gz)
Source code(zip)
freepsxboot-unirom-fastload-20210505-bios-1.0-1994-09-22-I-3b601fc8.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-1.1-1995-01-22-I-3539def6.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-2.0-1995-05-07-A-55847d8c.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-2.0-1995-05-10-E-9bb87c4b.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-2.1-1995-07-17-A-aff00f2f.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-2.1-1995-07-17-E-86c30531.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-2.1-1995-07-17-I-bc190209.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-2.2-1995-12-04-A-37157331.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-2.2-1995-12-04-E-1e26792f.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-2.2-1995-12-04-I-24fc7e17.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-3.0-1996-09-09-I-ff3eeb8c.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-3.0-1996-11-18-A-8d8cb7e4.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-3.0-1997-01-06-E-d786f0b9.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-4.0-1997-08-18-I-ec541cd0.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-4.1-1997-11-14-A-b7c43dad.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-4.1-1997-12-16-A-502224b6.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-4.1-1997-12-16-E-318178bf.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-4.3-2000-03-11-I-f2af798b.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-4.4-2000-03-24-A-6a0e22a0.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-4.4-2000-03-24-E-0bad7ea9.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-4.5-2000-05-25-A-171bdcec.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210505-bios-4.5-2000-05-25-E-76b880e5.mcd(128.00 KB)
v1.1(Apr 21, 2021)
This release provides memory card image files containing FreePSXBoot with Unirom 8.0.F.

Changes since last version:

2021-04-21: Added support for BIOS 1.1, and fixed BIOS 2.0 exploit (needs icache flush to work)

2021-04-21: Progress bar added in stage2 payload (thanks Nicolas Noble)

2021-04-20: Added support for BIOS 3.0 1996-09-09 (SCPH-5500) (thanks sickle)

2021-04-19: Added support for BIOS 1.0 and 4.3 (SCPH-1000 and SCPH-100 respectively)

2021-04-19: Exploit 100% reliable for every supported BIOS; now hooks an ISR (thanks sickle)

2021-04-19: Unirom version updated to 8.0.F

Please read the README.md file for installation instructions (and warnings).

| BIOS version/date | Models | 100% reliable exploit? | Image file | |-------------------|--------|------------------------|---------------| | 1.0 (1994-09-22) | SCPH-1000 | Yes | freepsxboot-unirom-fastload-20210421-bios-1.0.mcd | | 1.1 (1995-01-22) | SCPH-3000 | Yes | freepsxboot-unirom-fastload-20210421-bios-1.1.mcd | | 2.0 (1995-05-10) | SCPH-1002 | Yes; see note below | freepsxboot-unirom-fastload-20210421-bios-2.0.mcd | | 2.1 (1995-07-17) | SCPH-1002
SCPH-3500 | Yes | freepsxboot-unirom-fastload-20210421-bios-2.1.mcd | | 2.2 (1995-12-04) | SCPH-1001
SCPH-1002
SCPH-5000
SCPH-5903 | Yes | freepsxboot-unirom-fastload-20210421-bios-2.2.mcd | | 3.0 (1996-09-09) | SCPH-5500 | Yes | freepsxboot-unirom-fastload-20210421-bios-3.0.mcd | | 3.0 (1996-11-18) | SCPH-5001
SCPH-5501
SCPH-5503
SCPH-7003 | Yes | freepsxboot-unirom-fastload-20210421-bios-3.0-19961118.mcd | | 3.0 (1997-01-06) | SCPH-5502
SCPH-5552 | Yes | freepsxboot-unirom-fastload-20210421-bios-3.0-19970106.mcd | | 4.1 (1997-12-16) | SCPH-7001
SCPH-7002
SCPH-7500
SCPH-7501
SCPH-7502
SCPH-7503
SCPH-9001
SCPH-9002
SCPH-9003 | Yes | freepsxboot-unirom-fastload-20210421-bios-4.1.mcd | | 4.3 (2000-03-11) | SCPH-100 | Yes | freepsxboot-unirom-fastload-20210421-bios-4.3.mcd | | 4.4 (2000-03-24) | SCPH-101
SCPH-102 | Yes | freepsxboot-unirom-fastload-20210421-bios-4.4.mcd | | 4.5 (2000-05-25) | SCPH-101
SCPH-102 | Yes | freepsxboot-unirom-fastload-20210421-bios-4.5.mcd |

Note for BIOS 2.0 (SCPH-1002): the memory card containing FreePSXBoot must be inserted in slot 1, and another memory card must be present in slot 2. The memory card in slot 2 can have any content.
Source code(tar.gz)
Source code(zip)
freepsxboot-unirom-fastload-20210421-bios-1.0.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210421-bios-1.1.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210421-bios-2.0.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210421-bios-2.1.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210421-bios-2.2.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210421-bios-3.0-19961118.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210421-bios-3.0-19970106.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210421-bios-3.0.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210421-bios-4.1.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210421-bios-4.3.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210421-bios-4.4.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210421-bios-4.5.mcd(128.00 KB)
v1.0(Apr 18, 2021)

This release provides memory card image files containing FreePSXBoot with Unirom 8.0.E.

Please read the README.md file for installation instructions (and warnings).

| BIOS version/date | Models | 100% reliable exploit? | Image file | |-------------------|--------|------------------------|---------------| | 2.0 (1995-05-10) | SCPH-1002 | No | freepsxboot-unirom-fastload-20210414-bios-2.0.mcd | | 2.1 (1995-07-17) | SCPH-1002
SCPH-3500 | No | freepsxboot-unirom-fastload-20210414-bios-2.1.mcd | | 2.2 (1995-12-04) | SCPH-1001
SCPH-1002
SCPH-5000
SCPH-5903 | No | freepsxboot-unirom-fastload-20210414-bios-2.2.mcd | | 3.0 (1996-11-18) | SCPH-5001
SCPH-5501
SCPH-5503
SCPH-7003 | No | freepsxboot-unirom-fastload-20210414-bios-3.0.mcd | | 3.0 (1997-01-06) | SCPH-5502
SCPH-5552 | No | freepsxboot-unirom-fastload-20210414-bios-3.0-19970106.mcd | | 4.1 (1997-12-16) | SCPH-7001
SCPH-7002
SCPH-7500
SCPH-7501
SCPH-7502
SCPH-7503
SCPH-9001
SCPH-9002
SCPH-9003 | Yes | freepsxboot-unirom-fastload-20210414-bios-4.1.mcd | | 4.4 (2000-03-24) | SCPH-101
SCPH-102 | Yes | freepsxboot-unirom-fastload-20210414-bios-4.4.mcd | | 4.5 (2000-05-25) | SCPH-101
SCPH-102 | Yes | freepsxboot-unirom-fastload-20210414-bios-4.5.mcd |
Source code(tar.gz)
Source code(zip)
freepsxboot-unirom-fastload-20210414-bios-2.0.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210414-bios-2.1.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210414-bios-2.2.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210414-bios-3.0-19970106.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210414-bios-3.0.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210414-bios-4.1.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210414-bios-4.4.mcd(128.00 KB)
freepsxboot-unirom-fastload-20210414-bios-4.5.mcd(128.00 KB)

Exploit allowing to load arbitrary code on the PSX using only a memory card (no game needed)

Related tags

Overview

FreePSXBoot

WARNING

Usage

Restoring the memory card

Supported models

Changelog

Information

Downloads

Comments

Releases(v2.1)

v2.1(Sep 19, 2022)

v2.0(Jul 7, 2021)

v1.2(May 5, 2021)

v1.1(Apr 21, 2021)

v1.0(Apr 18, 2021)

Owner

Online version of the greatest card game known to man

NeoGB Printer an SD card-based standalone Game Boy Printer emulator.

Magarena is a single-player fantasy card game played against a computer opponent.

How to use Live Update to improve the load speed of HTML5 game.

This tool allow you to create / load / edit models used for create a cinematic in game for World of Warcraft 3.3.5 version

PS1 savegame exploit using THPS3

Freecell Solver - a C library for automatically solving Freecell and some other variants of card Solitaire

A foobar2000 component which allows you to load and play ncm files directly.

Improved version of the X-Ray Engine, the game engine used in the world-famous S.T.A.L.K.E.R. game series by GSC Game World.

Stealthy way to hijack the existing game process handle within the game launcher (currently supports Steam and Battle.net). Achieve external game process read/write with minimum footprint.

Game Boy, Game Boy Color, and Game Boy Advanced Emulator

A game made for the Game (Engineless) Jam using Raylib

VE Font Cache is a single header-only GPU font rendering library designed for game engines.

A tic-tac-toe game made only in flutter

A cross-platform, top-down 2D space shooter written in C using only system libraries.

A cycle-accurate Game Boy and Game Boy Color Emulator, with rewind feature.

The Game Boy ROM of the Game Boy bitcoin miner!

CLUSEK-RT is a complex game engine written in C++ and the successor of the CLUSEK game engine

Ground Engine is an easy to use Game Engine for 3D Game Development written in C++