# Disc-less hack for original Playstation



## contezero (Apr 10, 2021)

FreePSXBoot 
https://github.com/brad-lin/FreePSXBoot

Works in a similar way to FMCB for the playstation 2. After the Tonyhax exploit now another one, but this one needs only a memory card. No discs, no games. Compatibility is still small: only works with SCPH-9000 model and could require a few reboots but it's very promising.


----------



## DinohScene (Apr 10, 2021)

Noice!

I knew this would appear one day!


----------



## VashTS (Apr 10, 2021)

yes! this is great news.


----------



## tech3475 (Apr 10, 2021)

I wonder if something like this could lead to a solderless ODD?


----------



## contezero (Apr 10, 2021)

tech3475 said:


> I wonder if something like this could lead to a solderless ODD?



The guys behind PSIO are working on a solderless ODE. No info on release, availability or price yet.


----------



## Elbart (Apr 10, 2021)

contezero said:


> only works with SCPH-9000 model


From the PSXDev-Thread:


> Confirming it's also working with SCPH-7002 and SCPH-7502 consoles since they share the same bios version you're currently targetting for the SCPH-9002 one.






contezero said:


> No info on release, availability or price yet.


That posting from PSIO-Matt happened some time in June 2020.
Looks like that artillery is stuck in the mud and the barrel filled with vegemite.


----------



## FAST6191 (Apr 10, 2021)

What interesting times we live in.


----------



## AkikoKumagara (Apr 10, 2021)

Does anyone know if there is a homebrew application for PS2 that I can use to prep a PlayStation memory card for this exploit? Using an Arduino to program the memory card seems excessive so I'm curious if there's an easier way.


----------



## Alexander1970 (Apr 10, 2021)

Sophie-bear said:


> Does anyone know if there is a homebrew application for PS2 that I can use to prep a PlayStation memory card for this exploit? Using an Arduino to program the memory card seems excessive so I'm curious if there's an easier way.



uLaunchELF/wLaunchELF can handle/copy Files to a PSX Memory Card on an PlayStation 2.

Please Note,note ALL Versions can handle it and a Original SONY Memory Card should it be,maybe this GBAtemp Thread can help:

https://gbatemp.net/threads/how-to-transfer-psx-memory-card-saves-to-pc-and-vice-versa.566212/


----------



## AkikoKumagara (Apr 10, 2021)

alexander1970 said:


> uLaunchELF/wLaunchELF can handle/copy Files to a PSX Memory Card on an PlayStation 2.
> 
> Please Note,note ALL Versions can handle it and a Original SONY Memory Card should it be,maybe this GBAtemp Thread can help:
> 
> https://gbatemp.net/threads/how-to-transfer-psx-memory-card-saves-to-pc-and-vice-versa.566212/



I thought about this, of course, but the files provided are .mcd images, not raw save files. This means it's basically a copy of a memory card's whole contents instead of just a save file. I'm not sure if there's a way to clone an image to an actual memory card via the PS2 which is what I'm asking about.
The thread provided does have some good info, but I don't think it's quite useful in this case. I'm not sure if this is something we where we can safely extract the contents of the .mcd file from because of how the exploit works as described on the github page. It seems like we need to properly image the memory card using the .mcd file provided.


----------



## cvskid (Apr 10, 2021)

With the disc less hack for ps1 being a thing now and a potential solderless ODE mod for ps1 i feel like the system will finally be in a good place.


----------



## tivu100 (Apr 11, 2021)

FAST6191 said:


> What interesting times we live in.


Hackers stuck at home due to pandemic, with too much time on their hand?


----------



## Bladexdsl (Apr 11, 2021)

would have loved to have had this back in the day instead of fucking around with modchips


----------



## FAST6191 (Apr 11, 2021)

Bladexdsl said:


> would have loved to have had this back in the day instead of fucking around with modchips


Mod chips?
When I were a lad we had to have a cheat device bought off the market for a fortune,have springs inside the tray, turn the playstation upside down, rent games from the video shop, burn discs with drives that barely lasted a year and then find there was anti piracy.
I would have killed for a mod chip.


----------



## KleinesSinchen (Apr 11, 2021)

Bladexdsl said:


> would have loved to have had this back in the day instead of fucking around with modchips


What is wrong with a PS1 modchip?
Burn disc, insert disc, play.
The only thing more convenient is an optical drive emulator.

Nevertheless:* Very cool exploit.*


----------



## Armadillo (Apr 11, 2021)

KleinesSinchen said:


> What is wrong with a PS1 modchip?



Probably the usual. Don't/can't solder, don't want to pay someone to do it either.


----------



## MockyLock (Apr 11, 2021)

It's very interesting indeed.
I hope it will lead to something very similar to FMCB.


----------



## asper (Apr 12, 2021)

The images on github repository are bundeled with UniROM; can someone explain what can be done with UniROM without having a modichip and/or an action replay (never used UniROM  ) ?

Anyway this can be the tool useful to write raw memory card images: https://github.com/ShendoXT/memcardrex


----------



## contezero (Apr 12, 2021)

asper said:


> The images on github repository are bundeled with UniROM; can someone explain what can be done with UniROM without having a modichip and/or an action replay (never used UniROM  ) ?



Modchip free booting
https://github.com/JonathanDotCel/unirom8_bootdisc_and_firmware_for_ps1


----------



## Bladexdsl (Apr 12, 2021)

KleinesSinchen said:


> What is wrong with a PS1 modchip?
> Burn disc *(wait an hour or two burning at 2x because if you used a higher speed it fucked up most of the time* ,
> insert disc, *HOPE it plays and doesn't need a patch*.
> *.*


FIXD 

I was doing it from the very beginning when burners were expensive AF. it was ok at first until FF VIII came out with it's fuckiong DRM than everyone started using it making it a FUGE pain to burn a disc properly. not to mention i had to patch nearly every fucking game to PAL because the assholes never even released the good games here like xeno gears and legends of legaia


----------



## AkikoKumagara (Apr 13, 2021)

Sophie-bear said:


> Does anyone know if there is a homebrew application for PS2 that I can use to prep a PlayStation memory card for this exploit? Using an Arduino to program the memory card seems excessive so I'm curious if there's an easier way.


To answer my own question, the README for Freepsxboot was updated to explain that the app "Memory Card Annihilator v2.0" can do this.

After testing it, I can say it works. You must change the file extension of the .mcd file to .mcr, then Memory Card Annihilator will recognize it and you can restore it to the memory card.


----------



## asper (Apr 13, 2021)

I tested it on my SCPH-5502 and it boots uniROM but... it says the drive is locked... is it a problem of 5502 model ?

I also restored the flashd memory card using "full format" under Memory Card Annihilator v2.0 so it can be usable again.


----------



## tfocosta (Apr 13, 2021)

This is awesome! Thank you for sharing!


----------



## AceyBwoi (Apr 13, 2021)

asper said:


> I tested it on my SCPH-5502 and it boots uniROM but... it says the drive is locked... is it a problem of 5502 model ?
> 
> I also restored the flashd memory card using "full format" under Memory Card Annihilator v2.0 so it can be usable again.



How did it show up in annihiltor as my mem card does not show up just freezes the program when mem card inserted


----------



## AkikoKumagara (Apr 13, 2021)

asper said:


> I tested it on my SCPH-5502 and it boots uniROM but... it says the drive is locked... is it a problem of 5502 model ?
> 
> I also restored the flashd memory card using "full format" under Memory Card Annihilator v2.0 so it can be usable again.



If you follow the directions, the drive should be opened when you launch UniROM.


----------



## asper (Apr 13, 2021)

Sophie-bear said:


> If you follow the directions, the drive should be opened when you launch UniROM.


Never used unirom and i missed that part (i am still not able to find that specific part); anyway thank you for pointing that out!!

--------------------- MERGED ---------------------------



AceyBwoi said:


> How did it show up in annihiltor as my mem card does not show up just freezes the program when mem card inserted


I opened the homebrew and i connected the memory card after the program opened and it got recognized.


----------



## AkikoKumagara (Apr 13, 2021)

asper said:


> Never used unirom and i missed that part (i am still not able to find that specific part); anyway thank you for pointing that out!!


Read these directions so you're clear on how to use FreePSXBoot.
https://github.com/brad-lin/FreePSXBoot/blob/master/README.md#usage


----------



## asper (Apr 13, 2021)

Sophie-bear said:


> Read these directions so you're clear on how to use FreePSXBoot.
> https://github.com/brad-lin/FreePSXBoot/blob/master/README.md#usage


I was looking for that info under uniROM readme  now i got it and I really missed that, thank you !


----------



## AceyBwoi (Apr 14, 2021)

Mine doesn't recognise just freezes out the app


----------



## AkikoKumagara (Apr 14, 2021)

AceyBwoi said:


> Mine doesn't recognise just freezes out the app


Always read the README, it clearly states this can be an issue.




Once installed, it may become difficult to uninstall, as the normal software to re-format a memory card won't work, due to the exploit itself. You could end up with no means to recover the memory card; if for example your installation method was Memory Card Annihilator v2, as it will also crash. If you happen to own a game that shows the memory card's content before creating a save file like _Cool Boarders 4_, chances are you can recover your card's normal functionality by overwriting the exploit with the game's save.


Source: https://github.com/brad-lin/FreePSXBoot/blob/master/README.md#warning

Please also see here for a potential solution to your problem if you don't own a game like CoolBoarders 4.
https://github.com/brad-lin/FreePSXBoot/issues/18


----------



## KleinesSinchen (Apr 14, 2021)

Sophie-bear said:


> Always read the README, it clearly states this can be an issue.
> 
> 
> 
> ...


*Thanks for the warning!* I didn't even think about this. But it makes sense. There is an exploit on the MC and the "MC manager" crashes because of invalid data. It surprises that Memory Card Annihilator v2, able to do raw read/write also crashes. Was this in the README file all the time or has it been added later? I it had been there all the time I must have missed it.

Since different BIOS versions require different images I'm not quite sure I want to waste a bunch of cards. I have one cheap knockoff MC and will try it on an SCPH-9002 with the 100% reliable exploit and game loader.


----------



## AkikoKumagara (Apr 14, 2021)

KleinesSinchen said:


> *Thanks for the warning!* I didn't even think about this. But it makes sense. There is an exploit on the MC and the "MC manager" crashes because of invalid data. It surprises that Memory Card Annihilator v2, able to do raw read/write also crashes. Was this in the README file all the time or has it been added later? I it had been there all the time I must have missed it.
> 
> Since different BIOS versions require different images I'm not quite sure I want to waste a bunch of cards. I have one cheap knockoff MC and will try it on an SCPH-9002 with the 100% reliable exploit and game loader.



In theory, assuming the exploit works, I see no reason why one can't install the exploit then launch a backup of CoolBoarders 4 or some other game that can overwrite the exploit save data. This is still risky because if the exploit does not work and Memory Card Annihilator doesn't work anymore (seems to be a mixed bag whether it will work or not depending on the exploit version), you're out a memory card with no easy fix. I'm sure once FreePSXBoot matures more, there will be more reliable ways to install and uninstall the exploit.

Edit: It may also be worth nothing that on my card using using the
*"freepsxboot-unirom-20210412-7001-7002-7500-7501-7502-7503-9001-9002-9003.mcd"*
version of FreePSXBoot, I have absolutely no problems reformatting the card via MCA, slot 2 in my screenshot below:


----------



## tech3475 (Apr 14, 2021)

Sophie-bear said:


> Always read the README, it clearly states this can be an issue.
> 
> 
> 
> ...



I just tested this, I was able to reformat the card with MCAv2 on my 500x PAL PS2.

First time I inserted the card in slot 1 it crashed, so I rebooted the console and tried slot 2 and was able to reformat.

Tried again with a different third party card and I was able to reformat using slot 1.

Tried copying a save from my PS2's HDD and it copied over fine and it SEEMS ok when loading from the PS1 both MCM and in game, but be cautious until others can verify.

edit:

Just checked the 'fix', I was using the 4.5 so that might be why it works.


----------



## AkikoKumagara (Apr 14, 2021)

tech3475 said:


> I just tested this, I was able to reformat the card with MCAv2 on my 500x PAL PS2.
> 
> First time I inserted the card in slot 1 it crashed, so I rebooted the console and tried slot 2 and was able to reformat.
> 
> ...



Good info, thank you. I'm excited for when this gets more accessible and refined so we don't have to jump through hoops like this to manage it.


----------



## tech3475 (Apr 14, 2021)

Sophie-bear said:


> Good info, thank you. I'm excited for when this gets more accessible and refined so we don't have to jump through hoops like this to manage it.



Again just to be clear, it seems that the PSone 102 4.4/4.5 versions are safe from my experience. I haven't tried others.


----------



## KleinesSinchen (Apr 14, 2021)

Sophie-bear said:


> [...]
> Edit: It may also be worth nothing that on my card using using the
> *"freepsxboot-unirom-20210412-7001-7002-7500-7501-7502-7503-9001-9002-9003.mcd"*
> version of FreePSXBoot, I have absolutely no problems reformatting the card via MCA, slot 2 in my screenshot below:
> ...


Can confirm from my end:
Exploit MC does not crash MC Annihilator -- and even the stock PS2 (fat model) memory card manager opens it showing four corrupted symbols. Did not try deleting from there.

Exploit perfectly working on PAL SCPH-9002 (no modchip). Boots CD-R backups fine.


----------



## asper (Apr 15, 2021)

There seems to be crash problems even with MC Annihilator only with some bios version exploits. Anyway I find a way to recover "broken" memory card using Wipeout (I ercovered a memory card making MC Annihilator to crash - no way to recover it using abe's odyssee game)

0 - insert a WORKING memory card in slot 1 (YES, you need at least 1 good memory card - it will probably work on slot 2 too)
1 - start Wipeout [SCES-00010] game
2 - go to "options"
3 - go to "load data"
4 - press "O" to choose "format card"
5 - answer "YES" to the format 1st request
6 - SWITCH the good memory card with the modified (corrupted) one
7 - answer "YES" to the 2nd format request [some programmer (fortunately) here forgot to check for the memory card data before starting the formating procedure !]
8 - done ! your memory card is good again


----------



## Deleted User (Apr 15, 2021)

My first hacked console was a PS1 with a modchip. I didn't have a cd burner so I found someone online and paid them $5 a disc, not a game per disc. So if I game had 4 discs which some PS1 games did, I paid $20 lol. Should have just bought the originals on some of them.


----------



## Elbart (Apr 16, 2021)

What is the situation with regard to antimod-protected games?
I'd imagine they don't work without patches as the licence-check is disabled all together.


----------



## KleinesSinchen (Apr 16, 2021)

Elbart said:


> What is the situation with regard to antimod-protected games?
> I'd imagine they don't work without patches as the licence-check is disabled all together.


Shouldn't be the case. Try one.

If I understood anti-mod games correctly, they had an additional check for the license string. Early chips would constantly send it (even when not reading the part that is used for authentication). The game could check for the SCE* string and if it *did find it* (shouldn't be the case) there must be a modchip sending it.
This prevented even original CDs from being used. Modded console → No game.

Later modchips switched themselves off after authenticating the disc (guess this was the "stealth" in the later versions).


What doesn't work with modchip and with an exploit like this one is successfully *playing unpatched backups of LibCrypt protected games*. They crash deliberately early on. Coincidentally I just tried it hoping RAW copy with subchannel data would work without patch… NOPE!


----------



## Elbart (Apr 16, 2021)

driverdis said:


> It is using previously undocumented commands on the disc drive controller to turn off the license check.


They were discovered and documented in 2013 by nocash, there was just no way to use them outside of cheat-carts with unirom or BIOS-replacements until now.



KleinesSinchen said:


> If I understood anti-mod games correctly, they had an additional check for the license string. Early chips would constantly send it (even when not reading the part that is used for authentication). The game could check for the SCE* string and if it *did find it* (shouldn't be the case) there must be a modchip sending it.
> This prevented even original CDs from being used. Modded console → No game.
> 
> Later modchips switched themselves off after authenticating the disc (guess this was the "stealth" in the later versions).


True.
But there are also some games which check for the license mid-game properly (afaik Spyro NTSC-U is one of them) and due to the nature of the unlock-mechanism used, that won't work as that licence-check is disabled.



KleinesSinchen said:


> What doesn't work with modchip and with an exploit like this one is successfully *playing unpatched backups of LibCrypt protected games*. They crash deliberately early on. Coincidentally I just tried it hoping RAW copy with subchannel data would work without patch… NOPE!


Then you must have ripped or burned it wrong: Reading and writing subchannel-data uncorrected and the burner must support DAO RAW _96_ (or similarly named).
Any kind of modchip being there or not doesn't affect Libcrypt at all, only if the disc is properly made (or burned).


----------



## AceyBwoi (Apr 16, 2021)

I managed to fix my non formatting card with a sort of new solutions

I did not have any of the mentiond CD games eg wipeout or coolboarders so I was finding a way to restore my first flashed mem card

I tried my games and found that resident evil can fix the corrupted card also

1. Put resident evil disk in ps2
2. Wait for it to load 
3. Insert the flashed memory card
4. The memory card is recognised but does not contain any saves
5. Play the game till you can save at typewriter
(Play as chris will be able to save faster)
6. You will be able to save requires 1block
7. Once saved restart your ps2
8. Go into browser and ps1 mem card is there
9. Now you can use MC app to format
10. Restore your original backup of mem card

It's a great lil exploit and glad there are ways to get your card to function again

Let me know if this helped you out


----------



## KleinesSinchen (Apr 16, 2021)

Elbart said:


> But there are also some games which check for the license mid-game properly (afaik Spyro NTSC-U is one of them) and due to the nature of the unlock-mechanism used, that won't work as that licence-check is disabled.


If you have one: Try a problematic game and share the results. I don't have any Anti-mod games as far as I know.




Elbart said:


> […]
> Then you must have ripped or burned it wrong: Reading and writing subchannel-data uncorrected and the burner must support DAO RAW _96_ (or similarly named).
> Any kind of modchip being there or not doesn't affect Libcrypt at all, only if the disc is properly made (or burned).


Good point. My newer drives are missing this capability. *Thank you!* Never had any luck burning LibCrypt games without crack. Grubbing through my old stuff on the attic I quickly found an older burner supporting this write mode, plugged it into a Windows XP machine and Alcohol 120% created a seemingly working copy (tested for about ½ hour) of a protected game. If this really works out, I'm going to replace my cracked backups containing the crappy _"We are the greatest!!11!"_-intros by the cracking groups with clean copies.


----------



## Elbart (Apr 18, 2021)

KleinesSinchen said:


> If you have one: Try a problematic game and share the results. I don't have any Anti-mod games as far as I know.


I'd need a US-PS1 for that, because antimod-protections of US-games isn't being executed on PAL-PS1s, afaik.


----------



## robertsteven (Apr 19, 2021)

This is awesome! Thank you for sharing


----------



## Bradlin (Apr 22, 2021)

Hey, I've released version 1.1 yesterday: see release 1.1 on the github repo; I cannot post a link since I'm a new member.

So far it has been confirmed working on BIOS 2,0, 4.1, 4.5. Some feedback would be nice for other BIOS versions. I've also just added support for SCPH-7000 and SCPH-7000W (the image files are not in the release, but they are in the repo).

If you can test the latest images on real hardware and report the status here, I'd be grateful (make sure you test the latest images - they overwrite a different address compared to the previous ones). If it doesn't work, make absolutely sure you have the correct image file and that you wrote the image file to the memcard exactly as it is. If possible, read back the memory card and compare with the original image file.

Thanks!


----------



## KleinesSinchen (Apr 22, 2021)

Release link: https://github.com/brad-lin/FreePSXBoot/releases


Bradlin said:


> So far it has been confirmed working on BIOS* 2,0, 4.1, 4.5.* Some feedback would be nice for other BIOS versions. I've also just added support for SCPH-7000 and SCPH-7000W (the image files are not in the release, but they are in the repo).


Thanks for the cool exploit! Awesome!

Since I'm not a developer I'm always happy if I can contribute a small thing:
Small PSONE,SCPH-102 (PAL) BIOS *4.4 *working perfectly with Freepsxboot-unirom-fastload-20210421-bios-4.4.mcd
The console has an (unknown) modchip so I can't say anything to the nocash unlock on this one. Hope the modchip is not a problem.

The same MC works on another SCPH-102 without modchip. The second console has BIOS version 4.5 but I didn't flash the 4.5 specific image to the MC (found out about this device being a 4.5 _after_ starting FreePSXBoot).
Backups loading perfectly.

Don't have any other models besides one with the already tested 4.1
Edit:
The files for 4,3, 4.4 and 4.5 appear to be the same anyway.


----------



## Bradlin (Apr 22, 2021)

KleinesSinchen said:


> Edit:
> The files for 4,3, 4.4 and 4.5 appear to be the same anyway.



Thanks for the feedback. The files are indeed the same, the BIOSes are different but happen to have the same stack pointer value when the exploit triggers, and also allow the same instruction to be overwritten. Nevertheless, if we improve yet again the exploit, the files may end up being different.


----------



## tozevleal (Apr 23, 2021)

Can someone put this on the frontpage thats some interesting news!


----------



## Mike_D (Apr 30, 2021)

Just checked my un-chipped PSone SCPH-102 (PAL). Perfect! Thanks.


----------



## Bradlin (May 1, 2021)

Thanks for the feedback. Someone reported recently that BIOS version 2.2 (A) was not working, and I had mistakenly assumed that BIOS 2.2 (E) was the same as 2.2 (A), as it's the case for versions 4.1, 4.4, and 4.5.

So I've updated again the images, and the BIOS list. There is also a fix which caused the exploit to freeze on some BIOS versions; this is fixed by reading a dummy frame from the memory card before loading the actual payload. All the updated images are on github (not in the release, but in the download links on the main repo page). I am waiting for the Unirom author to update his code, and I will do a release once it's ready.


----------



## KleinesSinchen (May 1, 2021)

Bradlin said:


> Thanks for the feedback. Someone reported recently that BIOS version 2.2 (A) was not working, and I had mistakenly assumed that BIOS 2.2 (E) was the same as 2.2 (A), as it's the case for versions 4.1, 4.4, and 4.5.
> 
> So I've updated again the images, and the BIOS list. There is also a fix which caused the exploit to freeze on some BIOS versions; this is fixed by reading a dummy frame from the memory card before loading the actual payload. All the updated images are on github (not in the release, but in the download links on the main repo page). I am waiting for the Unirom author to update his code, and I will do a release once it's ready.


Nice!

I will test the new images later this day and post results. I've bought an additional console, SCPH-1002 (E), for testing. If I stumble upon more models, I will buy them. Flea markets not existing anymore makes this a lot harder (and more expensive).
*
Edit:*
Tests done with the new images from 30th of April 2021.
Results: *Not a single problem, regression or failure* (100% success rate, CD-R loading perfectly) with any of those:
SCPH-1002, BIOS 2.2 12/04/95 E, CRC32: 1E26792F
SCPH-9002, BIOS 4.1 12/16/97 E, CRC32: 318178BF
SCPH-102, BIOS 4.4 03/24/00 E, CRC32: 0BAD7EA9 (has unknown modchip)
SCPH-102, BIOS 4.5 05/25/00 E, CRC32: 76B880E5

Also perfectly working: Formatting memory card with Unirom to prevent Memory Card Annihilator on the PS2 from crashing.

Can't do more at the moment. As mentioned, if I find more consoles, I'll buy them. Not much hope here. Imported NTSC consoles will be even harder to get.

Boy, the PlayStation 1 sure got a lot of hardware revisions and BIOS versions.


Spoiler: md5sums



Showing which FreePSXBoot images are the same at the moment by checksum:
1e5bf9d8c4915315265dbf7086a2520c  freepsxboot-unirom-fastload-20210430-bios-2.0-1995-05-10-E-9bb87c4b.mcd
21700c491b620821248a786d93a5598a  freepsxboot-unirom-fastload-20210430-bios-4.1-1997-11-14-A-b7c43dad.mcd
21700c491b620821248a786d93a5598a  freepsxboot-unirom-fastload-20210430-bios-4.1-1997-12-16-A-502224b6.mcd
21700c491b620821248a786d93a5598a  freepsxboot-unirom-fastload-20210430-bios-4.1-1997-12-16-E-318178bf.mcd
2a0c258b112b9c311d3f455e5e824202  freepsxboot-unirom-fastload-20210430-bios-2.1-1995-07-17-I-bc190209.mcd
2a0c258b112b9c311d3f455e5e824202  freepsxboot-unirom-fastload-20210430-bios-2.2-1995-12-04-I-24fc7e17.mcd
2a0c258b112b9c311d3f455e5e824202  freepsxboot-unirom-fastload-20210430-bios-3.0-1996-09-09-I-ff3eeb8c.mcd
4966a362e63a950a460b873832ab47e6  freepsxboot-unirom-fastload-20210430-bios-2.1-1995-07-17-A-aff00f2f.mcd
4966a362e63a950a460b873832ab47e6  freepsxboot-unirom-fastload-20210430-bios-2.2-1995-12-04-A-37157331.mcd
4b40669b3a3a47d184610c94dcca39ab  freepsxboot-unirom-fastload-20210430-bios-3.0-1996-11-18-A-8d8cb7e4.mcd
4b40669b3a3a47d184610c94dcca39ab  freepsxboot-unirom-fastload-20210430-bios-4.0-1997-08-18-I-ec541cd0.mcd
6654289a9d916bc906ee4651d69ec7d6  freepsxboot-unirom-fastload-20210430-bios-3.0-1997-01-06-E-d786f0b9.mcd
79b0452db10adb045ed7aa8f95d8a6de  freepsxboot-unirom-fastload-20210430-bios-4.3-2000-03-11-I-f2af798b.mcd
79b0452db10adb045ed7aa8f95d8a6de  freepsxboot-unirom-fastload-20210430-bios-4.4-2000-03-24-A-6a0e22a0.mcd
79b0452db10adb045ed7aa8f95d8a6de  freepsxboot-unirom-fastload-20210430-bios-4.4-2000-03-24-E-0bad7ea9.mcd
79b0452db10adb045ed7aa8f95d8a6de  freepsxboot-unirom-fastload-20210430-bios-4.5-2000-05-25-A-171bdcec.mcd
79b0452db10adb045ed7aa8f95d8a6de  freepsxboot-unirom-fastload-20210430-bios-4.5-2000-05-25-E-76b880e5.mcd
a0020be10e32260b06a4decdf3716e59  freepsxboot-unirom-fastload-20210430-bios-2.1-1995-07-17-E-86c30531.mcd
a0020be10e32260b06a4decdf3716e59  freepsxboot-unirom-fastload-20210430-bios-2.2-1995-12-04-E-1e26792f.mcd
a0686a864e378537a971ae79904c8f5a  freepsxboot-unirom-fastload-20210430-bios-2.0-1995-05-07-A-55847d8c.mcd
ada128288fcd35269b67bed97d2ee2d6  freepsxboot-unirom-fastload-20210430-bios-1.0-1994-09-22-I-3b601fc8.mcd
cd3abde84054c9442b63dfd08c689396  freepsxboot-unirom-fastload-20210430-bios-1.1-1995-01-22-I-3539def6.mcd


----------



## Elbart (May 1, 2021)

KleinesSinchen said:


> Boy, the PlayStation 1 sure got a lot of hardware revisions and BIOS versions.


PS2 got twice that many.

It's interesting what mc-images are the same for which BIOS-versions.
3.0 US and 4.0 JP?
2.1, 2.2 and 3.0 JP?
2.1 US/EU and 2.2 US/EU, but then 3.0 EU all alone?
Funny.

Final Challenge: NoCash's replacement-BIOS.


----------



## Mike_D (May 7, 2021)

Mike_D said:


> Just checked my un-chipped PSone SCPH-102 (PAL). Perfect! Thanks.



Just to add, I tried backups of NTSC and PAL (my region) and both worked perfectly. Also, the 1st time ever I've been able to play a backup of Vib Ribbon (after many previous, failed, attempts through the years with emulation).


----------



## Boogieboo6 (May 13, 2021)

AceyBwoi said:


> I managed to fix my non formatting card with a sort of new solutions
> 
> I did not have any of the mentiond CD games eg wipeout or coolboarders so I was finding a way to restore my first flashed mem card
> 
> ...


This is exactly what I did to fix one of my cards too, except I used RE2! I think I might've been using an old version of FreePSXBoot though, because I couldn't do it a second time. Say you used the wrong payload for your bios and now your memory card is broken. You can fix it without special PC hardware. 
1. Use a second memory card and a PS2 to install TonyHax. This is the only step that requires a PS2.
2. Make a Unirom boot disc using the latest version. This ran on my PS1 with a Verbatim disc at 16x speed.
3. Use TonyHax to start the Unirom boot disc on PS1
5. Scroll to Memory Cards
6. Highlight files on the FreePSXBoot memory card, press X, then Format

As of version 1.3.3, TonyHax will block FreePSXBoot. This means you can use a memory card manager without crashing your console! I tried these steps on a PS2, but Unirom, while functional, has garbled text.


----------



## Bradlin (Jul 4, 2021)

It is now possible to run FreePSXBoot on a memory card on slot 2, and to keep the memory card plugged in while playing a game (the kernel is patched by FreePSXBoot to disable the memory card on slot 2, so games will only see a memory card connected in slot 1).

I am (as always ) looking for feedback on the slot 2 exploit. It has been tested on a few models and works fine on these, but it may not be the case on all models.

You can download the slot 2 images on github directly from the home page of the repository (there is no tagged release yet, waiting for more feedback). Slot 1 images are still provided for users of the Memcard Pro, or in case of incompatibility.


----------



## KleinesSinchen (Jul 4, 2021)

Same consoles as last time:
SCPH-1002, BIOS 2.2 12/04/95 E, CRC32: 1E26792F
SCPH-9002, BIOS 4.1 12/16/97 E, CRC32: 318178BF (*difference to last time:* I've soldered in a PsNee…)
…but I also now have this one:
SCPH-7502, BIOS 4.1 12/16/97 E, CRC32: 318178BF
SCPH-102, BIOS 4.4 03/24/00 E, CRC32: 0BAD7EA9 (has unknown modchip)
SCPH-102, BIOS 4.5 05/25/00 E, CRC32: 76B880E5

Sadly still only PAL consoles. I have no idea where/how I could get a bunch of NTSC-U and NTSC-J for an acceptable price. My test only got three distinct Slot-2 memory card images covered since the md5sum for BIOS 4.4 and 4.5 are still the same.

Results:
Unirom working like before. Formats memory cards for allowing new images to be flashed on the PS2 flawlessly. The game I loaded from CD-R was Castlevania – Symphony of the Night since it allows accessing Slot-2 for saves as well. The game simply states "Error!" for Slot-2, offers formatting MC2 but fails. Seems your kernel patch works perfectly.

The SCPH-102 with the unknown modchip crashed once, but I'm willing to file that under user error. Maybe I closed the tray too early and the modchip already tried starting the game. I tried it more than a dozen times afterwards → *No problem.*
Conclusion for my test devices:* Perfect!*

*Thanks for the awesome development!*


----------



## Bradlin (Jul 4, 2021)

Thanks for this feedback.

I have tested saving and loading with a few games and so far all of them work as expected (though strangely MGS will be stuck retrying on slot 2 if it sees no card connected there, but that's not due to FreePSXBoot).

The only case it could fail is if a game reimplements completely the memory card reading code instead of using the BIOS calls; so far I don't know of any such game.


----------



## Bradlin (Jul 7, 2021)

FreePSXBoot 2.0 has been released: Release Version 2.0 (support for slot 2) · brad-lin/FreePSXBoot (github.com)

The images are identical to the ones published a few days ago; thanks again for the feedback.


----------

