# Tonyhax is a new softmod backup loader for the PlayStation 1



## Deleted member 397813 (Mar 12, 2021)

Finally!


----------



## djpannda (Mar 12, 2021)

thats cool no mod chip needed! but still love on psio as don't need a working cd Drive or back up disc.. just SD files. Never the less more ways are always better


----------



## Tom Bombadildo (Mar 12, 2021)

This is super cool. I don't think I have any way to move a modded save to a PS1 memory card at this particular moment, but this is definitely something I'm 100% going to get around to doing at some point since I don't really want to install a modchip in my PS1 and the disc swap method is annoying


----------



## TwistedZeon (Mar 12, 2021)

This is actually one of the coolest things in awhile! I wonder if this could lead to solderless methods for loading roms from an sd card since it seems like the only reason you need to solder for xstation and the like is for disc protection stuff or so I believe.


----------



## Chary (Mar 12, 2021)

Well, heck. I know what I’m doing this weekend.


----------



## djpannda (Mar 12, 2021)

TwistedZeon said:


> This is actually one of the coolest things in awhile! I wonder if this could lead to solderless methods for loading roms from an sd card since it seems like the only reason you need to solder for xstation and the like is for disc protection stuff or so I believe.


I just realized this....whoa I bet Tony Hawk is going to Sky Rocket


----------



## smallissue (Mar 12, 2021)

not sure if this is easier or harder than a modchip
but this is poggers either way


----------



## MaxToTheMax (Mar 12, 2021)

Epic


----------



## smallissue (Mar 12, 2021)

MaxToTheMax said:


> Epic


I think you meant


----------



## VashTS (Mar 12, 2021)

nice! now i just need a copy of thps2, secured on ebay for $9 before scalpers incoming


----------



## socram8888 (Mar 12, 2021)

TwistedZeon said:


> This is actually one of the coolest things in awhile! I wonder if this could lead to solderless methods for loading roms from an sd card since it seems like the only reason you need to solder for xstation and the like is for disc protection stuff or so I believe.


tonyhax author here.

I've had some crazy ideas about maybe creating a custom SD to memory card adapter, since both SD cards and memory cards use standard SPI. It wouldn't be even necessary to open the console or touch anything inside, just an adapter much like on a GC.

For now I'm gonna focus on trying to port this exploit to other games.


----------



## Tom Bombadildo (Mar 12, 2021)

socram8888 said:


> tonyhax author here.
> 
> I've had some crazy ideas about maybe creating a custom SD to memory card adapter, since both SD cards and memory cards use standard SPI. It wouldn't be even necessary to open the console or touch anything inside, just an adapter much like on a GC.
> 
> For now I'm gonna focus on trying to port this exploit to other games.


Actually someone has made one very recently! https://8bitmods.com/memcard-pro-for-playstation-1/ < Still not released (and a little expensive, IMO) and it's just for making tons of virtual memory cards, but I assume someone could easily write a firmware to do exactly that


----------



## smallissue (Mar 12, 2021)

socram8888 said:


> tonyhax author here.


hi tonyhax author, im dad


----------



## KokoseiJ (Mar 12, 2021)

socram8888 said:


> tonyhax author here.
> 
> I've had some crazy ideas about maybe creating a custom SD to memory card adapter, since both SD cards and memory cards use standard SPI. It wouldn't be even necessary to open the console or touch anything inside, just an adapter much like on a GC.
> 
> For now I'm gonna focus on trying to port this exploit to other games.


Mad respect to you. That was some amazing work.
It would be really nice to get SD to Memory Card adapter- would really be handy for both PS1 and PS2 uses. either it happens or not, I respect your decisions and appreciate all your works.


----------



## Asia81 (Mar 12, 2021)

djpannda said:


> I just realized this....whoa I bet Tony Hawk is going to Sky Rocket


same as cubic ninjhax


----------



## socram8888 (Mar 12, 2021)

Tom Bombadildo said:


> Actually someone has made one very recently! https://8bitmods.com/memcard-pro-for-playstation-1/ < Still not released (and a little expensive, IMO) and it's just for making tons of virtual memory cards, but I assume someone could easily write a firmware to do exactly that


The interesting bit is that you don't even need to make a custom firmware or use any fancy circuitry. If my memory serves me correctly, the PS1 on the memory card uses just standard SPI - that's exactly what SD cards use too.
You couldn't use it for saving in games since the commands are different, BUT you could indeed talk using custom software using nothing but a passive adapter.
I once did for fun a NetYaroze boot card using an Arduino. It just waited the console to emit a particular SPI command, and then replied with what the NetYaroze boot disc expected.


----------



## Cyan (Mar 12, 2021)

Ohh,nice.
It's always interesting to see old console's exploit being released.

I thought I wouldn't need to swap games on my PS1 anymore (it's an original launch day SCPH 1002 with swap support), but from what I understand, it's a "swap-loader" method using an original game disc, for non boot swap-compatible consoles.
I thought it was something like PS2 FreeMcBoot directly loading the memory card's exploit, but it's not like that. You always need to play Tony hawk to unlock and "wait for lid", which means it's not compatible with multi-disc games, right ? (Chrono cross or Parasite eve requires disc swapping without saving first)

or is the unlock hack working with in-game swapp ? that's very great for everyone if it works 


Thanks for releasing it 
It'll be helpful to many users. It's always nice to have multiple choices !

edit:
Having SDCard adapter for memory card would be great too !


----------



## TwistedZeon (Mar 12, 2021)

socram8888 said:


> tonyhax author here.
> 
> I've had some crazy ideas about maybe creating a custom SD to memory card adapter, since both SD cards and memory cards use standard SPI. It wouldn't be even necessary to open the console or touch anything inside, just an adapter much like on a GC.
> 
> For now I'm gonna focus on trying to port this exploit to other games.


Hey! Wonderful work here man. That's a very intriguing idea and I honestly would love if something like this could happen. I want an sd method for my ps1 but I just cannot do the intricate soldering needed for most every option out there.


----------



## tech3475 (Mar 12, 2021)

Asia81 said:


> same as cubic ninjhax



Well the cheap copies have gone quick on ebay.


----------



## socram8888 (Mar 12, 2021)

Cyan said:


> I thought I wouldn't need to swap games on my PS1 anymore (it's an original launch day SCPH 1002 with swap support), but to my understanding, it's a "swap-loader" method using an original game disc, for non boot swap-compatible consoles.
> I thought it was something like PS2 FreeMcBoot directly loading the memory card's exploit, but it's not like that. You always need to play Tony hawk to unlock and "wait for lid", which means it's not compatible with multi-disc games, right ? (No chrono cross, or Parasite eve, which requires disc swapping without saving first)


According to the documentation I based this on, it should work also for games that use multiple discs, unless they reset the CD BIOS:


> In the unlocked state, ReadN/ReadS are working for unlicensed CD-Rs, and for imported CDROMs from other regions (both without needing modchips). However there are some cases which may still cause problems: The GetID command (1Ah) does still identify the disc as being unlicensed, same for the Get SCEx Counters test command (19h,05h). And, if a game should happen to send the Reset command (1Ch) for some weird reason, then the BIOS would forget the unlocking, same for games that set the "HCRISD" I/O port bit. On the contrary, opening/closing the drive door does not affect the unlocking state.


Thus, if those multi-CD games limit themselves to use standard BIOS calls and don't do any nasty things, they _should_ work.


----------



## playstays_shun (Mar 12, 2021)

socram8888 said:


> tonyhax author here.
> 
> I've had some crazy ideas about maybe creating a custom SD to memory card adapter, since both SD cards and memory cards use standard SPI. It wouldn't be even necessary to open the console or touch anything inside, just an adapter much like on a GC.
> 
> For now I'm gonna focus on trying to port this exploit to other games.



Does the ps1 memory card slot have enough bandwidth to handle something @ passable speeds? i.e. like serial part on DC, or GC memory card?

Wouldn't it require a lot of Swiss like witchcraft?

What's more epic about these hax is the popularity of THPS1+2 remake and the timing 



tech3475 said:


> Well the cheap copies have gone quick on ebay.



you think this will really happen? maybe temporarily, but game save exploitable GC games aren't much to boot into Swiss, the cost will drop after some hype.

I also think ps1 has got to be the most popular mod chipped console of all time. its like a coin flip a used ps1 you buy will already have one installed



djpannda said:


> thats cool no mod chip needed! but still love on psio as don't need a working cd Drive or back up disc.. just SD files. Never the less more ways are always better



PSIO is alright it seems, especially if you want to keep the same model for discs, and I guess MODE having PS1 compatibility now with a QSB, but all in all I think the recent _Xstation _is still king for the features, its price point, performance + compatibility, and support.


----------



## Silent_Gunner (Mar 12, 2021)

I got excited for a second, thinking this was a way to get a sort of "soft ODE" for the PS1.

Still neat that there's a method out that doesn't require one to get an art eraser, a spring, and a finger that was said to be taken from King Midas' corpse!

--------------------- MERGED ---------------------------



socram8888 said:


> tonyhax author here.
> 
> I've had some crazy ideas about maybe creating a custom SD to memory card adapter, since both SD cards and memory cards use standard SPI. It wouldn't be even necessary to open the console or touch anything inside, just an adapter much like on a GC.
> 
> For now I'm gonna focus on trying to port this exploit to other games.



Would it be possible to have this adapter replace the need for the disc drive and the memory card in one fell swoop? To make it act as both an ODE and a memory card that, ideally, could be swapped out in software to have "multiple" memory cards all in Slot 1 as most games prefer it to be?


----------



## Alexander1970 (Mar 12, 2021)

Congratulations,very good Work.


As some already mentioned....
Not only the Exploit will be "skyrocket"..

....also the Prices for the needed original Games......"Collectors Item"....pff........


----------



## Silent_Gunner (Mar 12, 2021)

alexander1970 said:


> Congratulations,very good Work.
> 
> 
> As some already mentioned....
> ...



Both of the Lunar games, Persona 2 EP, Tales of Destiny, Tales of Destiny 2 (which is actually Tales of Eternia), the first print run of Dragon Ball Grand Turd: Final Bleh, Valkyrie Profile, etc., all in SEALED MINT CONDITION 100% NEVER OPENED BRAND NEW at the price of selling your soul to AlphaOmegaSin's and Maximilian Dood's collection!


----------



## zoogie (Mar 12, 2021)

Thank you Mr. Socram. I feel less insecure about hacking a dead system now.


----------



## WiiHomebrew+Snes (Mar 12, 2021)

Wonder if this would work on a PS2 in ps1 mode? simply because there is still no way to play CD-R backups or different region PS1 games on it without a modchip. Might try after picking up a copy of tony hawk.


----------



## cvskid (Mar 12, 2021)

This is great but at the same time relies on booting up the original game in order to load the exploit and also don't know how many multi disc games work with this method. Have to take the ps1 laser itself into consideration with it eventually going to stop working and i don't know how easy it is to replace a ps1 laser.

Anyone serious about ps1 or any disc based consoles will most likely want a ODE/optical drive emulator for systems that have one like the Terraonion MODE or The X-Station to futureproof yourself.


----------



## WiiHomebrew+Snes (Mar 12, 2021)

cvskid said:


> I don't know how easy it is to replace a ps1 laser.



very easy all things considered. Just the replacements are usually shite


----------



## sloppycrap (Mar 12, 2021)

Stuff like this is really cool, and I'm glad people work on it.

It's great that people who want to maintain their old hardware have a method to utilize it fully, I just don't want to maintain old hardware myself.  I'd much rather just emulate.


----------



## leon315 (Mar 12, 2021)

BUT WHY???????


----------



## socram8888 (Mar 12, 2021)

leon315 said:


> BUT WHY???????


Why not?


----------



## ClancyDaEnlightened (Mar 12, 2021)

I wonder if the cd player functionality can be exploited, like  freedvdboot


----------



## WiiHomebrew+Snes (Mar 12, 2021)

aadz93 said:


> I wonder if the cd player functionality can be exploited, like  freedvdboot


pretty sure there was some way to play backup games on really early ps1s involving the CD player


----------



## MikaDubbz (Mar 12, 2021)

leon315 said:


> BUT WHY???????


It's pretty cool to see an old system suddenly becoming softmoddable having never been so until now.  If you happen to have an old PS1 and TH2 or 3 laying around, now suddenly the entire console's library becomes open to you to play natively on the actual hardware.  I think that's really awesome.


----------



## cvskid (Mar 12, 2021)

Better get a copies of THPS2 and THPS3 while you can. Prices are gonna spike up for the games now.


----------



## ClancyDaEnlightened (Mar 12, 2021)

WiiHomebrew+Snes said:


> pretty sure there was some way to play backup games on really
> early ps1s involving the CD player





Exploit the cd player, to load code from the memory card 

Or create a modded bios, that ignores copy protection


----------



## Julie_Pilgrim (Mar 12, 2021)

Thps2 and thps3 boutta become the next cubic ninja


----------



## lokomelo (Mar 12, 2021)

People saying that the Tony Hawk game prices would go up, and that's may happen in short term, but I remind you that the code went open source just now, so more people will start to mess with it and more games should be discovered as exploitable (I think PS1 has like 8000 games).

Also, this is not the definitive solution for the so-called ultimate PS1. Ultimate PS1 should have an ODE, period. (I really mean that, discs die fast, unlike flash memory).


----------



## freestile (Mar 12, 2021)

Inredible!! I remember getting into swap magic and the little port thing you would plug into the back serial port.
Never actually installed a real mod chip to say, but this is super dope. I have like 4 still and I have the mini one too,
so actually I think I have about 5 original psx's to try this with. Hehe....


----------



## MetoMeto (Mar 12, 2021)

Do you need a game or just a save file?


----------



## lokomelo (Mar 12, 2021)

MetoMeto said:


> Do you need a game or just a save file?


both the original CD and the memory card with the modded save on it


----------



## Alexander1970 (Mar 12, 2021)

Hello.



MetoMeto said:


> Do you need a game or just a save file?



The Game(s)

Tony Hawks Pro Skater 2 (NTSC or PAL)
Tony Hawks Pro Skater 3 (NTSC or PAL)

Thank you.


----------



## DarthMotzkus (Mar 12, 2021)

Oh crap, i don't own a tony hawk 2 or 3 original copy. Guess i will try to import one. Finnally this came out!


----------



## uyjulian (Mar 12, 2021)

socram8888 said:


> tonyhax author here.
> 
> I've had some crazy ideas about maybe creating a custom SD to memory card adapter, since both SD cards and memory cards use standard SPI. It wouldn't be even necessary to open the console or touch anything inside, just an adapter much like on a GC.
> 
> For now I'm gonna focus on trying to port this exploit to other games.


See mx4sio, which is a similar solution for the PS2. https://www.psx-place.com/threads/m...d-sd-driver-for-the-ps2-sio2-interface.29210/


----------



## Leon11 (Mar 12, 2021)

This thing is really really good. If you have the original game of course, you don't need to modchip a console, you can buy an used PS1 and that's it. If multiple disc games work without problems this exploit replaces the modchip entirely. If in the future there is the possibility to load the exploit to load games from sd card without solder is a dream come true. The xstation and the the PSIO are good products but they require soldering and they are very pricey.


----------



## KiiWii (Mar 12, 2021)

On the original console I’m sure I used a pen lid and swapped after the boot message when it spins back up.


----------



## cvskid (Mar 12, 2021)

Leon11 said:


> This thing is really really good. If you have the original game of course, you don't need to modchip a console, you can buy an used PS1 and that's it. If multiple disc games work without problems this exploit replaces the modchip entirely. If in the future there is the possibility to load the exploit to load games from sd card without solder is a dream come true. The xstation and the the PSIO are good products but they require soldering and they are very pricey.


If i remember right for now the soldering can't be helped since that bypasses some security checks in ps1 systems. For anyone with a PS1 Slim this is probably the best method to use now since the PS1 Slim does not have a  ODE/Optical Disc Emulator option.

 As for the price think of it this way, for a 1 time payment you can have every ps1 game ever made all at  once on the system.


----------



## alucard_xs (Mar 12, 2021)

5 € for tony 3 here, I guess it's a good price


----------



## smf (Mar 12, 2021)

socram8888 said:


> I once did for fun a NetYaroze boot card using an Arduino.



The net yaroze boot card behaves like a standard memory card, it uses a different ID and read & write commands fail. The yaroze disk uses a command that memory cards support, but no software uses. I assume there are lines jumpered to ground differently between the two but haven't investigated.

memcard to usb/ethernet would be kinda cool for development on psone (or full size that don't have parallel ports). hooking up a cheap esp to the memcard port can be done much cheaper than that memcard pro.

technically it's not spi as the standard protocol uses dtr to select the device and dsr as a handshake. You'd need to keep an sdcard off the bus unless that port is selected and make sure the first byte sent to the sd card wasn't an 01 or the controller above it will interfere. There are some other id's that are good to avoid as the first byte after dtr goes low as well, especially if you want to use the same adapter on a ps2. You can avoid the dsr to ack each byte, but it will probably then be incompatible with multitap.


----------



## eduall (Mar 12, 2021)

that's neat! finally the gold console is alive again!


----------



## Jayro (Mar 12, 2021)

I just boot to my Gameshark CD, swap to a CD-R, and start the burned game without cheats.


----------



## 0000ff (Mar 12, 2021)

This will be quite helpful. 

Snagged one on the cheap from ebay before the price goes through the roof. Now to wait 4 weeks for delivery, thanks USPS.


----------



## gbazone (Mar 12, 2021)

KiiWii said:


> On the original console I’m sure I used a pen lid and swapped after the boot message when it spins back up.



Same, before I eventually got a modchip. It was damn near impossible. Only worked like 1 out of 20 tries. And if I remember correctly the disc drive was really picky about which CD-R brands it would take. Memorex was always a safe bet.


----------



## KentaZX (Mar 12, 2021)

Okay So I've test this hax on my NTSC-U PSOne with a japanese game called mad panic coaster and PAL copy of Vib Ribbon.

Vib Ribbon works 100% both playing the the game disc AND music CDs, no security hangups or anything whatsoever. However, the Tony hax menu gets "stuck" at STARTING when I tried to load up Mad panic Coaster.


----------



## socram8888 (Mar 12, 2021)

KentaZX said:


> Okay So I've test this hax on my NTSC-U PSOne with a japanese game called mad panic coaster and PAL copy of Vib Ribbon.
> 
> Vib Ribbon works 100% both playing the the game disc AND music CDs, no security hangups or anything whatsoever. However, the Tony hax menu gets "stuck" at STARTING when I tried to load up Mad panic Coaster.


Thanks for the report, I'll look into it.


----------



## elBenyo (Mar 12, 2021)

If only this had a Bios entry point to pair with so we could coldboot. i.e. an overflow in the save title or loaded through the CD player program (like 3DS's music player's parsing glitch).


----------



## Jayro (Mar 12, 2021)

elBenyo said:


> If only this had a Bios entry point to pair with so we could coldboot.


Kind of shocked nobody has attacked the bootrom yet, tbh...


----------



## elBenyo (Mar 12, 2021)

Jayro said:


> Kind of shocked nobody has attacked the bootrom yet, tbh...


Me too, I'll take a look after work. Maybe there's obvious endian security issues I could attack.


----------



## socram8888 (Mar 12, 2021)

elBenyo said:


> If only this had a Bios entry point to pair with so we could coldboot. i.e. an overflow in the save title or loaded through the CD player program (like 3DS's music player's parsing glitch).


I've tried that already. The BIOS uses strncpy for the path name. If a save file looks fishy (name too long, too many blocks...) it gets nuked.


----------



## socram8888 (Mar 12, 2021)

KentaZX said:


> Okay So I've test this hax on my NTSC-U PSOne with a japanese game called mad panic coaster and PAL copy of Vib Ribbon.
> 
> Vib Ribbon works 100% both playing the the game disc AND music CDs, no security hangups or anything whatsoever. However, the Tony hax menu gets "stuck" at STARTING when I tried to load up Mad panic Coaster.


Mad Panic seems to be doing fishy things. In fact I can't even get it to boot reliably on the emulator, with or without tonyhax.
It executes the following BIOS calls:

A(39h): InitHeap(0x801F95AC, 0xFFFFEA58) -> init malloc heap with size 0xFFFFEA58, wtf
A(72h): CdRemove() (call bugged)
*A(44h) - FlushCache()*
Then crashes. This last call is called with Vsync and DMA interrupts enables, which according to documentation, is a mistake:


> BUG: The FlushCache function contains a handful of opcodes that do use the k0 register without having IRQs disabled at that time, if an IRQ occurs during those opcodes, then the k0 value gets destroyed by the exception handler, causing FlushCache to get trapped in an endless loop.



This could explain why it is so temperamental, as it is a race condition. If this is the reason, there's little I can do from tonyhax.


----------



## Magnus87 (Mar 12, 2021)

Cyan said:


> Ohh,nice.
> It's always interesting to see old console's exploit being released.



Exactly, I also love these kinds of discoveries or creation of tools long after the "demise" of the console.

I wonder if in the not too distant future it could be used to boot PSIO since it needs a modchip


----------



## stanleyopar2000 (Mar 12, 2021)

I'm guessing Tony Hawk's Pro Skater 2 because it's one of the best candidates for the swap disk trick because it's one of the largest in file size?

$103 on Amazon. That didn't take long


----------



## Zaphod77 (Mar 12, 2021)

No, this hack tells the drive to tell lie to the console and say the protection check passed, while still reading the new TOC.

I'm amazed if this even beats anti-mod games.


----------



## THEELEMENTKH (Mar 13, 2021)

Never been so happy to see my childhood PS1 THPS3 copy besides me


----------



## Paulsar99 (Mar 13, 2021)

Even though the chances are low but I hope this leads to a solderless and cheaper alternative to the likes of xstation.


----------



## raxadian (Mar 13, 2021)

This is amazing but both of my PS1 are chipped.  Is that printer port some Playstations have on the back useful for anything?


----------



## limpbiz411 (Mar 13, 2021)

just grabbed a cheap copy of THPS 2 and 3 for 9 each before they skyrocket in price.


----------



## ClancyDaEnlightened (Mar 13, 2021)

aadz93 said:


> Exploit the cd player, to load code from the memory card
> 
> Or create a modded bios, that ignores copy protection
> 
> ...





Jayro said:


> Kind of shocked nobody has attacked the bootrom yet, tbh...




I was thinking the same, either a bootrom exploit,or a custom bios replacement

You can swap bios between ps1 revisions, and will work, you can run a launch model ps1 bios on a psone slim, though with some simple patches (io port init)

I don't think the ps1 checks the bios, so you can just replace it with a flash chip,with a bios with no copy protection, using a flash chip, it can also be updated if need be

The only other way is to use in game exploits, since this is still the generation of consoles where game code is completely trusted,and can access and run anything 


Plus with psnee I can just use a $3usd arduino 

https://ebay.to/3bGi9Pj


----------



## ClancyDaEnlightened (Mar 13, 2021)

raxadian said:


> This is amazing but both of my PS1 are chipped.  Is that printer port some Playstations have on the back useful for anything?



Yes, cheat devices use this, and the ps1 flash cartridge psio (https://ps-io.com/store/psio-cartridge/)

One of the reasons it was later removed


----------



## driverdis (Mar 13, 2021)

I did notice with THPS 3 while testing the exploit on a PS1 that needs a pot adjustment that frequent read errors due to the drive may cause the exploit to crash or not run. I do have a copy of THPS 2 on the way in better shape than my THPS 3 disc and will be using a different PS1 as well.

I used an SCPH-5501 for this test

disc rot or scratches may cause the crashes or loading errors on THPS 3 but 2 may be less demanding due to having a simpler menu that takes less data to load in.


----------



## KentaZX (Mar 13, 2021)

socram8888 said:


> Mad Panic seems to be doing fishy things. In fact I can't even get it to boot reliably on the emulator, with or without tonyhax.
> It executes the following BIOS calls:
> 
> A(39h): InitHeap(0x801F95AC, 0xFFFFEA58) -> init malloc heap with size 0xFFFFEA58, wtf
> ...



thats weird. I DID do the swap trick on my ps1 to see if my copy of the game was screwed, but nope it works just fine.


----------



## Hwilliams8548 (Mar 13, 2021)

djpannda said:


> I just realized this....whoa I bet Tony Hawk is going to Sky Rocket


I actually liked thps2 a while back and still own the game


----------



## raxadian (Mar 13, 2021)

aadz93 said:


> Yes, cheat devices use this, and the ps1 flash cartridge psio (https://ps-io.com/store/psio-cartridge/)
> 
> One of the reasons it was later removed



Cool, I guess is too slow to connect a hard disk and load games from it?

Actually is better to fo stuff like that on a PS2, all PS1 games work on it and avoiding using discs means the DVD laser doesn't ruin the CDs. And yes that was a problem back then.

What do you have to do to connect a Hard disc to a PS2 slim, use the Internet adapter?


----------



## Retinal_FAILURE (Mar 13, 2021)

Nice! Off to the process for my SCPH-900x and PSOne Models, the latter of which have difficulty in playing near any retail game. I'll never sell my gameshark for SCPH-1001 models I own though... It's just too good looking to stop using UniROM or maybe not, but time will tell. 



Chary said:


> ​
> 
> Those wanting to take their original PlayStation to the next level usually needed to open up the system and install a modchip; that's been common knowledge since even the '90s. However, a user named Socram, previously known for creating amiitool, has released an exploit that makes modding your PS1 easier than ever before. Called "tonyhax", because it utilizes Tony Hawk's Pro Skater 2 or 3, it loads specific data off of the PS1's memory card that "unlocks" the system's disc drive, which then lets you run other region games or even backups.
> 
> ...


----------



## tech3475 (Mar 13, 2021)

raxadian said:


> Cool, I guess is too slow to connect a hard disk and load games from it?
> 
> Actually is better to fo stuff like that on a PS2, all PS1 games work on it and avoiding using discs means the DVD laser doesn't ruin the CDs. And yes that was a problem back then.
> 
> What do you have to do to connect a Hard disc to a PS2 slim, use the Internet adapter?



On the Slim, AFAIK smb is the only practical option. Although earlier models of the Slim did have the header for an IDE connection. Iirc at some point someone was making mods with special cases to hold a HDD.


----------



## socram8888 (Mar 13, 2021)

KentaZX said:


> thats weird. I DID do the swap trick on my ps1 to see if my copy of the game was screwed, but nope it works just fine.


Interesting. No clue.

I reinitialize the kernel so it could be that I am leaving the console in a different state that the game expects, but I can't figure out exactly what changed.


----------



## raxadian (Mar 13, 2021)

tech3475 said:


> On the Slim, AFAIK smb is the only practical option. Although earlier models of the Slim did have the header for an IDE connection. Iirc at some point someone was making mods with special cases to hold a HDD.



Unfortunately the adapter is a bit pricey nowadays, but I have 90% of the games I wanna play burned on DVDs anyway. 

ATM I am playing around with my rehacked Wii. A sore spot is how bad the N64 emulation for the Wii is. Thankfully there is both a method on injection into Wiiware and an exoerimental method to include the service pack for those sweet extra 4 mb of ram. Not all N64 games work that way but hey, is a work in progress.


----------



## Cyan (Mar 13, 2021)

aadz93 said:


> I wonder if the cd player functionality can be exploited, like  freedvdboot





WiiHomebrew+Snes said:


> pretty sure there was some way to play backup games on really early ps1s involving the CD player


Yes, you could swap the disc from the CD player on first models. 

Go to CD player, put a game, block the lid detector. The CD player check the disc's TOC and stop spinning. swap disc, exit disc player and the new game launches.
The only problem is it's using the original disc's TOC.
Read next quote below for proper way to swap with TOC reading.



KiiWii said:


> On the original console I’m sure I used a pen lid and swapped after the boot message when it spins back up.


I used Pen lid for a very short while, but it wasn't stable 
I switched to just small tape to keep the lid detector in place, and then I could close the lid itself for safety. no more "play with lid open". and I could properly "put the console on the side to help with the laser reading" too, without risking to lose the pen lid  

Hmmm, are you talking about the "PS logo" screen ? when the disc get a slower spin and then spin faster ?
That swap method also had the TOC issue. Which could be enough for lot of games as long as you used a big disc as sources, with lot of tracks, or a disc one single data track, etc.

You had a very short window of few miliseconds to swap the disc between "original disc check" and "TOC reading".
It's checked very very early at console boot, or when the lid detector is pressed (you can do it with multi-disc games too).

I always do it with feeling and hearing, putting my fingers gently on the block reader and "feeling" the laser head moving, there's a "move" and a "tic tic tic" sound. you do it between them. if you heard the tic, it's too late. if you do it too soon, nothing happen, and you could try again.

Note:
There were silent updates of late SCPH1002 (probably also other 100x), which had the swap method disabled. I encountered that model once, and couldn't do the swap trick at all, neither of the 3 versions.



DarthMotzkus said:


> Oh crap, i don't own a tony hawk 2 or 3 original copy. Guess i will try to import one. Finnally this came out!


Be sure your "import" is from the same region than your console.
if not, it'll not boot, you need a way to boot imports first, which TonyHax allows you to.


----------



## socram8888 (Mar 13, 2021)

For your information, so you don't become paranoid about getting copies of THPS 2 and 3, tonyhax v1.1 will also add support for:

Tonyhawk's Pro Skater 4, in both European and American releases (apparently there are also French and Germany versions according to redump?)
Brunswick Circuit Bowling 1 (and maybe 2)


----------



## Deleted member 323844 (Mar 13, 2021)

Amazing hack. It does not work with PS-IO if anyone is wondering (probably not). I guess Matt has replaced the virtual CD drive info with his own string?

https://i.imgur.com/tDk6Iwy.gif


----------



## nikeymikey (Mar 13, 2021)

tech3475 said:


> Well the cheap copies have gone quick on ebay.



Shitloads of copies on Uk Ebay right now TSPS 2 buy it now for around £12.. get in quick


----------



## tech3475 (Mar 13, 2021)

nikeymikey said:


> Shitloads of copies on Uk Ebay right now TSPS 2 buy it now for around £12.. get in quick



When I looked yesterday, there were copies of 3 for around £3 (disc only) which were going quickly.


----------



## Leon11 (Mar 13, 2021)

There are french copies of THPS 3 that have SLES-03646 ID. Do they work?


----------



## socram8888 (Mar 13, 2021)

Leon11 said:


> There are french copies of THPS 3 that have SLES-03646 ID. Do they work?


I could add support, as I bet they'd be literally the same code with minor patches and thus exploitable as well, but at the moment, no. I'll try to get it done for v1.1.


----------



## Stwert (Mar 13, 2021)

2 of my PS1’s are chipped anyway, but as I have THPS3, I’ll download this and add it to my (ridiculous amount of TB’s of firmware/software/hacks/backups, magazines, manuals) collection anyway.... Just in case something even more interesting comes of it


----------



## ClancyDaEnlightened (Mar 13, 2021)

raxadian said:


> Cool, I guess is too slow to connect a hard disk and load games from it?
> 
> Actually is better to fo stuff like that on a PS2, all PS1 games work on it and avoiding using discs means the DVD laser doesn't ruin the CDs. And yes that was a problem back then.
> 
> What do you have to do to connect a Hard disc to a PS2 slim, use the Internet adapter?




Does nobody use opl and usb loading on ps2???
https://github.com/ps2homebrew/Open-PS2-Loader


----------



## shinwg (Mar 13, 2021)

Sadly I don’t have my ps1 anymore. I sold it 13 years ago with over 200 games or more. I was an idiot, I sold all my old console very cheap


----------



## tech3475 (Mar 13, 2021)

shinwg said:


> Sadly I don’t have my ps1 anymore. I sold it 13 years ago with over 200 games or more. I was an idiot, I sold all my old console very cheap



At least you got money, my parents threw out my NES games when the console started blinking.

Worst part is that it was my Dad who bought my current NES years later.


----------



## ClancyDaEnlightened (Mar 13, 2021)

tech3475 said:


> At least you got money, my parents threw out my NES games when the console started blinking.
> 
> Worst part is that it was my Dad who bought my current NES years later.



You sure he didn't buy it for him, not you? That's why nes went from $20 for a console to up to $80-100, shit is crazy, I'll just import a famicom for $30, I honestly prefer the famicom over the nes,just looks cool imho


----------



## shinwg (Mar 13, 2021)

tech3475 said:


> At least you got money, my parents threw out my NES games when the console started blinking.
> 
> Worst part is that it was my Dad who bought my current NES years later.





aadz93 said:


> You sure he didn't buy it for him, not you? That's why nes went from $20 for a console to up to $80-100, shit is crazy, I'll just import a famicom for $30, I honestly prefer the famicom over the nes,just looks cool imho


My NES and SNES both and mad games sold under $20 I remembered the local shop owner give me 20 cents per cartridge, same for the rest N64, game cube, all version game boy, sega genesis, cd, nomad, game gear, dream cast. Ps1, ps2, Xbox. The only console  I keep Xbox 360, ps3, ps4 psp 3ds. I wished i can go back undone my mistakes


----------



## cvskid (Mar 13, 2021)

aadz93 said:


> Does nobody use opl and usb loading on ps2???
> https://github.com/ps2homebrew/Open-PS2-Loader


If i remember right loading from usb on ps2 is slow since ps2 has usb 1.1 ports, not usb 2.0 ports so there can be issues, mainly with video playback in games. That's why i personally think ps2 slim needs a optical drive emulator.


----------



## Zaphod77 (Mar 13, 2021)

The change with the newer bios was to make the console check protection TWICE during the boot.

To beat this, you swap near the end of the white screen from your original to your backup. then wait for the disk to slow down again and swap to your original, then swap again to the backup as soon as the black screen goes away.

Then you have to do the same thing AGAIN if the game has an anti-mod check during boot.  

The really fun one is booting a club append disc for DDR with a swap trick.   Here's how you do it.

0) find some way to hold the sensor down.
1) insert in region original disc.
2) swap to 2nd or 3rd mix right after the disc starts to speed up.
3) swap to original after toc is read and main exe is loaded before protection is checked (when the drive slows down again).  
4) after black screen goes away, swap to backup.
5) at memcard screen, swap AGAIN to US disc.  when the screen goes away, swap AGAIN to backup.
6) pick option to insert append disc
7) insert original US disc, and trip the sensor
8) wait 10 seconds or so, then swap quickly to the club append.
9) at memcard screen, repeat step 5.  you have FINALLY booted it.

9 disc changes.


----------



## raxadian (Mar 13, 2021)

shinwg said:


> Sadly I don’t have my ps1 anymore. I sold it 13 years ago with over 200 games or more. I was an idiot, I sold all my old console very cheap



Not a huge loss if you have a chipped PS2. 99% of PS1 games work on chipped PS2s with the rare few that don't or have problems either having workarounds or working in  emulators.


----------



## ClancyDaEnlightened (Mar 13, 2021)

cvskid said:


> If i remember right loading from usb on ps2 is slow since ps2 has usb 1.1 ports, not usb 2.0 ports so there can be issues, mainly with video playback in games. That's why i personally think ps2 slim needs a optical drive emulator.



I always used usb loading, I never had any issues with it, both using a usb hdd and usb flash drives, I can see fmv issues, but I skip those anyway

--------------------- MERGED ---------------------------



shinwg said:


> My NES and SNES both and mad games sold under $20 I remembered the local shop owner give me 20 cents per cartridge, same for the rest N64, game cube, all version game boy, sega genesis, cd, nomad, game gear, dream cast. Ps1, ps2, Xbox. The only console  I keep Xbox 360, ps3, ps4 psp 3ds. I wished i can go back undone my mistakes




I was the person buying them too, for like $3-$5 a cart, 10-30 for consoles


----------



## Deleted User (Mar 13, 2021)

I bet, in like a month, we end up seeing some homebrew memory card that runs games from n sd card, and it'll be insanely easy. I can see it happening.

I wonder if any other games will be able to use this. Gonna have to check out the local charity shops for one of these games.


----------



## konamicode89 (Mar 13, 2021)

This is awesome! But why is it that it won’t work on SCPH-1000 models?


----------



## Deleted member 323844 (Mar 13, 2021)

StarGazerTom said:


> I bet, in like a month, we end up seeing some homebrew memory card that runs games from n sd card, and it'll be insanely easy. I can see it happening.
> 
> I wonder if any other games will be able to use this. Gonna have to check out the local charity shops for one of these games.


Iirc SIO2SD is doable on PS1, but I guess the Memory Card bus on PS1 is slow as hell, so it probably does not worth at all.


----------



## WeedZ (Mar 13, 2021)

Am I in an alternate universe where it wasn't possible disc swap cd-r backups on a stock ps1?


----------



## socram8888 (Mar 13, 2021)

konamicode89 said:


> This is awesome! But why is it that it won’t work on SCPH-1000 models?


SCPH-1000 have an older BIOS on the CD controller that predates the introduction of the unlock command.

The exploit would boot just fine, but it'd probably report that it couldn't be unlocked.


----------



## elBenyo (Mar 13, 2021)

socram8888 said:


> I've tried that already. The BIOS uses strncpy for the path name. If a save file looks fishy (name too long, too many blocks...) it gets nuked.


I'm starting to see how this works. I'm still reading about the kernel's panic handlers. A game seems to be the best entry point to the shell.


----------



## socram8888 (Mar 13, 2021)

Leon11 said:


> There are french copies of THPS 3 that have SLES-03646 ID. Do they work?


As promised, support has been added in the upcoming v1.1 for all Germany and French copies of THPS2/3/4: https://github.com/socram8888/tonyhax/commit/08673ad7f9b8761a68a321a70b7a3ac0091e0868


----------



## limpbiz411 (Mar 13, 2021)

how long until we see eBay flooded with memory cards with the exploit already on them?


----------



## Leon11 (Mar 13, 2021)

Nice, so now we have all the editions covered.

These are all the possible editions.


----------



## KentaZX (Mar 13, 2021)

socram8888 said:


> Interesting. No clue.
> 
> I reinitialize the kernel so it could be that I am leaving the console in a different state that the game expects, but I can't figure out exactly what changed.



sounds like to me there could be other games that can have this kind of a problem...Unless this is the only one and everything else works fine, so no need for a compatibility chart?

Also, so youre releasing a v1.1 soon? Do I have to replace the save file AND the exploit file when it comes out? or just the exploit file?


----------



## tech3475 (Mar 13, 2021)

Just to confirm, does this work on the PS One (i.e. the 'slim' model)?


----------



## ILuvGames (Mar 13, 2021)

tech3475 said:


> Just to confirm, does this work on the PS One (i.e. the 'slim' model)?


If you watched the Youtube video in the opening post and read the opening post you would know .


----------



## tech3475 (Mar 13, 2021)

ILuvGames said:


> If you watched the Youtube video in the opening post and read the opening post you would know .



Sorry, didn't watch the video, only saw the picture which used the 'phat' model so I just wanted to be sure it had been tested on it.

I'm thinking of now getting the LCD display for it, so another reason to verify in case I see one before I could test it myself.


----------



## socram8888 (Mar 13, 2021)

KentaZX said:


> sounds like to me there could be other games that can have this kind of a problem...Unless this is the only one and everything else works fine, so no need for a compatibility chart?
> 
> Also, so youre releasing a v1.1 soon? Do I have to replace the save file AND the exploit file when it comes out? or just the exploit file?


I've just had myself an issue loading Formula 1 '97 NTSC, which crashed after displaying the copyright information. I will look further into it.

I omitted some stuff during the initialization, which was enough to get all the games I had at the moment running, but maybe these do need a perfect state during boot. I'll look into it.

v1.1 will be released as soon as I finish adding the games that I am aware are vulnerable, so it should be ready by week. Unless I figure out what is wrong with those games that crash and fix the SPL, there's would be very little reason to update, as I'd only be adding new supported games but no extra functionality.


----------



## raxadian (Mar 13, 2021)

StarGazerTom said:


> I bet, in like a month, we end up seeing some homebrew memory card that runs games from n sd card, and it'll be insanely easy. I can see it happening.
> 
> I wonder if any other games will be able to use this. Gonna have to check out the local charity shops for one of these games.



Unfortunately PS1 memory cards are too slow and don't have much space. Is technically possible to run an Atari emulator from one but is more of a "Because I can" thing.

A PS2 memory card could run Nes games and the PS2 not only has bigger memory cards but is much faster. 

But really with the PS1 hacked you can just run the homebrew from a CD and save data, as long is not much data, on the memory card. If you have a PS1 with that port on the back you can do more like try running a very small Linux OS, but otherwise there is not much point.  A PS1 is not a Dreamcast, so the options are limited. Wanna get online? Get a PS2 minimum.

Yeah sorry to keep saying this but the PS2 is better for any homebrew ideas you can have, can run games from a hard disk so no more disc scratching, can play a lot of video and audio files and can even be used as a (slow) media center. 

Yes the PS1 is great, but is like comparing a PSP with a Vita. A Vita can do anything a PSP can do and do it better, thanks to mods and hacking. Sure there are a few games that don't work right but 100% compatibility is a rare thing.


----------



## cashboxz01 (Mar 13, 2021)

raxadian said:


> Unfortunately PS1 memory cards are too slow and don't have much space. Is technically possible to run an Atari emulator from one but is more of a "Because I can" thing.
> 
> A PS2 memory card could run Nes games and the PS2 not only has bigger memory cards but is much faster.
> 
> ...


this. but in terms of ps2, it has ps1 hardware in it specifically for a 1:1 experience. it's not even emulating the games.


----------



## Deleted member 323844 (Mar 13, 2021)

raxadian said:


> Unfortunately PS1 memory cards are too slow and don't have much space. Is technically possible to run an Atari emulator from one but is more of a "Because I can" thing.


Playstation 2 Memory Card ports (SIO2-Interface) to SD adapters have been already done, they're not public yet since they're polishing the hardware and the software (especially crafted Open PS2 Loader version).

It's waaay more slower than the DVD drive (like 3mbps less) but it gives an advantage of 200-300kbps over USB ports, still slower than the ethernet interface (samba server).



cashboxz01 said:


> this. but in terms of ps2, it has ps1 hardware in it specifically for a 1:1 experience. it's not even emulating the games.


All PS2 models use some sort of emulation for PS1. Phat models has the main CPU (+ co-processors like the GTE, I guess) as IOP and the SPU is already inside the SPU2 (which is just 2 SPUs). The GPU is emulated inside the Graphics Synthesizer, infact, it has retro-compatibility mode that disables the z-buffer, perspective correction and texture filtering passes.


----------



## FR0ZN (Mar 13, 2021)

socram8888 said:


> v1.1 will be released as soon as I finish adding the games that I am aware are vulnerable, so it should be ready by week.



In the early PSVita scene there were exploits for Tekken 2 and XS Moto/Sports Superbike 2.
Maybe you can repurpose those exploits to load your code?


----------



## blindseer (Mar 14, 2021)

It's not a common game but another game that allows you to name and create a profile is Einhander... No idea if its exploitable but I figured I'd mention it.


----------



## raxadian (Mar 14, 2021)

blindseer said:


> It's not a common game but another game that allows you to name and create a profile is Einhander... No idea if its exploitable but I figured I'd mention it.



The thing is not if the game allows you to add a name but if it checks the number of characters limit.  As is something impossible to do without hacking the save file some games do not check if the name is over the limit and that's how this exploit works.


----------



## KentaZX (Mar 14, 2021)

socram8888 said:


> I've just had myself an issue loading Formula 1 '97 NTSC, which crashed after displaying the copyright information. I will look further into it.
> 
> I omitted some stuff during the initialization, which was enough to get all the games I had at the moment running, but maybe these do need a perfect state during boot. I'll look into it.
> 
> v1.1 will be released as soon as I finish adding the games that I am aware are vulnerable, so it should be ready by week. Unless I figure out what is wrong with those games that crash and fix the SPL, there's would be very little reason to update, as I'd only be adding new supported games but no extra functionality.



Alright. Also, maybe it was pointless to try, but just for the sake of confirmation, I've tested out ripping and burning the MPC game into a CD-R to see if it'll make a difference. It does not.

Oh yea, the game does load up on Retroarch on the PC with the PCSX rearmed core just fine. I didnt try doing the tonyhax on it though.


----------



## Silent_Gunner (Mar 14, 2021)

Why can't someone use the PS3's memory card adapter to copy the hack onto a memory card? Does it really require a hacked PS2 to absolutely copy it onto the card itself?


----------



## raxadian (Mar 14, 2021)

Silent_Gunner said:


> Why can't someone use the PS3's memory card adapter to copy the hack onto a memory card? Does it really require a hacked PS2 to absolutely copy it onto the card itself?



Can that adapter read PS1 memory cards?


----------



## Silent_Gunner (Mar 14, 2021)

raxadian said:


> Can that adapter read PS1 memory cards?



Yes, it can read both PS1 and PS2! I just wasn't sure if the hacked PS2 was needed for something exclusive to this hack.


----------



## raxadian (Mar 14, 2021)

Silent_Gunner said:


> Yes, it can read both PS1 and PS2! I just wasn't sure if the hacked PS2 was needed for something exclusive to this hack.



Just to copy and paste the hacked save data and the rest of the hack.  So yes technically posiible to do it on a PS3 with the adapter.


----------



## socram8888 (Mar 14, 2021)

KentaZX said:


> Alright. Also, maybe it was pointless to try, but just for the sake of confirmation, I've tested out ripping and burning the MPC game into a CD-R to see if it'll make a difference. It does not.
> 
> Oh yea, the game does load up on Retroarch on the PC with the PCSX rearmed core just fine. I didnt try doing the tonyhax on it though.


Alright, bug is fixed and upcoming v1.1 will support loading that game: https://github.com/socram8888/tonyhax/commit/d92ee7163f091b85f3ef38ff203541f42c2fe886

It turns out THPS was mangling somehow part of the kernel memory - a part of the kernel that apparently newer games (Tony Hawk's, Spyro, Hogs of War, Harry Potter...) don't use, but older (such as that one or F1 '97) do. I still need to check different BIOSes, to check if the place I am coping data from is identical to other regions and versions, but at least on my SCPH-102 works now.


----------



## KentaZX (Mar 14, 2021)

socram8888 said:


> Alright, bug is fixed and upcoming v1.1 will support loading that game: https://github.com/socram8888/tonyhax/commit/d92ee7163f091b85f3ef38ff203541f42c2fe886
> 
> It turns out THPS was mangling somehow part of the kernel memory - a part of the kernel that apparently newer games (Tony Hawk's, Spyro, Hogs of War, Harry Potter...) don't use, but older (such as that one or F1 '97) do. I still need to check different BIOSes, to check if the place I am coping data from is identical to other regions and versions, but at least on my SCPH-102 works now.


awsome! That was quick.


----------



## raxadian (Mar 14, 2021)

Once more I gotta say this is fantastic.


----------



## smf (Mar 14, 2021)

elBenyo said:


> Me too, I'll take a look after work. Maybe there's obvious endian security issues I could attack.



What's an endian security issue?



raxadian said:


> This is amazing but both of my PS1 are chipped.  Is that printer port some Playstations have on the back useful for anything?



It's not a printer port, it is the 16 bit cpu io bus that supports pio & dma. There is also a digital audio input that can be mixed with the spu and an interrupt (IIRC it's shared with the interrupt pin on the game controller ports used by konami guns).

Mostly it's used by cheat cartridges to hang an 8 bit rom off, but it can do much more than that. There is an official and very rare development tool ethernet adapter used for transferring art from SGI workstations for example.



aadz93 said:


> You can swap bios between ps1 revisions, and will work



If you're going to solder in a new bios then why bother trying to exploit a game? It would be easier to solder in a chip.


----------



## ClancyDaEnlightened (Mar 14, 2021)

smf said:


> What's an endian security issue?
> 
> 
> 
> ...



Obviously I'm referring to the  attacking or replacing the bios not a game, this would allow homebrew code at startup


----------



## driverdis (Mar 14, 2021)

Silent_Gunner said:


> Why can't someone use the PS3's memory card adapter to copy the hack onto a memory card? Does it really require a hacked PS2 to absolutely copy it onto the card itself?



i tried this and was able to copy the main game save but not the exploit itself as the program I am using (PSX memory card manager) allows copying saves to and from the card but requires additional naming info for the exploit file and I can’t seem to get it to not end up renamed when copied to the card.
http://onorisoft.free.fr/retro.htm?psx/psx.htm

--------------------- MERGED ---------------------------



Zaphod77 said:


> No, this hack tells the drive to tell lie to the console and say the protection check passed, while still reading the new TOC.
> 
> I'm amazed if this even beats anti-mod games.



this should as anti mod games are dumb and check if a modchip is reporting the license string over and over like the non stealth chips do. Of course some like Spyro 3 still needs to be patched as it checks wobble and other stuff while playing.


----------



## raxadian (Mar 14, 2021)

smf said:


> If you're going to solder in a new bios then why bother trying to exploit a game? It would be easier to solder in a chip.



True.

The whole objective is a softmod aka not modding the hardware.


----------



## socram8888 (Mar 14, 2021)

driverdis said:


> Of course some like Spyro 3 still needs to be patched as it checks wobble and other stuff while playing.


I've tried Spyro 3 and it didn't trigger the antipiracy. In fact, to my knowledge Spyro 3 doesn't check for the presence of the SCEx string in the inner sectors, but rather the absence on outer sectors.


----------



## smf (Mar 14, 2021)

socram8888 said:


> I've tried Spyro 3 and it didn't trigger the antipiracy. In fact, to my knowledge Spyro 3 doesn't check for the presence of the SCEx string in the inner sectors, but rather the absence on outer sectors.



Anti piracy is basically checking for dodgy rips (libcrypt) and checking that SCEx is not being generated by a mod chip all over the disc.


----------



## socram8888 (Mar 14, 2021)

I have just released v1.1 with the following changelog:

New supported games as entry points:
BASLUS-00571: Brunswick Circuit Pro Bowling (NTSC-US) (SLUS-00571)
BASLUS-00856: Brunswick Circuit Pro Bowling 2 (NTSC-US) (SLUS-00856)
BASLUS-01485TNHXG01: Tony Hawk's Pro Skater 4 (NTSC-US) (SLUS-01485)
BESLES-01376: Brunswick Circuit Pro Bowling (PAL-EU) (SLES-01376)
BESLES-02618: Brunswick Circuit Pro Bowling 2 (PAL-EU) (SLES-02618)
BESLES-02909TNHXG01: Tony Hawk's Pro Skater 2 (PAL-FR) (SLES-02909)
BESLES-02910TNHXG01: Tony Hawk's Pro Skater 2 (PAL-DE) (SLES-02910)
BESLES-03646TNHXG01: Tony Hawk's Pro Skater 3 (PAL-FR) (SLES-03646)
BESLES-03647TNHXG01: Tony Hawk's Pro Skater 3 (PAL-DE) (SLES-03647)
BESLES-03954TNHXG01: Tony Hawk's Pro Skater 4 (PAL-EU) (SLES-03954)
BESLES-03955TNHXG01: Tony Hawk's Pro Skater 4 (PAL-DE) (SLES-03955)
BESLES-03956TNHXG01: Tony Hawk's Pro Skater 4 (PAL-FR) (SLES-03956)

Restore kernel RAM contents. Fixes booting of Mad Panic Coaster (NTSC-JP) (SLPS-00880) and Formula 1 Championship Edition (NTSC-US) (SLUS-00546)
First stage will now display a red screen if it can't find the SPL, instead of crashing.
Available at https://github.com/socram8888/tonyhax/releases/tag/v1.1


----------



## limpbiz411 (Mar 14, 2021)

socram8888 said:


> I have just released v1.1 with the following changelog:
> 
> New supported games as entry points:
> BASLUS-00571: Brunswick Circuit Pro Bowling (NTSC-US) (SLUS-00571)
> ...


sweet, thank you.


----------



## caitsith2 (Mar 14, 2021)

What I like about this soft mod, is that any game that is exploitable can be made to load the tonyhax memory card payload and run it.


----------



## StrayGuitarist (Mar 15, 2021)

Woah, kickass. I've already got an I/O cheat device in mine that lets me play imports/backups, but I know some people who'd be very interested in this.. Now to find a copy of THPS2...


----------



## DarthMotzkus (Mar 15, 2021)

socram8888 said:


> I have just released v1.1 with the following changelog:
> 
> New supported games as entry points:
> BASLUS-00571: Brunswick Circuit Pro Bowling (NTSC-US) (SLUS-00571)
> ...



WOW! That's nice, congratulations for this awesome work! 
There will be more exploitable titles? Any spoiler about that? I really wish to any of my titles can do the trick. Unfortunately here in Brazil it's very rare to found original discs of psx, and import from ebay or else it's so much expensive due to the customs unbelievable tax tables. But i have some original copys, maybe they can be exploitable at some point. There's any standard at this hack you can point to us, so we can know which titles won't be exploitable ever? Or the possibilities is too big?


----------



## driverdis (Mar 15, 2021)

socram8888 said:


> I've tried Spyro 3 and it didn't trigger the antipiracy. In fact, to my knowledge Spyro 3 doesn't check for the presence of the SCEx string in the inner sectors, but rather the absence on outer sectors.


I was referring to patching the game if you play a backup copy. Spyro 3 should not trigger the console modified screen but should cause the lost gems,eggs and other anti-piracy measures to activate with a backup disc.

I do wonder if Spyro 3 on an original disc will fail the anti-piracy checks that are done while playing after the unlock commands are sent to the drive.

I put a push button modchip toggle on my scph-1001 to disable the modchip after booting and this is enough to pass the main antimod screen for Spyro 3 on both original and backup discs.


----------



## CeeDee (Mar 15, 2021)

This is cool as shit. But... question... why do you need a PS1 soft mod if Tony Hawk's Pro Skater is the only PS1 game you really need in your life?


----------



## KentaZX (Mar 15, 2021)

socram8888 said:


> I have just released v1.1 with the following changelog:
> 
> New supported games as entry points:
> BASLUS-00571: Brunswick Circuit Pro Bowling (NTSC-US) (SLUS-00571)
> ...


Damn you're fast! I've just tested Mad panic coaster again and I can confirm its working now. Thank you.


----------



## nl255 (Mar 15, 2021)

DarthMotzkus said:


> WOW! That's nice, congratulations for this awesome work!
> There will be more exploitable titles? Any spoiler about that? I really wish to any of my titles can do the trick. Unfortunately here in Brazil it's very rare to found original discs of psx, and import from ebay or else it's so much expensive due to the customs unbelievable tax tables. But i have some original copys, maybe they can be exploitable at some point. There's any standard at this hack you can point to us, so we can know which titles won't be exploitable ever? Or the possibilities is too big?



Essentially you need a game that allows text input by the user and saves said text to the memory card but does not check the length of said text when loading a saved game before putting it in a buffer, in other words it is a classic buffer overrun exploit.  There is a list of games that are known to be either not exploitable or unlikely to ever be exploitable on the main Tonyhax site at the "source" link.  Since the PS1 is an older system without any of the modern stuff intended to prevent such exploits (ASLR/NX/stack canaries/etc) I would suggest taking a look at the classic paper, "Smashing the Stack for Fun and Profit" if you want to know more on how to find such exploits.  Note that knowledge of assembly language is required to do so.


----------



## Lunar (Mar 15, 2021)

I wonder if it's possible to make an iso that writes the exploit to the card, making it so you would use the disk-swap method for the first boot and not have to worry about it again. I don't have a ps2 available and the only USB adapters I'm finding for the ps1 card are >70 USD. At that point you could just buy and hack a ps2 for less money.


----------



## socram8888 (Mar 15, 2021)

Lunar said:


> I wonder if it's possible to make an iso that writes the exploit to the card, making it so you would use the disk-swap method for the first boot and not have to worry about it again. I don't have a ps2 available and the only USB adapters I'm finding for the ps1 card are >70 USD. At that point you could just buy and hack a ps2 for less money.


It's indeed a possibility and shouldn't be too hard. I plan on doing that at some point but that'd be an entirely different project.


driverdis said:


> Spyro 3 should not trigger the console modified screen but should cause the lost gems,eggs and other anti-piracy measures to activate with a backup disc.


Yeah I know. Those lost gems etc are caused not by an anti-piracy measure but by an anti-crack check - ie if you modify the executable. Since the executable isn't modified, it is not triggered.

I've tried with both my original Spyro 3 and a copy of it and again, I can confirm Zoe doesn't complain about me using a pirated copy.


----------



## Acid_Snake (Mar 15, 2021)

socram8888 said:


> I have just released v1.1 with the following changelog:
> 
> New supported games as entry points:
> BASLUS-00571: Brunswick Circuit Pro Bowling (NTSC-US) (SLUS-00571)
> ...


You can probably also use Tekken 2 and 3 as well as Sports Superbike 2 (or XS Moto).
We used a buffer overflow in these games to escape the PS1 emulator on PSP/PS Vita.
Here's some writeups:
https://wololo.net/2015/09/16/playstation-20th-anniversary-psx-exploits-work/
https://wololo.net/2015/09/22/exploit-psx-games-psp-vita/

Edit: It might also be possible to exploit the memory card reader in the bios with a crafted icon, I remember being able to break the one on PSP (so the one on PS1 should be weak too).


----------



## HaloEffect17 (Mar 15, 2021)

So you have to load up Tony Hawk 2 each time then, right?

--------------------- MERGED ---------------------------



socram8888 said:


> tonyhax author here.
> 
> I've had some crazy ideas about maybe creating a custom SD to memory card adapter, since both SD cards and memory cards use standard SPI. It wouldn't be even necessary to open the console or touch anything inside, just an adapter much like on a GC.
> 
> For now I'm gonna focus on trying to port this exploit to other games.


Would be great to have Gran Turimo 2 added one day! I don't have the Hawks.


----------



## Urbanshadow (Mar 15, 2021)

Hi, I would like to know how does it behave with multidisc games. Can one backup load the next or the softmod should be reapplied every time? Thank you.


----------



## socram8888 (Mar 15, 2021)

v1.1.1 has been released: https://github.com/socram8888/tonyhax/releases/tag/v1.1.1

*Changes since v1.1*

The SPL file has been renamed from "TONYHAX-SPL" to "BESLEM99999-TONYHAX" so it follows the standard naming conventions.

Added MCS save files for easier usage on visual, desktop memory card editors.
The reason behind this small release is that an user on Reddit was having issues importing the SPL file on Dexdrive because of the non-standard name. Thus this release changes the name to stick to the standard format every other PS1 game used for game saves.

*This release otherwise doesn't change anything in the code. If v1.1 works well for you, there's no need to update - this version adds no new games nor improves compatibility.*



Acid_Snake said:


> You can probably also use Tekken 2 and 3 as well as Sports Superbike 2 (or XS Moto).
> We used a buffer overflow in these games to escape the PS1 emulator on PSP/PS Vita.
> Here's some writeups:
> https://wololo.net/2015/09/16/playstation-20th-anniversary-psx-exploits-work/
> ...


Will have a look for v1.2, thanks!



HaloEffect17 said:


> So you have to load up Tony Hawk 2 each time then, right?
> 
> Would be great to have Gran Turimo 2 added one day! I don't have the Hawks.


Yes, that is correct. THPSx have to be loaded each time. This is not a persistent hack.



Urbanshadow said:


> Hi, I would like to know how does it behave with multidisc games. Can one backup load the next or the softmod should be reapplied every time? Thank you.


You can load the next disc just fine mid-game without having to reboot the console.


----------



## mmz16x (Mar 15, 2021)

Is there any chance that we can load games on the memory card like the GC Gecko device as the recently made (Memcard Pro) via 8bitmods site allows upto 1TB sized Msd cards, or is the Memorycard BUS not fast enough for this? it would be a cool feature to make this maybe boot to the AR device then from there load to the (memcard Pro) device in tandom just theorizing here


----------



## Shardnax (Mar 15, 2021)

socram8888 said:


> v1.1.1 has been released: https://github.com/socram8888/tonyhax/releases/tag/v1.1.1
> 
> *Changes since v1.1*
> 
> ...


I'm unable to get the exploit to run with Brunswick Circuit Pro Bowling (US). I tested it on SCPH-1001 x2, SCPH-9001, and SCPH-101. It hangs on the load screen with the music still playing whenever I try to load the save. I don't have any other compatible games to test with at the moment.

Both versions ran without issue with a PS2.

Edit: I transferred the files from USB with uLaunch.


----------



## socram8888 (Mar 15, 2021)

Shardnax said:


> I'm unable to get the exploit to run with Brunswick Circuit Pro Bowling (US). I tested it on SCPH-1001 x2, SCPH-9001, and SCPH-101. It hangs on the load screen with the music still playing whenever I try to load the save. I don't have any other compatible games to test with at the moment.
> 
> Both versions ran without issue with a PS2.
> 
> Edit: I transferred the files from USB with uLaunch.


I've tried it on an emulator to rule out I had broken anything with the v1.1.1 and it's working fine here. Can you please try to remove the tonyhax SPL file and see if you get at least the red screen? That would indicate the first stage is working but it's failing when loading the SPL.


----------



## ShadowGeist (Mar 15, 2021)

Nice hack. It interests me, the creativity and problem solving associated with these types of exploits.

I assume one could build a disc image of Orion's save manager "PocketStation (Memory Card) Transfer Tool CD" for easy installation of .MCS files through swaptrick.  onorisoft.free.fr/psx/psloader.zip


----------



## driverdis (Mar 15, 2021)

socram8888 said:


> The SPL file has been renamed from "TONYHAX-SPL" to "BESLEM99999-TONYHAX" so it follows the standard naming conventions.
> 
> Added MCS save files for easier usage on visual, desktop memory card editors.


Great, now I can use a PC with the PS3 memory card adapter to add the save since it follows normal naming conventions


----------



## Zaphod77 (Mar 15, 2021)

There are multiple versions of the anti-mod check. the first anti-mod check simply tried to read the protection wobble without actually moving the laser to the proper spot. if this PASSED, the anti-mod check failed.  The auto disabling mod chip beat this one.

This unlock code shouldn't affect that. the check will fail like it should.

Later ones do TWO checks. one where they DON'T seek the protection area, and one where it does. this is the one that is likely to cause trouble with the exploit, and may need to be sharked past. This is the one the true stealth chip was made for, that reactivates when the drive is requested to do another protection check.

There is ALSO libcrypt, but that's not affected by this at all. A proper burn with subchannel data passes, and burns missing the data fail.


----------



## Shardnax (Mar 16, 2021)

socram8888 said:


> I've tried it on an emulator to rule out I had broken anything with the v1.1.1 and it's working fine here. Can you please try to remove the tonyhax SPL file and see if you get at least the red screen? That would indicate the first stage is working but it's failing when loading the SPL.


Same problem testing with the SCPH-101, it does red screen on the PS2.


----------



## blindseer (Mar 16, 2021)

Same issue with Brunswick pro. Bowling 2 on scph 101 freezes at load from memory card with music playing or sometimes a black screen, no red screen without the tonyhax file though.


----------



## Zaphod77 (Mar 16, 2021)

if anyone wants games to test, dance dance revolution 1st mix (jp) has the simple anti-mod check that you don't need to swap to beat, and 3rd mix has the more complicated check that normally requires swapping or a gameshark to beat unless you have a stealth chip.


----------



## mmz16x (Mar 16, 2021)

Is there any chance that we can load games on the memory card like the GC Gecko device as the recently made (Memcard Pro) via 8bitmods site allows upto 1TB sized Msd cards, or is the Memorycard BUS not fast enough for this? it would be a cool feature to make this maybe boot to the AR device then from there load to the (memcard Pro) device in tandom just theorizing here


----------



## elBenyo (Mar 16, 2021)

smf said:


> What's an endian security issue?
> 
> 
> 
> ...



When you are exploiting a buffer overflow and, for example, overwrite the return pointer to jump to a memory address that you control, you need to specify this address in the proper endian because the overflowing data begins at the lower end of that stack. Duh.


----------



## socram8888 (Mar 16, 2021)

Shardnax said:


> Same problem testing with the SCPH-101, it does red screen on the PS2.





blindseer said:


> Same issue with Brunswick pro. Bowling 2 on scph 101 freezes at load from memory card with music playing or sometimes a black screen, no red screen without the tonyhax file though.


Now that's odd. Those two exploits worked fine on an emulator, and my SCPH-102 also ran the Brunswick 2 PAL-E version exploit just fine. But you are right that the console chokes with the very same exploit on NTSC-U.

This is going to be hard to fix, since there's nothing I can do other than blindly run stuff on the console until it works, given no$psx works fine with the exploit.


----------



## Deleted User (Mar 16, 2021)

socram8888 said:


> Now that's odd. Those two exploits worked fine on an emulator, and my SCPH-102 also ran the Brunswick 2 PAL-E version exploit just fine. But you are right that the console chokes with the very same exploit on NTSC-U.
> 
> This is going to be hard to fix, since there's nothing I can do other than blindly run stuff on the console until it works, given no$psx works fine with the exploit.


Could the problem be they're running it on a ps2?


----------



## smf (Mar 16, 2021)

elBenyo said:


> When you are exploiting a buffer overflow and, for example, overwrite the return pointer to jump to a memory address that you control, you need to specify this address in the proper endian because the overflowing data begins at the lower end of that stack. Duh.



Well of course you need to store your addresses in the correct endian, but that doesn't explain why it's an "endian security issue" that you can "attack".

If you use the wrong endian in your exploit, then your exploit is broken. Using x86 opcodes instead of MIPS would also not work, but that doesn't make it a "cpu security issue".


----------



## socram8888 (Mar 16, 2021)

StarGazerTom said:


> Could the problem be they're running it on a ps2?


I don't think so, they said it worked fine on a PS2, but failed on a PS1.

The interesting bit is that the buffer allocated for the memory card is a static one. This means it's a fixed address, not something that will vary from between consoles as a dynamically allocated one could do between BIOS revisions. Yet still it's failing to work on a real machine. Hm.


----------



## DarthMotzkus (Mar 16, 2021)

socram8888 said:


> I don't think so, they said it worked fine on a PS2, but failed on a PS1.
> 
> The interesting bit is that the buffer allocated for the memory card is a static one. This means it's a fixed address, not something that will vary from between consoles as a dynamically allocated one could do between BIOS revisions. Yet still it's failing to work on a real machine. Hm.
> View attachment 252173


I'm wating for my copy of Brunswick Circuit Pro Bowling 2 to arrive and gonna test it on my PSOne. Meanwhile i can test it on my other modded Fat PS1 with a backup. Do you think the modchip will confuse the process or it's fine?


----------



## socram8888 (Mar 16, 2021)

DarthMotzkus said:


> I'm wating for my copy of Brunswick Circuit Pro Bowling 2 to arrive and gonna test it on my PSOne. Meanwhile i can test it on my other modded Fat PS1 with a backup. Do you think the modchip will confuse the process or it's fine?


It should be fine. If you are gonna try on your console with Brunswick, I'll send you on PM a custom testing version that should fix the issue other users were having.


----------



## smf (Mar 16, 2021)

mmz16x said:


> Is there any chance that we can load games on the memory card like the GC Gecko device as the recently made (Memcard Pro) via 8bitmods site allows upto 1TB sized Msd cards



AFAIK memcard pro just gives you lots if 128k (ps1 memcard) sized slots, you would need something that gives direct access to the sd card and if you're unlucky that might prevent you using a controller in the same socket. You can run the port quite fast, but the cpu might struggle keeping up. Especially if the game is running other code while loading. 

You also wouldn't have streaming audio. You need something like psio to do that, it would be nice if there was a raspberry pi based optical disc emulator.


----------



## Lv44ES_Burner (Mar 16, 2021)

Socram, you're an amazing fellow. Mad props to you for figuring out how to leverage exploits like this to allow for loading backups, man. Hope your work on the project to produce a memory card adapter comes to a success as well, 'cause I'd definitely snap one up in a heartbeat!


----------



## XDel (Mar 16, 2021)

Meanwhile the old crappy Classic is about to be able to pull off HD!!!


----------



## socram8888 (Mar 16, 2021)

Thanks to @DarthMotzkus and @Shardnax for the debugging on their machines, I have just released v1.1.2. If you were trying to use Brunswick Pro Circuit 2 NTSC-U and couldn't get it to work, this release is for you.

*Changes since v1.1.1*

Fixed Brunswick Pro Circuit 2 (NTSC-U) (SLUS-00571) entry point, which was causing the SPL to fail loading.
Loading steps in the entry points are now color coded for easier debugging:
Purple (Brunswick only) indicates the memory cards are being reinitialized.
Blue indicates the SPL is being read from the memory card into memory.
Green indicates that the SPL is about to launch. This shouldn flash very very briefly.
Red indicates the SPL couldn't be found or loaded.
The console should spend no more than a couple seconds with each color. If it spends more time, it's probably crashed. Please report it.
Added an integrity. Shall the SPL load in a corrupted state into the main memory (for instance, if the memory card is damaged, the file is corrupted, or some other process caused the load process to fail), it'll now report so during the boot on the screen.
The SPL will now report your system BIOS. If you are experiencing any issue, please remember to tell me the BIOS version.
Essentially this version has just been released to fix the Brunswick 2 bug, which was causing me a serious headache as the payload was booting just fine on the emulator, but failing on real hardware during the phase in which the SPL was loading into main memory, with all the previous steps (card initialization, file open...) executing just fine.

The FileRead call was executing instantaneously, as if it wasn't reading anything, despite me explicitelly checking the return value. Instead of getting to the red screen of dead, it was just turning black, something I don't have implemented anywhere on the code.

After adding all those logging features, it turned out that the issue was simply that the save file had a wrong address, and it was causing the stack pointer to never get reinitialized. FileRead apparently has enough nested functions to cause the call stack to grow larger than what the fast RAM - where Brunswick helds the stack - could hold and it just crashed into a black screen.

*Just like v1.1.1, this is just a bugfix release - if previous versions were working fine for you and you don't mind missing the cool seizure-inducing loading screens, just skip it.

Available at https://github.com/socram8888/tonyhax/releases/tag/v1.1.2*


----------



## driverdis (Mar 17, 2021)

PS2 SCPH-39001 Date Code 2C works
BIOS Version V5.0 02/07/02 A

my other 2 PS2 Slims (SCPH-77001) don’t work and my 3 fat SCPH-50001 systems don’t work either.

seems some earlier US NTSC models used the American firmware rather than the Japanese firmware and support the unlock command.

I did test an SCPH-70012 but it had a loose ribbon cable and literally put a circle ring on THPS 3 and ruined it so I have another from eBay on the way.

good thing I picked up Brunswick Bowling 1 and 2 as I had to test other systems with that after the incident

I find it interesting that newer consoles that can work with with the PSXLoader homebrew are the ones that don’t work with this hack since the drives are a different region.

I did try some AntiMod games including the notorious Spyro 3 NTSC and booting a real disc on a same region console via this exploit works and does not throw the console modified error. This is good as I was not sure if the unlock commands issued would mess with games checking for the license string.

 I do not have a PAL or NTSC-J system to check if a legit Spyro 3 game will pass it’s check on a different region system but it should since the drive will still report the SCEA string each time it checks since the disc is legit.

booting a clean copy however will throw a hardware modified message which does not happen with stealth modchips since the modchips will inject the string each time the game requests it.


----------



## Deleted User (Mar 17, 2021)

playstays_shun said:


> I also think ps1 has got to be the most popular mod chipped console of all time. its like a coin flip a used ps1 you buy will already have one installed


If you live in Latin America it's guaranteed to have a modchip kek


----------



## blindseer (Mar 17, 2021)

driverdis said:


> PS2 SCPH-39001 Date Code 2C works
> BIOS Version V5.0 02/07/02 A
> 
> my other 2 PS2 Slims (SCPH-77001) don’t work and my 3 fat SCPH-50001 systems don’t work either.
> ...


Well I'll be, it does work on the SCPH 39001 with a date code of 3B also...


----------



## caitsith2 (Mar 17, 2021)

It is kind of a miracle that no developer thought to randomly decide which part of the disc it was reading for checking the protection, in order to defeat the true-stealth chips. You have to be right 100% of the time to remain stealth.  the random check only has to ever see the chip get it wrong just once.


----------



## DarthMotzkus (Mar 17, 2021)

socram8888 said:


> Thanks to @DarthMotzkus and @Shardnax for the debugging on their machines, I have just released v1.1.2. If you were trying to use Brunswick Pro Circuit 2 NTSC-U and couldn't get it to work, this release is for you.



Anytime man, happy to help, glad it works now. 
Thank you for your time and efforts. This is an amazing exploit, i'll put in very good use.


----------



## smf (Mar 17, 2021)

caitsith2 said:


> It is kind of a miracle that no developer thought to randomly decide which part of the disc it was reading for checking the protection, in order to defeat the true-stealth chips.



You've got a deadline to get the game out, anything random you do is going to be a risk during QA and anyone running the game on an emulator can see exactly what your code is doing.

Some people will buy the game regardless, some people will wait for the crack regardless.


----------



## Acid_Snake (Mar 17, 2021)

socram8888 said:


> Thanks to @DarthMotzkus and @Shardnax for the debugging on their machines, I have just released v1.1.2. If you were trying to use Brunswick Pro Circuit 2 NTSC-U and couldn't get it to work, this release is for you.
> 
> *Changes since v1.1.1*
> 
> ...


Hey if you need any development hand let me know. i'm gonna try to recreat the buffer overflow on the PSP's memory card manager, hopefully we can also trigger it on the real console.


----------



## a32bitmint (Mar 17, 2021)

I finally have an excuse to get a Tony Hawk game! lol
I don't have a PS1 (I do have a PS2 though) and I wanna get more import titles but I don't wanna modchip my console because it's hard and I have no soldering experience or skill. This should be great if it works well on a PS2.


----------



## elBenyo (Mar 17, 2021)

smf said:


> Well of course you need to store your addresses in the correct endian, but that doesn't explain why it's an "endian security issue" that you can "attack".
> 
> If you use the wrong endian in your exploit, then your exploit is broken. Using x86 opcodes instead of MIPS would also not work, but that doesn't make it a "cpu security issue".



Have you ever heard of buffer overflow prevention techniques? For example RELRO, NoExecute, Stack Canaries, Address Space Layout Randomization, or Position Independent Executables? Learn to ROP and then you might understand


----------



## smf (Mar 18, 2021)

elBenyo said:


> Have you ever heard of buffer overflow prevention techniques? For example RELRO, NoExecute, Stack Canaries, Address Space Layout Randomization, or Position Independent Executables? Learn to ROP and then you might understand



Yes, I have heard of those. I haven't heard of "endian security issues" that you can "attack".

I'm not sure how RELNO, NoExecute & ASLR are relevant to PS1 & I'm not sure ROP would be my first choice on a platform where everything runs in kernel mode & has rwx access to all of ram.


----------



## elBenyo (Mar 18, 2021)

smf said:


> Yes, I have heard of those. I haven't heard of "endian security issues" that you can "attack".
> 
> I'm not sure how RELNO, NoExecute & ASLR are relevant to PS1 & I'm not sure ROP would be my first choice on a platform where everything runs in kernel mode & has rwx access to all of ram.


I was looking to jump out of the CD player program with a kernal panic exploit using rough ROP to run his exploit, leading to a burned game only needing a hacked track 1. I won't even try if you want to explain it any further, go troll in another thread.


----------



## limpbiz411 (Mar 19, 2021)

this works great in my playstation 2 as well


----------



## DarthMotzkus (Mar 19, 2021)

limpbiz411 said:


> this works great in my playstation 2 as well


Wich model is yours?


----------



## limpbiz411 (Mar 19, 2021)

DarthMotzkus said:


> Wich model is yours?


scph-39001


----------



## driverdis (Mar 19, 2021)

limpbiz411 said:


> scph-39001


3900X must be the cutoff for systems. Other people including me have reported success on 3900X and 3000X consoles meanwhile 5000X and newer consoles are using the Japanese drive controller and don’t work.

what I really like about this exploit is that it is the first method to load backups without a modchip,slide tool, or flip top on PS2 3900X and lower since you can eject the tray normally.


----------



## NeonBlack79 (Mar 19, 2021)

Just to be absolutely sure, does this method work for import games, bypassing the region lock, or it's only for backups?


----------



## driverdis (Mar 19, 2021)

NeonBlack79 said:


> Just to be absolutely sure, does this method work for import games, bypassing the region lock, or it's only for backups?



works fine for imports. Be aware that you will have NTSC->PAL and PAL->NTSC conversion issues with this method as the console will output what the game wants and a PS1 by default is missing components to generate proper signals for out of region color standards. You can use RGB scart cables to get around this but the game will still be out of sync by around 1% speed wise.

I ended up playing original imports on a PS2 using component cables with gsm mode switcher to output a proper signal for PS1 games.


----------



## DaisyAge12 (Mar 19, 2021)

I have tried playing an NTSC-J copy of Gunner's Heaven (Rapid Reload in EU) and it always comes up with an error. American Spyro and EU Rapid Reload work (Rapid Reload is in black and white) Am I doing something wrong or is this game unplayable? Are all NTSC-J games unplayable?


----------



## limpbiz411 (Mar 19, 2021)

driverdis said:


> works fine for imports. Be aware that you will have NTSC->PAL and PAL->NTSC conversion issues with this method as the console will output what the game wants and a PS1 by default is missing components to generate proper signals for out of region color standards. You can use RGB scart cables to get around this but the game will still be out of sync by around 1% speed wise.
> 
> I ended up playing original imports on a PS2 using component cables with gsm mode switcher to output a proper signal for PS1 games.


playstation games are looking amazing through my ps2 with component cables on my trinitron wega 32" crt


----------



## driverdis (Mar 20, 2021)

socram8888 said:


> It's indeed a possibility and shouldn't be too hard. I plan on doing that at some point but that'd be an entirely different project.
> 
> Yeah I know. Those lost gems etc are caused not by an anti-piracy measure but by an anti-crack check - ie if you modify the executable. Since the executable isn't modified, it is not triggered.
> 
> I've tried with both my original Spyro 3 and a copy of it and again, I can confirm Zoe doesn't complain about me using a pirated copy.



does your copy throw the antimod screen. My clean copy of Spyro 3 1.1 NTSC throws the antimod screen since it can’t read the license string on the main menu.


----------



## Shardnax (Mar 20, 2021)

DaisyAge12 said:


> I have tried playing an NTSC-J copy of Gunner's Heaven (Rapid Reload in EU) and it always comes up with an error. American Spyro and EU Rapid Reload work (Rapid Reload is in black and white) Am I doing something wrong or is this game unplayable? Are all NTSC-J games unplayable?


I can't say if all games work but the random Japanese game I tested did.


----------



## DaisyAge12 (Mar 20, 2021)

Shardnax said:


> I can't say if all games work but the random Japanese game I tested did.


So I read in a reddit post from OP that as long as the game has the SYSTEM.CNF file it should work, this game doesn't have that format. I'm wondering that's why this game won't work. Is there a way to create a dummy SYSTEM.CNF file for the purpose of loading the game?
EDIT: I managed to create a CNF file for the game and it loaded it in tonyhax but since it doesn't point to the correct sectors it doesn't load the game. So in theory it might be possible to patch games without the CNF file if someone can figure out where the CNF needs to point to in the game data


----------



## socram8888 (Mar 20, 2021)

Well I'm glad to announce I've just released v1.2. This is a pretty important milestone I think since it contains a couple of really popular games that were in the top ten sold games for the PS1.

*Changes since v1.1.2*

Add new games as entry points:
Castrol Honda Superbike Racing (NTSC-U) (SLUS-00882)
Castrol Honda Superbike Racing (PAL-E) (SLES-01182)
Castrol Honda VTR (PAL-E) (SLES-02942)
Cool Boarders 4 (NTSC-U) (SCUS-94559)
*Crash Bandicoot 2: Cortex Strikes Back (NTSC-U) (SCUS-94154)*
*Crash Bandicoot 2: Cortex Strikes Back (PAL-E) (SCES-00967)*
*Crash Bandicoot 3: Warped (NTSC-U) (SCUS-94244)*
*Crash Bandicoot 3: Warped (PAL-E) (SCES-01420)*
Sports Superbike (PAL-E) (SLES-03057)
Sports Superbike 2 (PAL-E) (SLES-03827)
XS Moto (NTSC-U) (SLUS-01506)
XS Moto (PAL-E) (SLES-04095)

Added support for European NetYaroze consoles.
One would expect first party games like Crash Bandicoot would be better programmed. Apparently, no.



driverdis said:


> does your copy throw the antimod screen. My clean copy of Spyro 3 1.1 NTSC throws the antimod screen since it can’t read the license string on the main menu.


It does not on mine, but apparently PAL version doesn't check for it either.


----------



## Zurdonx (Mar 20, 2021)

socram8888 said:


> One would expect first party games like Crash Bandicoot would be better programmed. Apparently, no.


Nice (and shocking) to see that Crash Bandicoot 2 and 3 are supported!

Out of curiosity, are all Crash Bandicoot games exploitable? Or just these two?


----------



## socram8888 (Mar 20, 2021)

Zurdonx said:


> Nice (and shocking) to see that Crash Bandicoot 2 and 3 are supported!
> 
> Out of curiosity, are all Crash Bandicoot games exploitable? Or just these two?


Those two are the only two I've looked at, so we have a 100% success rate so far haha


----------



## Flame (Mar 20, 2021)

this is amazing stuff.  

now makes you think with this softmod would it possible to create a memory card with microsd fuction which will be able to play games off that?

sort of like a Vita2sd for the vita or SD2SP2 for the Gamecube.


----------



## DaisyAge12 (Mar 20, 2021)

Socram8888 will there be a way later to support games that don't have SYSTEM.CNF files? I don't know how many games out there are built without it but I am curious.


----------



## socram8888 (Mar 20, 2021)

DaisyAge12 said:


> Socram8888 will there be a way later to support games that don't have SYSTEM.CNF files? I don't know how many games out there are built without it but I am curious.


Are there any really? I've never seen one like it. In fact I assumed all had a SYSTEM.CNF file.


Flame said:


> this is amazing stuff.
> 
> now makes you think with this softmod would it possible to create a memory card with microsd fuction which will be able to play games off that?
> 
> sort of like a Vita2sd for the vita or SD2SP2 for the Gamecube.


Yes and no. That would require coming with a generic way of redirecting BIOS calls, so it reads from a SD instead of a CD-ROM. It's not impossible, but many games that directly access the CD drive controller (for instance, every game that has audio CD tracks, a functionality the BIOS doesn't expose) would be impossible to use unless patched on a case-by-case basis, which is pretty complex.


----------



## DaisyAge12 (Mar 20, 2021)

socram8888 said:


> Are there any really? I've never seen one like it. In fact I assumed all had a SYSTEM.CNF file.


The only game I can confirm doesn't have the CNF file is Gunners Heaven/Rapid Reload. I found a tool to create a CNF for a game and it will load in tonyhax however I do not know what parameters are needed to get the game to boot


----------



## Deleted member 323844 (Mar 20, 2021)

Wipeout 3 Special Edition could be worth checking. It has a somewhat complex entry name screen. On the other hand, it was a first-party title, so idk.



Flame said:


> this is amazing stuff.
> 
> now makes you think with this softmod would it possible to create a memory card with microsd fuction which will be able to play games off that?
> 
> sort of like a Vita2sd for the vita or SD2SP2 for the Gamecube.


According to Takeshi (trisaster.de), developer of SIO2SD/MX4SIO, MX4SIO should work on PS1, but it lacks the software. There's a big difference in speed tho.

PS2: 24 MHz (in practice ~1.1 MB/s)
PS1: 250 kHz (in practice ???)


----------



## DaisyAge12 (Mar 20, 2021)

Ive made some progress. So far I can boot into the game but after the initial screen it hangs. I created a CNF file with PSX2CNFCreator_1.4.0 with the default parameters found here: How do I make a SYSTEM.CNF file? - PlayStation Development Network (psxdev.net)
Now I've looked at the EU release which does have a CNF and I'm trying to use some of the parameters in this file in my makeshift one. Hoping to get this figured out soon as I'm running low on CD-R's.
Edit: This one booted but quits at the same point. Right after the intro screen.


----------



## driverdis (Mar 20, 2021)

I noticed that the demo disc that comes with Spyro the Dragon PAL (Winter Releases ‘98) won’t load any of the demos once it hits the main menu. I wonder if it has to do with loading new executables after the drive is unlocked as the disc works fine using a chipped system or scph-5000x PS2 using LaunchElf or PSXLoader disc swapping but will black screen and not load the demo game it is supposed to when ran via TonyHax.

I will be able to test if the NoCash unlock is to blame once my Unirom cart arrives as it too can unlock the drive using the NoCash commands.

I will be checking a 3 in 1Crash compilation I have burned to see if it fails as well since it loads other games from it’s menu.


----------



## socram8888 (Mar 20, 2021)

DaisyAge12 said:


> The only game I can confirm doesn't have the CNF file is Gunners Heaven/Rapid Reload. I found a tool to create a CNF for a game and it will load in tonyhax however I do not know what parameters are needed to get the game to boot


Will be supported in the next version: https://github.com/socram8888/tonyhax/commit/a2b4e194714bd69ebf2125b4d9cb7303dab793b9


----------



## Shardnax (Mar 20, 2021)

socram8888 said:


> Will be supported in the next version: https://github.com/socram8888/tonyhax/commit/a2b4e194714bd69ebf2125b4d9cb7303dab793b9


Nice to hear, you're making excellent progress with this.


----------



## Naxil81 (Mar 20, 2021)

We can now make ps1 homebrew? Like nes emu in 1 cd? Emu + our dumped roms in 1cd?


----------



## DaisyAge12 (Mar 20, 2021)

socram8888 said:


> Will be supported in the next version: https://github.com/socram8888/tonyhax/commit/a2b4e194714bd69ebf2125b4d9cb7303dab793b9


Amazing, truly great work you've done


----------



## driverdis (Mar 21, 2021)

socram8888 said:


> Will be supported in the next version: https://github.com/socram8888/tonyhax/commit/a2b4e194714bd69ebf2125b4d9cb7303dab793b9


Nice to hear, this also opens up the door for playing some alpha and beta games that only use psx.exe as well.


----------



## smf (Mar 21, 2021)

elBenyo said:


> I was looking to jump out of the CD player program with a kernal panic exploit using rough ROP to run his exploit, leading to a burned game only needing a hacked track 1. I won't even try if you want to explain it any further, go troll in another thread.



I'm not trolling, I just wanted to know what an "endian security issue" was.

The cd player just tells the drive what audio to stream. So good luck getting that to throw an exception.

--------------------- MERGED ---------------------------



driverdis said:


> works fine for imports. Be aware that you will have NTSC->PAL and PAL->NTSC conversion issues with this method as the console will output what the game wants and a PS1 by default is missing components to generate proper signals for out of region color standards. You can use RGB scart cables to get around this but the game will still be out of sync by around 1% speed wise.



The psx gpu can take inputs from two clocks, one for pal and one for ntsc. As the gpu starts up in ntsc, they tend to feed the pal clock to it and you get timing issues with some games. ntsc consoles have no need for a pal clock, so they don't always connect it & switching to pal mode loses video output entirely.

The black yaroze/world consoles have both ntsc & pal clocks fitted & will have the correct speed.

Some consoles switch the color burst when changing modes and will produce black and white on composite as your tv probably only handles one and some stick to the original region and are fine in composite. RGB is better though anyway.


----------



## segashack (Mar 22, 2021)

Anyone have advice for burning backups of your ISOs?

I have a bluray burner and tried all sorts of speeds with no luck. I'm using Verbatim Discs. Am I better off getting a new disc burner?

Games crash when loading fmvs or music will stop in game.

Some games stop at "loading executable" on the Tonyhax screen.

edit: My blank discs are probably 15+ years old, ordered the "Verbatim Data Life Plus" just now based on reddit posts I saw and will let people know how those go.


----------



## Leon11 (Mar 22, 2021)

Verbatim are the best. You better find a simple old DVD burner and burn at lowest speed. Use CloneCD or Imgburn to burn. The problem with PS1 ISO is that are not ISO, usually are in cue and bin format but sometimes in mdf and mds or img ccd sub, depending of the program used to rip the game. Many games are multitrack, some have libcrypt so you have to patch the ISO just to be sure. If you have a multitrack game you need to convert to one bin and one cue. Usually i do this: mount the multiple track image with Daemon Tools and convert the image with CloneCD, then mount the converted image to Dameon Tools and burn with CloneCD with specified settings.


----------



## socram8888 (Mar 22, 2021)

New v1.2.1, solving the issues with at least three games: https://github.com/socram8888/tonyhax/releases/tag/v1.2.1

*Changes since v1.2*

Support games lacking a SYSTEM.CNF file. Fixes Gunners Heaven (NTSC-J) (SCPS-10006) not booting.
Support games with a SYSTEM.CNF lacking certain configuration entries. Fixes Tekken 3 (NTSC-U) (SLUS-00402) not booting.
Clear some registers for bugged games. Fixes Pepsiman (NTSC-J) (SLPS-01762) not booting.


----------



## Cake4all (Mar 22, 2021)

Can confirm Tekken 3 is working now, I've been getting an error with Crash Bash (SCES-02834) though. Message is "Loading Failed"


----------



## socram8888 (Mar 22, 2021)

Cake4all said:


> Can confirm Tekken 3 is working now, I've been getting an error with Crash Bash (SCES-02834) though. Message is "Loading Failed"


Could you please share an screenshot copy the text on screen? That error message means the main executable couldn't get loaded, and one reason could be the SYSTEM.CNF isn't getting properly parsed.


----------



## DarthMotzkus (Mar 22, 2021)

socram8888 said:


> New v1.2.1, solving the issues with at least three games: https://github.com/socram8888/tonyhax/releases/tag/v1.2.1
> 
> *Changes since v1.2*
> 
> ...


When a new version is launched, do i need to re-copy the saves from games or just the Tonyhax exploit save?


----------



## segashack (Mar 22, 2021)

Leon11 said:


> Verbatim are the best. You better find a simple old DVD burner and burn at lowest speed. Use CloneCD or Imgburn to burn. The problem with PS1 ISO is that are not ISO, usually are in cue and bin format but sometimes in mdf and mds or img ccd sub, depending of the program used to rip the game. Many games are multitrack, some have libcrypt so you have to patch the ISO just to be sure. If you have a multitrack game you need to convert to one bin and one cue. Usually i do this: mount the multiple track image with Daemon Tools and convert the image with CloneCD, then mount the converted image to Dameon Tools and burn with CloneCD with specified settings.


Thanks so much for the information! I really appreciate it. I do have an old PC with an IDE DVD burner that I used in the dreamcast days, maybe I should try that one.


----------



## Cake4all (Mar 22, 2021)

socram8888 said:


> Could you please share an screenshot copy the text on screen? That error message means the main executable couldn't get loaded, and one reason could be the SYSTEM.CNF isn't getting properly parsed.


I was using 1.1.1 previously with the same issue


----------



## rmorris003 (Mar 22, 2021)

So they found a swap magic trick for the PS1. I see this as no different since you have to load it every time you power on.


----------



## socram8888 (Mar 22, 2021)

DarthMotzkus said:


> When a new version is launched, do i need to re-copy the saves from games or just the Tonyhax exploit save?


From now on, the first stage should be stable enough not to need any upgrades, so the tonyhax SPL (tonyhax.mcs/SLEM-99999TONYHAX) only.

I've made no changes to them since 1.1.2


----------



## Baraksha1 (Mar 23, 2021)

So, I do not have any of the games currently supported. so I decided to attempt understanding how this thing works myself and see if I can modify a save file for one of the games I actually own. that didn't work well since I honestly don't know what im doing so I think my best option is to put my best recomandation for a candidate and hope s0cram8888 could maybe  add support to it.

the game in question that I own is Beyblade by Sunsoft, its the only game I have that I know allows you to write down your name on the save file which from my understanding seem to be a necesasity for this to work. I also test it out and you can edit the save file to have more characters then what is displayed on the save profile, not sure if that means much tho. hopefuly you can figure it out.


----------



## driverdis (Mar 24, 2021)

rmorris003 said:


> So they found a swap magic trick for the PS1. I see this as no different since you have to load it every time you power on.


This is different than swap magic since the drive stays unlocked to read backup discs even after opening the tray.

In fact i used this on an SCPH-39001 PS2 and was able to skip the AntiMod protection on Spyro 3 NTSC via ejecting the game normally before the main menu and using my original disc to get to the load save menu. After I get to the save screen, I eject the game normally and load into Spyro just fine.

without this mod, you would need a flip top cover mod and hot swap the discs while the drive is running.

Basically I am using the original 1.0 disc to pass the AntiMod when it looks for the wobble then swapping back to my copy. Since the game is not modified, it should not trigger the AntiCrack protection although I have not played enough yet to find out.

why would I do this?
I have the original 1.0 Spyro 3 with the reused music tracks and other bugs and a burned copy of version 1.1 that has unique music tracks and bug fixes.

Problem is that Paradox and other groups did not bother to crack 1.1 so there is no way to burn a 100% functional version without a stealth modchip until now. If I am wrong about this, someone please tell me as I would love to not need to do this when I want to play.


----------



## halfpricebuttes (Mar 24, 2021)

driverdis said:


> This is different than swap magic since the drive stays unlocked to read backup discs even after opening the tray.
> 
> [snip]
> 
> Problem is that Paradox and other groups did not bother to crack 1.1 so there is no way to burn a 100% functional version without a stealth modchip until now. If I am wrong about this, someone please tell me as I would love to not need to do this when I want to play.



If I'm understanding this correctly you shouldn't need to swap. Very few PS1 games actually seeked back to sector 4 to check to see if the wobble was still present there, instead preferring to check for a lack of wobble on later sectors to defeat cheaper modchips. By the time stealth modchips came out developers were more interested in binary protection mechanisms like libcrypt than repeated wobble checks.

If you burn a proper CloneCD copy of the game with the bad Q subchannel data libcrypt uses intact you shouldn't need to swap.


----------



## driverdis (Mar 24, 2021)

halfpricebuttes said:


> If I'm understanding this correctly you shouldn't need to swap. Very few PS1 games actually seeked back to sector 4 to check to see if the wobble was still present there, instead preferring to check for a lack of wobble on later sectors to defeat cheaper modchips. By the time stealth modchips came out developers were more interested in binary protection mechanisms like libcrypt than repeated wobble checks.
> 
> If you burn a proper CloneCD copy of the game with the bad Q subchannel data libcrypt uses intact you shouldn't need to swap.



I will try that later as I have an original Spyro 3 1.1 disc arriving in the mail soon I will rip properly and test.

the 1.1 copy I have boots on my stealth PS1 and fails on my two older non stealth systems so I assumed the game data was fine.

from what I have read the NTSC versions don’t need sub channel data to work.


----------



## shock44 (Mar 24, 2021)

Hi, I'm having an issue trying out this exploit. I have a FAT PS2 with the model number SCPH-30001. I copied over the RAW save game file for Crash Bandicoot 3: Warped. I popped in my copy of the game and I loaded up the tonyhax save file and I get a red screen. I tried waiting for a while but nothing happens. Can anybody help me with this?


----------



## Baraksha1 (Mar 24, 2021)

shock44 said:


> Hi, I'm having an issue trying out this exploit. I have a FAT PS2 with the model number SCPH-30001. I copied over the RAW save game file for Crash Bandicoot 3: Warped. I popped in my copy of the game and I loaded up the tonyhax save file and I get a red screen. I tried waiting for a while but nothing happens. Can anybody help me with this?


you most likely forgot to also include the TonyHax SPL save file. look for "tonyhax.mcs" and add it to your memory card


----------



## socram8888 (Mar 24, 2021)

From v1.2.2, tonyhax will support patching some games with anti-modchip checks. So far Tomba 2 (US) and YuGiOh Forbidden Memories (US and SP) are both supported.

If you know any game that has the black screen of death please let me know.


----------



## segashack (Mar 24, 2021)

segashack said:


> Thanks so much for the information! I really appreciate it. I do have an old PC with an IDE DVD burner that I used in the dreamcast days, maybe I should try that one.


I tried my old IDE drive with a USB adapter on 1x. 

Everything got stuck on "loading executable". Tried Jedi Power Battles, Klonoa, and Fighting Force. Have new discs showing up soon so will try those next.


----------



## SideFFect (Mar 24, 2021)

Just a quick heads up, after the latest 1.2.1 version, Einhander now works!
Before this, it made it until the "Wait...." text appeared, and then froze there


----------



## RandomGamerRiven (Mar 24, 2021)

Thanks to socram8888 this is a real game changer being able to bypass the region lock on PS1 using a PS1 and PS2 console. Fantasic work, really well done.

If possible adding an option to force games into 50Hz or 60Hz regardless of the region of the title that would be great.

Tested on a PAL base model 39003 and works without issue. On my PAL modded with a matrix infinity slim 77003, it said unsupported region Japan with the mod turned off and didn't go any further. On PS2 one YouTuber found out that if you use it with a program called PS1VModeNeg you can force the game into NTSC or PAL video mode. Which is great for unoptimised PAL games that only run at 50Hz

As I can't post a link yet having just signed up here, name of the video where he uses both programs to work together is "Tonyhax - How to enable 50/60hz video modes?" on YouTube.

Sadly I couldn't get it to work for me with the latest version of PS1VModeNeg v1.10 on my PS2, so might need to try an earlier version.

Also tested on a unmodded PAL slim PS1, only given, Wild Arms 2 NTSC/U, Mega Man X5 NTSC/U and Gamera 2000 NTSC/J, but all worked and were all put into 60Hz on a unmodded PAL unit. All were original retail discs.

I run a gaming blog and YouTube channel known as Randomised Gaming, happy to help test the NTSC retail games I have to see which do and don't work. Which games also go into 60Hz and which don't.

I managed to get the homebrew software ImportPlayer Light v2.1 to boot as well, this can be used to force games into 60Hz, but hasn't been updated since 2001 and the forcing on it is rather poor many games are also misaligned on screen badly. If a game crashes via Tonyhax at the moment, might want to try booting ImportPlayer Light v2.1 and then booting the game that might work as a short term fix. Until socram8888 can address the issue.

Great work again socram8888.


----------



## DarthMotzkus (Mar 24, 2021)

segashack said:


> I tried my old IDE drive with a USB adapter on 1x.
> 
> Everything got stuck on "loading executable". Tried Jedi Power Battles, Klonoa, and Fighting Force. Have new discs showing up soon so will try those next.


Apparently it's your ps1 cd driver, it's not reading backups porperly, since you're using good media and proper burning method. You can search about calibrate your driver, and see if anything changes. The "Loading executable" has nothing about the exploit, it's trying to read the .exe of the game in the backup disc.


----------



## driverdis (Mar 24, 2021)

socram8888 said:


> From v1.2.2, tonyhax will support patching some games with anti-modchip checks. So far Tomba 2 (US) and YuGiOh Forbidden Memories (US and SP) are both supported.
> 
> If you know any game that has the black screen of death please let me know.


Spyro 3 1.0 and 1.1 NTSC has this


----------



## Leon11 (Mar 24, 2021)

The Legend of Dragoon has anti-modchip protection, PAL version for sure.


----------



## socram8888 (Mar 24, 2021)

driverdis said:


> Spyro 3 1.0 and 1.1 NTSC has this


The Spyro 3 can of worms is one I don't want to open and probably can't fix. That game has multiple executable files and I can only patch the first one that boots.


Leon11 said:


> The Legend of Dragoon has anti-modchip protection, PAL version for sure.


Will have a look at this one. What happens when it is triggered? Do you get that very same screen? I'm asking because I can't emulate that, so I generally have to reverse engineer it, blindly patch it without testing and praying it works.


----------



## Leon11 (Mar 24, 2021)

socram8888 said:


> The Spyro 3 can of worms is one I don't want to open and probably can't fix. That game has multiple executable files and I can only patch the first one that boots.
> 
> Will have a look at this one. What happens when it is triggered? Do you get that very same screen? I'm asking because I can't emulate that, so I generally have to reverse engineer it, blindly patch it without testing and praying it works.



I'm sorry, i don't know because i played with a stealth modchip at the time so the screen wasn't triggered, but i know that it has an anti-modchip check for sure. I found an old reddit topic that confirms that: https://www.reddit.com/r/retrogaming/comments/5zvupu/legend_of_dragoon_wont_run_on_my_ps1/


----------



## shock44 (Mar 24, 2021)

Baraksha1 said:


> you most likely forgot to also include the TonyHax SPL save file. look for "tonyhax.mcs" and add it to your memory card


Alright I had to copy over the RAW file of TonyHax actually since I'm using the FreeMcBoot method. Thanks for the help. However, now I'm having another problem. I'm happy the burnt game works, but when I get into a battle there is NO music playing. I read this has to do with CDDA and the only way to get it working would be to swap using a game that has the same amount of tracks as the game you want to play. I'm trying to play Tekken 3. Is there a certain game I could use to get the music tracks to play for this swap exploit?


----------



## shock44 (Mar 24, 2021)

Okay so now the music is playing during a battle somehow. I switched to my arcade stick controller and I had to hit reset to go back to the title screen. I started up arcade mode again and the music started playing during battles. So not sure if it was that one level I was in at first or what.
Edit: Yea it depends on the level. My guess is that certain songs are on the first track and then other ones are on other tracks cuz now I'm fighting Lei and there's no music again.


----------



## RandomGamerRiven (Mar 25, 2021)

socram8888 said:


> Will have a look at this one. What happens when it is triggered? Do you get that very same screen? I'm asking because I can't emulate that, so I generally have to reverse engineer it, blindly patch it without testing and praying it works.



Quite a few of Square Soft's later games use that copy protection. I just tried the Japanese version of Legend of Mana which has it and it triggers the message, just like a rubbish PS2 modchip we had years ago.

The game successfully boots via Tonyhax, then you get a screen of rabbits from the game appear, before the mod chip message plays. If needed I can do a quick video of it, but don't know how much it will help.

Just tried The Legend of Dragoon (NTSC/U) and (NTSC/J) so far no crash for me it got into game, I read a site that said the following gameshark code would get around the protection on Dragoon:

_D01BF664 FF52
801BF66E 1000_

Didn't need it in my case, could be early printings didn't have it? Unless it happens later in game or was was just added for the PAL version. I did find a site were people were talking about how to get round the protect, but I don't think I can't link to the site as it handles redumps of game images for preservation. If you search "The Legend of Dragoon mod chip" it will be one of listing on google. It shows the same message as the one in Legend of Mana.

I'll check Front Mission 1st and Front Mission 3 to see if they work with Tonyhax both games have crashes added for mod chip protection. 1st will crash when you enter the equipment area in the shop. 3 crashed after finishing the first mission in-game on bad mod-chips. Haven't tested them yet with Tonyhax.

[Edit: Tried Front Mission 1st and that looks like it is working correctly, could enter the shop buy and equip new weapons without issue.]


----------



## shock44 (Mar 25, 2021)

shock44 said:


> Okay so now the music is playing during a battle somehow. I switched to my arcade stick controller and I had to hit reset to go back to the title screen. I started up arcade mode again and the music started playing during battles. So not sure if it was that one level I was in at first or what.
> Edit: Yea it depends on the level. My guess is that certain songs are on the first track and then other ones are on other tracks cuz now I'm fighting Lei and there's no music again.


Alright! I got the music to play in Lei's stage this time. So I had to burn the game in a different way. I found a tutorial online. Not sure if I'm allowed to discuss the info here so I won't. But if anyone wants to know they can DM me on this website.


----------



## _47iscool (Mar 25, 2021)

Amazing that the drive can be unlocked, and then opened multiple times and continue reading the disc. Truly amazing.
Tried it on my SCPH-9001 (USA) with Silent Bomber and it worked flawless.

I would interested in knowing how it works and how it's possible.


----------



## Baraksha1 (Mar 25, 2021)

_47iscool said:


> Amazing that the drive can be unlocked, and then opened multiple times and continue reading the disc. Truly amazing.
> Tried it on my SCPH-9001 (USA) with Silent Bomber and it worked flawless.
> 
> I would interested in knowing how it works and how it's possible.



He talk quite a bit about how it works on his website's page about it at orca.pet


----------



## driverdis (Mar 25, 2021)

I wonder if running the unlock command in PS2 mode (SCPH-3900X and under) will allow booting backup PS2 CD rom (blue disc) games. I don’t even know if it is possible to send this command in PS2 mode.

EDIT: even if this does not manage to boot backups, I wonder if it would at least allow for out of region discs.

the reason I am wondering about this is that PS2 CD games do have a wobble groove with the copy protection string like PS1 games. In fact I watched a video where someone used a PS2 CD game as a hotswap disc for PS1 to get backups to load. Why put the data on the disc of it is not used at all.

i doubt this will be very useful if it did work but some games like Crash Bandicoot: Wrath of Cortex that are on CD would play should this work.


----------



## DarthMotzkus (Mar 25, 2021)

driverdis said:


> I wonder if running the unlock command in PS2 mode (SCPH-3900X and under) will allow booting backup PS2 CD rom (blue disc) games. I don’t even know if it is possible to send this command in PS2 mode.
> 
> EDIT: even if this does not manage to boot backups, I wonder if it would at least allow for out of region discs.
> 
> ...



It's impossible man, because, like the GC mode of the Wii, the PS2 has a PSX chipped inside, and when a PS1 title starts, it can't go back to PS2 mode without a console power reset. So it's impossible acess PS2 games in PS1 mode, even then are CD like, because the PS2 stuff is inaccessible.


----------



## driverdis (Mar 25, 2021)

DarthMotzkus said:


> It's impossible man, because, like the GC mode of the Wii, the PS2 has a PSX chipped inside, and when a PS1 title starts, it can't go back to PS2 mode without a console power reset. So it's impossible acess PS2 games in PS1 mode, even then are CD like, because the PS2 stuff is inaccessible.



With this, I am not referring to accessing PS1 games in PS2 mode, rather the MECHACON which should be accessible in both modes. The PS2 MECHACON of older models is able to be unlocked via the NoCash code but since the PS2 is in PS1 mode, it would not allow to reboot and try a PS2 CD game since the MECHACON would not be unlocked.

what I am describing would be using the NoCash code while in PS2 mode to boot PS2 CD (blue disc) games. Due to the way the PS2 verifies discs i think all this will accomplish would be to boot out of region PS2 CD games since the region wobble check should be bypassed. Unless I am wrong here and the license data on PS2 CD games is ignored and not used for verification.


----------



## _47iscool (Mar 25, 2021)

Baraksha1 said:


> He talk quite a bit about how it works on his website's page about it at orca.pet



I glanced over the article before posting here (found out about the exploit at gamehacking.org/vb) and skipped over that part apparently. I see now though, it's possible to run CD-R's without hot-swapping with CDROM unlock commands thanks to Martin Korth, author of the nocash emulators .
https://problemkaputt.de/psx-spx.htm#cdromsecretunlockcommands


----------



## tech3475 (Mar 25, 2021)

driverdis said:


> With this, I am not referring to accessing PS1 games in PS2 mode, rather the MECHACON which should be accessible in both modes. The PS2 MECHACON of older models is able to be unlocked via the NoCash code but since the PS2 is in PS1 mode, it would not allow to reboot and try a PS2 CD game since the MECHACON would not be unlocked.
> 
> what I am describing would be using the NoCash code while in PS2 mode to boot PS2 CD (blue disc) games. Due to the way the PS2 verifies discs i think all this will accomplish would be to boot out of region PS2 CD games since the region wobble check should be bypassed. Unless I am wrong here and the license data on PS2 CD games is ignored and not used for verification.



Since it’s only possible on older models, wouldn’t getting a HDD be better overall?


----------



## segashack (Mar 26, 2021)

I found a burning method that worked thanks to peoples help.

I am using Data Life Discs and 24x speed and the games will boot and don't stutter.

I can't seem to get Fighting Force (rev 2) to work though, compared it to redump and it matched. Game stays at "loading executable". Converted from multibin to bin with CDMage and also tried Daemon Tools. Anyone have any luck with this title?


----------



## dominater01 (Mar 26, 2021)

socram8888 said:


> From v1.2.2, tonyhax will support patching some games with anti-modchip checks. So far Tomba 2 (US) and YuGiOh Forbidden Memories (US and SP) are both supported.
> 
> If you know any game that has the black screen of death please let me know.


tetris With Cardcaptor Sakura: Eternal Heart japan has this same screen it shows a loading screen then bam call bla bla bla


----------



## Leon11 (Mar 26, 2021)

My copy has just arrived


----------



## RandomGamerRiven (Mar 26, 2021)

socram8888 said:


> From v1.2.2, tonyhax will support patching some games with anti-modchip checks. So far Tomba 2 (US) and YuGiOh Forbidden Memories (US and SP) are both supported.
> 
> If you know any game that has the black screen of death please let me know.



Got a failed to load with Chrono Cross (Original North American version) [Disc 1 & 2] SLUS-01041

In Tonyhax 1.2.1

Gives the following message read out:
Loading System.CNF
TCB = 00000004
EVENT = 00000016
STACK = 801FE000
BOOT = =
Configuring kernel
Loading executable
Loading Failed
Swap CD now

If you swap cd after that I think the software has crashed as it does nothing,

Suspect this was one of the better protected games on PS1, along with the NTSC/J version of Legend of Mana.

Everything else I've tried has worked perfectly, including many games that failed on mod chips.


----------



## socram8888 (Mar 26, 2021)

RandomGamerRiven said:


> Got a failed to load with Chrono Cross (Original North American version) [Disc 1 & 2] SLUS-01041


This is a known bug in v1.2.1 and is already solved. v1.2.2 will work with this game.


----------



## dominater01 (Mar 27, 2021)

v1.2.2 didnt fix tetris for me


----------



## driverdis (Mar 27, 2021)

tech3475 said:


> Since it’s only possible on older models, wouldn’t getting a HDD be better overall?


Technically, but some people like myself like playing off of the original disc at times and for imports would need a modchip to play original games.

unlocking the drive in while in PS2 mode (if even possible) may allow to boot different region and copied PS1 and PS2 (blue CD) games on a PS2 without needing to boot TonyHax via a PS1 game which only allows for playing PS1 games.

this scenario has limited uses since not many good PS2 games are on PS2 CD and it is a mild inconvenience at worst to boot TonyHax for playing PS1 games.


----------



## tech3475 (Mar 27, 2021)

driverdis said:


> Technically, but some people like myself like playing off of the original disc at times and for imports would need a modchip to play original games.
> 
> unlocking the drive in while in PS2 mode (if even possible) may allow to boot different region and copied PS1 and PS2 (blue CD) games on a PS2 without needing to boot TonyHax via a PS1 game which only allows for playing PS1 games.
> 
> this scenario has limited uses since not many good PS2 games are on PS2 CD and it is a mild inconvenience at worst to boot TonyHax for playing PS1 games.



I know there was a thread elsewhere about Mechacon's BIOS being dumped and potentially allowing for the DRM to be bypassed. But it's very early stages if at all possible.


----------



## someMAUZ (Mar 27, 2021)

This is a very interesting and amazing discovery! I am attempting to make it work, but here's an issue:

Since my PS2 Slim is of a revision greater than 74XXX, my third party (Hip Gear) PSX memory card wouldn't be read. I saw a Reddit post where a soldering workaround would fix the issue, so I went ahead with said action. I would copy the SPL and game save (Cool  Boarders 4) to the USB to later transfer it to the PSX. After that, I'd stick the card to my PSOne, load up CB4, and guess what? The game would load as if there was no saves in the memory card. Doing a little inspection, I noticed that my PSX memory card would appear as if it saves the SPL and crafted save on uLaunchELF, but after restarting the loader or the console, those copied files would get deleted.

Is it because the soldering mod would just enable read-only PSX memory card functionality to my console, or is it because there is a catch I'm unaware of?


----------



## RandomGamerRiven (Mar 27, 2021)

socram8888 said:


> This is a known bug in v1.2.1 and is already solved. v1.2.2 will work with this game.



Thanks for taking the time to reply socram8888

I'll sign up to your github to report bugs there I find, I'm guessing you are already aware that Chrono Cross doesn't work with v.1.2.2 and NTSC/J Legend of Mana SLPS 02170 is still triggering copy protection also in the latest version.

I've confirmed on PlayStation 2 software PS1VModeNeg v1.01 does indeed force PAL games into 60Hz as this video shows, however most games are misaligned on screen either too low or to high and not centred correctly resulting in screen cut off.


Tonyhax might want to add screen alignment options like GSM has to raise or lower the screen. As by default using Tonyhax some games are aligned incorrect as well.


----------



## HaloEffect17 (Mar 29, 2021)

Any plans for an exploit using Cool boarders 3? I saw that Coolboarders 4 works.


----------



## Tweaker_Modding (Mar 30, 2021)

ok so basically my ps1 (scph-102) has a fucked up sensor and always thinks the drive is closed. no matter what i do this little bastard doesn’t want to act normal and only think the drive is closed when its closed.

will tonyhax still work or am I fucked?


----------



## driverdis (Mar 30, 2021)

Tweaker_Modding said:


> ok so basically my ps1 (scph-102) has a fucked up sensor and always thinks the drive is closed. no matter what i do this little bastard doesn’t want to act normal and only think the drive is closed when its closed.
> 
> will tonyhax still work or am I fucked?


The current TonyHax build requires to open the tray so you are SOL unless a build is made where you can press a button to verify a disc swap vs opening the tray. I don’t know if the drive will read the new TOC this way since the lid close and open forces the drive to reinitialize and read the new disc’s TOC for maximum compatibility.

 Use could use SwapMagic or a modchip to get around TonyHax not working but a modchip is the only way to read the new disc’s TOC first and works with AntiMod games like Spyro 3 NTSC.


----------



## Tweaker_Modding (Mar 30, 2021)

driverdis said:


> The current TonyHax build requires to open the tray so you are SOL unless a build is made where you can press a button to verify a disc swap vs opening the tray. I don’t know if the drive will read the new TOC this way since the lid close and open forces the drive to reinitialize and read the new disc’s TOC for maximum compatibility.
> 
> Use could use SwapMagic or a modchip to get around TonyHax not working but a modchip is the only way to read the new disc’s TOC first and works with AntiMod games like Spyro 3 NTSC.


ok i’ll keep that in mind 

but i was playing dancing stage party edition just now on my ps1 and mid song the disc stopped spinning and the sensor finally came to its senses and started working properly so i may not be at a loss with tonyhax unless its starts being a bastard again


----------



## BilehBawb (Mar 31, 2021)

Can you use ntsc-U on Pal consoles?


----------



## driverdis (Mar 31, 2021)

BilehBawb said:


> Can you use ntsc-U on Pal consoles?


You can with a modchip but TonyHax is not really needed on a modchipped system since it can already play backup and other region games.


----------



## BilehBawb (Mar 31, 2021)

driverdis said:


> You can with a modchip but TonyHax is not really needed on a modchipped system since it can already play backup and other region games.


Is there any os on the system or is the tonyhax tricking the Ps1 to play backups.


----------



## DarthMotzkus (Mar 31, 2021)

BilehBawb said:


> Is there any os on the system or is the tonyhax tricking the Ps1 to play backups.


Please, read about the hack/exploit before start asking basic questions. The first thing all newcomers have to do is read it. There's a section named *How does this work *in the site below.

TONYHAX


----------



## driverdis (Mar 31, 2021)

BilehBawb said:


> Is there any os on the system or is the tonyhax tricking the Ps1 to play backups.



It is using previously undocumented commands on the disc drive controller to turn off the license check. This is similar to how older Wii DVD drives could be sent commands for regular dvd playback allowing to load backup Wii and GameCube games off of a disc.


----------



## Lindaru (Apr 1, 2021)

Chrono Cross doesn't work on 1.2.2 ;w;

It gives this:

Loading System.CNF
TCB = 00000004
EVENT = 00000016
STACK = 801FE000
BOOT = =
Configuring kernel
Loading executable
Loading Failed
Swap CD now

it's the disc or does this happen with every version of the game?

EDIT: Tested with 1.2.3b "Beta?" found in github and Chrono Cross "at least disc 1 for now" works like a charm.
Maybe it had something to do with the loader?


----------



## Tweaker_Modding (Apr 1, 2021)

my copy of pro skater 3 arrived today and magical drop 3 and magical drop +1 work perfectly over tonyhax

the nostalgia is real rn


----------



## mistamontiel (Apr 2, 2021)

SCPH 101, NTSC-U, THPS3, not having it unfortunate

In PS2 I put the raw save with wLE in my PS1 memory card, red screened, looked further looks like SPL missing needed another I re-acquired THPS3 save and with BESLEM99999-TONYHAX then on Create Skater just freezes screen


----------



## Tweaker_Modding (Apr 3, 2021)

my tests so far

tonyhax works on both my pal ps1 scph-102 and my pal ps2 phat scph-39002

i’m using a 3rd party memory card from a company named skream 

here are the games i have tested

-magical drop 3 (pal) - works perfectly with no issues
-magical drop +1 (pal) - works perfectly with no issues
-toca world touring cars (pal) - crashes on a loading screen, emulators do this same thing most likely a bad rom
-wwf smackdown 1 (pal) - works perfectly with no issues
-monopoly (pal) - works perfectly with no issues
-destruction derby (ntsc-u) - doesn’t boot it gets stuck at initialising cd likely because i used a cd-rw and the ps1 hates cd-rw the ps2 does the same thing
-lsd dream emulator (ntsc-j) - works perfectly with no issues did crash once but the disc was dirty so an issue on my part


----------



## Ponlork (Apr 3, 2021)

wouldnt it be great if someone creates a homebrew that boots immediately into the tonyhax exploit? and somehow press their own boot discs like how datel and breaker pro did back in the day. i would buy it in a heartbeat. though some dont think something like that will sell today but u got people spending over $100 for a PS1 memory card in 2021 so who knows


----------



## driverdis (Apr 3, 2021)

Ponlork said:


> wouldnt it be great if someone creates a homebrew that boots immediately into the tonyhax exploit? and somehow press their own boot discs like how datel and breaker pro did back in the day. i would buy it in a heartbeat. though some dont think something like that will sell today but u got people spending over $100 for a PS1 memory card in 2021 so who knows



since Sony does not go after people selling PS1 modchips and other stuff due to the console being vintage now, I wonder if they would go after people making pressed discs with the wobble groove. Obviously if people did this for retail games Sony may do something but for homebrew or a NoCash unlocker disc I doubt they would.


----------



## mistamontiel (Apr 3, 2021)

Now switched over to 7501 fat PS1 and still the same chit

THPS3 just freezes screen music continues


----------



## Lindaru (Apr 4, 2021)

Tested with 1.2.2 and 1.2.3b (beta found on github) on EU console phat PS1 using THPS2:

All my PAL discs work
Einhänder boots up 
Chrono Cross (disc 1 for now) boots up just fine on 1.2.3b but not on 1.2.2 (freezes on said error earlier)
Thrill Kill (Uncensored Full NTSC Ver.) boots up
Final Fantasy Tactics worked


----------



## Leon11 (Apr 4, 2021)

It could be useful a datasheet with working\not working\partial or problematic working games.


----------



## duwen (Apr 6, 2021)

I finally got around to running this on my PS2 (pointless to run it on my modchipped PS1) after acquiring one of the entry point titles (I went with Cool Boarders 4, while not the cheapest of the options it's not the most expensive and it has the most streamlined entry to the hack).
Worked like a charm! I guess I'm lucky enough to have a PS2 that this works with, as I've heard results are pretty mixed.

While I love all the benefits of having a FMCB PS2 with a fully loaded hard drive, it always bugged me that I couldn't run my legit NTSC import PS1 disks on my PAL PS2. This hack allows me to do just that... although there are some minor issues that I hope get addressed in the future. The main one being related to output resolution; like I said, I have a PAL console that outputs a 576i signal (in PS1 mode) via component. Upon running the hack and switching to an NTSC disk the output resolution should switch to 480 but remains in 576, which results in the image being displayed with a black border at the bottom of the screen (presumably the 96 lines worth of difference between the PAL and NTSC signals).
Oddly, the 50/60hz difference doesn't seem to be an issue, and it seems to be running at the correct frame rate for the game.

Hopefully a PS2 exclusive fork of this can be developed which could eventually include some button combos for forcing various resolutions depending on output requirements.


----------



## mistamontiel (Apr 6, 2021)

Now I've even formatted with MC Annihilator and did just the THPS3 NTSC and SPL saves

Two cards I've did this

Create Skater still refuses only freezes screen either my slim or fat

Why is this only me, @socram8888


----------



## socram8888 (Apr 6, 2021)

mistamontiel said:


> Now I've even formatted with MC Annihilator and did just the THPS3 NTSC and SPL saves
> 
> Two cards I've did this
> 
> ...


I've heard reports that uLaunchELF 4.43 corrupts data when copying from USB. Try with an older version maybe?


----------



## halfpricebuttes (Apr 7, 2021)

Could someone with a PAL Playstation try to load the "Run Crash!" demo that was just released at Revision this past week? It's posted on pouet, as a new user I can't share a link apparently but just search for PSX demos and sort by release date, it's the newest one.


Loading it from tonyhax using a copy of THPS2 on an unmodded SCPH-9001 (BIOS v4.1) results in a scrolling image with no color (expected, I was testing it on an NTSC TV and not through my GV-2USB) but it also doesn't play any of the audio from the demo and instead continues playing the THPS menu drum loop throughout the entire thing.


----------



## mistamontiel (Apr 7, 2021)

Same thing couple random ones I saw, anyone have a wLE/uLE that did the save copy with no corrupt


----------



## mistamontiel (Apr 8, 2021)

Now I used uLE v4.42d and same 'result' I quit!!! Hoping THPS4 just does it


----------



## DarthMotzkus (Apr 8, 2021)

@socram8888 did you see this: http://www.psxdev.net/forum/viewtopic.php?f=62&t=3765

It's fresh! OMG! Maybe you guys could work together on that! A new exploit wich work just opening the MC Menu.


----------



## malammore (Apr 9, 2021)

Hi Socram, thank you for your work, can you link me the procedure on how to add the savefile on the mc? thank you


----------



## Leon11 (Apr 9, 2021)

DarthMotzkus said:


> @socram8888 did you see this: http://www.psxdev.net/forum/viewtopic.php?f=62&t=3765
> 
> It's fresh! OMG! Maybe you guys could work together on that! A new exploit wich work just opening the MC Menu.



Seems like Fortuna Project for PS2, but the thing is, if i can't enter the memory card menu how can i manage the save files?


----------



## DarthMotzkus (Apr 9, 2021)

Leon11 said:


> Seems like Fortuna Project for PS2, but the thing is, if i can't enter the memory card menu how can i manage the save files?


I think it will use a memory card to exploit, and you need another to manage your saves. Or Maybe putting the memory card with exploit in slot 2 to load the hack, and in slot 1 to manage it is an option. There's a lot of possibilities and I'll follow it closely. Just hope @socram8888 see that, a collab with this new exploit will be amazing.


----------



## Tweaker_Modding (Apr 10, 2021)

ok done some more tests and this time i used different brand CD-R's
the games are launched with tonyhax 1.2.2 using tony hawks pro skater 3 (EU)
discs used are maxell CD-R's
all of these were tested on a pal ps1 (scph 102)

destruction derby - works perfectly
croc 2 - works perfectly
crash bandicoot 2 - hangs on initializing cd
croc 1 - hangs on initializing cd

will test the last 2 games on my ps2 (scph 39002) and with tonyhax 1.2.3

EDIT: croc 1 successfully boots and works with tonyhax 1.2.2 on my ps2 though it took longer to load than most games i've tested

crash bandicoot 2 gets stuck at loading executable on the ps2 with tonyhax 1.2.2
i'm gonna test 1.2.3 now and leave an edit labelled EDIT 2 when done

EDIT 2: the 1.2.3 tests

PS2
croc 1 now gets stuck at a black screen with the pro skater 3 menu music in the background

crash 2 still gets stuck at loading executable 

PS1
crash 2 successfully boots and plays fine with tonyhax 1.2.3

croc 1 successfully boots and plays fine with tonyhax 1.2.3


----------



## socram8888 (Apr 11, 2021)

DarthMotzkus said:


> @socram8888 did you see this: http://www.psxdev.net/forum/viewtopic.php?f=62&t=3765
> 
> It's fresh! OMG! Maybe you guys could work together on that! A new exploit wich work just opening the MC Menu.


I'm aware of this exploit. Looks like an interesting way to launch tonyhax, though given it requires specialized hardware I've not yet been able to use it on real hardware.

I've been considering trying something to ease its installation, but it's still in the early planning stages.


malammore said:


> Hi Socram, thank you for your work, can you link me the procedure on how to add the savefile on the mc? thank you




This video by MrMario2011 explains it pretty well.


Tweaker_Modding said:


> PS2
> croc 1 now gets stuck at a black screen with the pro skater 3 menu music in the background
> 
> crash 2 still gets stuck at loading executable


It's probably related to https://github.com/socram8888/tonyhax/issues/24, which causes reloading issues on PS2 for games that work perfectly well on PS1.


----------



## Tweaker_Modding (Apr 11, 2021)

socram8888 said:


> It's probably related to https://github.com/socram8888/tonyhax/issues/24, which causes reloading issues on PS2 for games that work perfectly well on PS1.



ah that makes sense


----------



## DarthMotzkus (Apr 12, 2021)

socram8888 said:


> I'm aware of this exploit. Looks like an interesting way to launch tonyhax, though given it requires specialized hardware I've not yet been able to use it on real hardware.
> 
> I've been considering trying something to ease its installation, but it's still in the early planning stages.



Awesome, keep us updated!


----------



## Cake4all (Apr 12, 2021)

Would it be possible just to download the tonyhax SPL file from GitHub instead of the entire folder in the future (for people who already have the game saves on their memory cards)?


----------



## socram8888 (Apr 12, 2021)

Cake4all said:


> Would it be possible just to download the tonyhax SPL file from GitHub instead of the entire folder in the future (for people who already have the game saves on their memory cards)?


Even with all the files, it's just a 100kB ZIP.

Also I recommend installing the entrypoints also, as I tend to make some breaking changes from time to time (such as for 1.3, which will be totally incompatible with current entry point saves)


----------



## mistamontiel (Apr 13, 2021)

How about it THPS4 NTSC works for me cheers


----------



## mistamontiel (Apr 13, 2021)

This really cool for bootdisc! Funny that I haven't been able to load last UniROM update but this just did lol

Gunners' Heaven quite odd not having no attract mode


----------



## duwen (Apr 14, 2021)

@socram8888
Sorry for posting an issue report here rather than on the git, but I don't have an account there.
I've worked my way through testing all my legit NTSC import disks (predominantly Japanese, but also several US) on my PAL PS2 (3900X model), using Cool Boarders 4 as the entrypoint. Pretty much everything works as expected - I've been using GSM to set screen resolution (without it image is forced to the top of the screen, with a 96 line black border at the bottom - the discrepancy between 480 and 576). The v1.3b version you supplied on github doesn't seem to fix the image position/border issue and there's still audio sync issues in fmv on some NTSC titles. That beta release also displays the Tonyhax screen incorrectly; header midway down the screen with all the useful info at the foot pushed out of view at the bottom.
Running PS1VModeNeg v1.01 before booting the Cool Boarders 4 disk does seem to fix all NTSC issues on a PAL machine, and negates the use of GSM.
I saw there was a freezing issue raised for the NTSC-U version of Einhander. I can confirm the exact same issue with the NTSC-J version. Tried with tonyhax v1.2.2, v1.2.3 and v1.3b.
Only found two titles in my collection that wouldn't boot at all using any versions of Tonyhax; Xenogears (NTSC-U) and Bust a Move (NTSC-J, aka Bust a Groove).
Looking forward to testing all these again with the next release, and I'm beyond grateful to you for finally having a way to natively play my PS1 imports on my PS2 so I don't need to dig out my modchipped PS1.



RandomGamerRiven said:


> I've confirmed on PlayStation 2 software PS1VModeNeg v1.01 does indeed force PAL games into 60Hz as this video shows, however most games are misaligned on screen either too low or to high and not centred correctly resulting in screen cut off.


Have you (anyone) got a link for PS1VModeNeg v1.01? I can't find a valid link for it anywhere, and v1.10 doesn't seem to work correctly at all.
It's okay, I found it via the Youtube video you mentioned in another of your posts.
The file's HERE if anyone else needs it.


----------



## socram8888 (Apr 15, 2021)

@duwen I've uploaded several images to GitHub, a few of which were broken. Which is the one you tried?


----------



## duwen (Apr 15, 2021)

socram8888 said:


> @duwen I've uploaded several images to GitHub, a few of which were broken. Which is the one you tried?


Thanks for responding. I tried the one you put up 5 days ago, but just noticed you put a new one up on #56 a few hours ago. I'll give it a try later.

*edit*

@socram8888

So, I've just been trying the new v1.3b that you issued today...
On the plus side, the tonyhax swap screen is fixed now, and looks great. Really like all the additional info that's displayed.
Issues I was having with certain games that switch resolutions between fmv and title screens now seem to work okay.
However, the image is still displaying as 480 'windowed' at the top of a 576 frame (PS2 outputting via component, and TV's still reporting 576i rather than 480). Audio sync issues are still there too.
All games that wouldn't load on previous versions still won't load.

Unfortunately, at present it's still better to be using v1.2.3 with PS1VModeNeg - NTSC titles run correctly with no audio sync issues, and are correctly outputting at 480 in fullscreen.


----------



## Baraksha1 (Apr 16, 2021)

I already made a post here before that is somewhat related, but I don't know what to do so I guess its worth typing again.
in a nutshell I been attempting to see if I can really understand how this softmod works (despite being inexpirienced). you see, I would absolutely love to use this because I don't have many PS1 games and I wish to use my PS1 more. the problem is that I don't own any of the games currently listed for support. I was hoping I could get this to work with the ones I do own by tempering with their save files and try copying what the other save files in the GitHub do. that proved to be more complicated then I though. this got me to think, what tools and methods does one use to  figure this stuff out? becuase I am currently  trying to make this work with Beyblade by Sunsoft and I was able to overwrite text data with a long name, but im not sure if it really overwrites anything. im not sure what I can do to really tell weather the game is compatible or not. do I need to use a RAM viewer or something?


----------



## mistamontiel (Apr 17, 2021)

@socram8888 Heaven's Gate SLPS 00667 is a no-go, hangs here

THPS4 NTSC


----------



## socram8888 (Apr 17, 2021)

v1.3 has just been released after nearly two weeks improving it, and most importantly, ironing out bugs. Available at https://github.com/socram8888/tonyhax/releases/tag/v1.3

*Changelog*

tonyhax is now bootable using the FreePSXBoot exploit.
Added support for Castlevania Chronicles (U) (SLUS-01384) as entry point.
Added automatic switching between PAL and NTSC. tonyhax will detect the game's region and swap to the correct one before launching the game, ensuring it runs at the correct speed. Support is still spotty for the PS2, though.
Improved loading speed of every entry point to match that of Tony Hawk games - no more purple screens!
Increased the screen resolution. tonyhax now uses VGA video which allows more info on screen, making debugging easier.
Added antimodchip patch for Resident Evil Survivor (U) (SLUS-01087)
Added antimodchip patch for pop'n music 2 (J) (SLPM-86294)
Added antimodchip patch for pop'n music 6 (J) (SLPM-87089)
Fixed antimochip patch for Tetris with Card Captor Sakura - Eternal Heart (J) (SLPS-02886)
@mistamontiel could you please try with this one? It's got some extra debugging which would make figuring out why that game doesn't work much easier.


----------



## mistamontiel (Apr 17, 2021)

@socram8888 sorry for wait


----------



## manks (Apr 17, 2021)

I had been using a DexDrive + Dexter to set my memory card up before before, was working perfectly for Tonyhax 1.2.2 and 1.2.3. However now trying to copy the 1.3 tonyhax.mcs fails every time in Dexter, it gets about halfway and then an "unknown error" every time. I've tried freshly formatting the card etc. Anything else I can try or info I can provide?


----------



## zfreeman (Apr 18, 2021)

manks said:


> I had been using a DexDrive + Dexter to set my memory card up before before, was working perfectly for Tonyhax 1.2.2 and 1.2.3. However now trying to copy the 1.3 tonyhax.mcs fails every time in Dexter, it gets about halfway and then an "unknown error" every time. I've tried freshly formatting the card etc. Anything else I can try or info I can provide?


MemcardRex v1.9


----------



## socram8888 (Apr 18, 2021)

mistamontiel said:


> @socram8888 sorry for wait


Hmmm all the info here seems to be correct. I was afraid it would have some sorta of weird antipiracy where it would screw up the loading point or size (as trying on an emulator that's what happened, I was getting garbled info on the "Loading executable (x @ y)" line).

I am gonna open an issue and investigate it. Is it an original import disc or a burned one?


----------



## manks (Apr 18, 2021)

zfreeman said:


> MemcardRex v1.9
> View attachment 258972


Thanks so much for the help, brings me a step closer. Now the entrypoint and loader are on my memory card, and the save file successfully loads in Castrol, but tonyhax 1.3 gives me an "Integrity check failed" message every time. I'm using a SCPH-9001.


----------



## zfreeman (Apr 18, 2021)

manks said:


> Thanks so much for the help, brings me a step closer. Now the entrypoint and loader are on my memory card, and the save file successfully loads in Castrol, but tonyhax 1.3 gives me an "Integrity check failed" message every time. I'm using a SCPH-9001.


I also had problems copying, especially with certain 3rd-party cards. I ended up copying the save from a 2nd, working card using the PS1's memory card manager.


----------



## socram8888 (Apr 18, 2021)

@manks can you try reading that file back from the memory card and attach it here? I wanna see if the file got copied successfully and thus is an error on my side, or if it's a problem with your setup


----------



## mistamontiel (Apr 18, 2021)

@socram8888 she's burnt, but able to play with earlier UniROM v8x version (current now hangs too)

Not protected

EDIT: @zfreeman there's a v1.9 MemcardRex!? Shendo's last blogspot post just says v1.8 all this lol time

EDIT 2: Well @socram8888 PAL version with PAL4u to make 60hz is working! Yusha Heaven's Gate SLES 00713


----------



## manks (Apr 18, 2021)

socram8888 said:


> @manks can you try reading that file back from the memory card and attach it here? I wanna see if the file got copied successfully and thus is an error on my side, or if it's a problem with your setup


Sure thing, thank you - here's the save exported back by MemcardRex. It does look like something is happening to the file along the way.


----------



## zfreeman (Apr 18, 2021)

mistamontiel said:


> @zfreeman there's a v1.9 MemcardRex!? Shendo's last blogspot post just says v1.8 all this lol time


He had activity in 2017 on his Github. You can use the older versions; v1.9 included PS3 decryption/encrytion. https://github.com/ShendoXT/memcardrex

@manks, do you have the coaxial charger plugged into the DexDrive? maybe it's not getting enough power when it writes.


----------



## socram8888 (Apr 18, 2021)

manks said:


> Sure thing, thank you - here's the save exported back by MemcardRex. It does look like something is happening to the file along the way.


Thanks!

So your copy has exactly three bytes different to the version released on GitHub:
 - First and second changes are on the MCS file header, and are are totally benign and expected: one is a difference in the "next sector pointer" (ie where the second block of data is stored, and this is expected to change depending on which blocks are used and which are free on the memory card), and the second is a checksum over this header (which changes because the data has changed too).
 - The third change is the one that trashes the data, and it's a change from 0x00 to 0xB0 at offset 0x1E40, which I think it's part of the tiny orca logo. The reason why this happens is beyond me, as this is just a normal byte inside the save file data that the manager should treat as opaque binary data and not mess with it.


----------



## manks (Apr 19, 2021)

@zfreeman wow, I must extend my wholehearted thanks yet again. I had not been using the power adapter for the DexDrive and the previous versions worked fine that way - but it seems to be making the difference for 1.3! 

@socram8888 thanks so much for your time, seems like I'm sorted now. Absolutely love this exploit, it's breathed new life into my PS1.


----------



## DarthMotzkus (Apr 19, 2021)

Anyone could teach me how to prepare a memory card to run the tonyhax via FreePSX? Can't find a guide for that, using uLaunch.elf on ps2 for it.

EDIT: Hey @socram8888 how you doing man? Well, i found something about Memory Card Annihilator, wich does ovewrite the memory card with the FreePSXBoot MC image. But, if i want to update the tony hax version, can i re-flash the Memory Card with this program? Did the new versions ahead will be added to the MC FreePSXBoot image? Or will be another form to update the tonyhax exploit?
I'm asking because i read the Memory Card Annihilator flash method can't be undone, and i don't know how to update the upcome tonyhax version with that, will be safe to reflash?

Thanks, if anyone could enlight it for me, i'll be much appreciated, for now I'll stick with save exploit method via Brunswick 2.


----------



## socram8888 (Apr 19, 2021)

DarthMotzkus said:


> Anyone could teach me how to prepare a memory card to run the tonyhax via FreePSX? Can't find a guide for that, using uLaunch.elf on ps2 for it.
> 
> EDIT: Hey @socram8888 how you doing man? Well, i found something about Memory Card Annihilator, wich does ovewrite the memory card with the FreePSXBoot MC image. But, if i want to update the tony hax version, can i re-flash the Memory Card with this program? Did the new versions ahead will be added to the MC FreePSXBoot image? Or will be another form to update the tonyhax exploit?
> I'm asking because i read the Memory Card Annihilator flash method can't be undone, and i don't know how to update the upcome tonyhax version with that, will be safe to reflash?
> ...


I've had no issue updating the memory card image or even formatting it back to defaults using MC Annihilator while testing, so you shouldn't have any either.


----------



## DarthMotzkus (Apr 19, 2021)

socram8888 said:


> I've had no issue updating the memory card image or even formatting it back to defaults using MC Annihilator while testing, so you shouldn't have any either.


Thanks for the quickly reply.
I've managed to get it work, booted Grandia NTSC already on my PsOne 4.5 Bios, and it's more quickly to run the backup disc in this way, mainly because i can keep the disc and don't need to swap.
So if i want to update the .mcd image to a newest version should i restore the MC Image with the new one, do i need to restore the original MC image and then flash it?
Oh, and one last thing, the MC Annihilator only reads .mcr image files, i just renamed the .mcd extension of your file and it works. Maybe you should post the upcoming revisions on .mcr format already, to use on "Annihilator" or write that in the wiki page/readme.

Thank you again!


----------



## socram8888 (Apr 19, 2021)

DarthMotzkus said:


> Thanks for the quickly reply.
> I've managed to get it work, booted Grandia NTSC already on my PsOne 4.5 Bios, and it's a way more quickly run the backup disc, mainly because i can keep the disc and don't need to swap.
> So if i want to update the .mcd image to a newest version should i restore the MC Image with the new one, do i need to restore the original MC image and then flash it?
> Oh, and one last thing, the MC Annihilator only reads .mcr image files, i just renamed the .mcd extension of your file and it works. Maybe you should post the upcoming revisions on .mcr format already, to use on "Annihilator" or write that in the wiki page/readme.
> ...


You don't need to format it or anything, just flash a new image over the old one and that's it.

I'll add a note regarding the file extension. I am using .mcd instead of .mcr because that's what everybody but Annihilator (no$psx, PS1 MC Manager) uses.


----------



## DarthMotzkus (Apr 19, 2021)

socram8888 said:


> You don't need to format it or anything, just flash a new image over the old one and that's it.
> 
> I'll add a note regarding the file extension. I am using .mcd instead of .mcr because that's what everybody but Annihilator (no$psx, PS1 MC Manager) uses.


Cool!
Will be any future improvement regarding loading the FPSXB+TONYHAX exploit in Memory Card Slot-2 and with no issues for letting the exploited MC inserted on it? So i can keep my main memory card on slot-1 all the time. Or is it impossible?


----------



## socram8888 (Apr 20, 2021)

DarthMotzkus said:


> Cool!
> Will be any future improvement regarding loading the FPSXB+TONYHAX exploit in Memory Card Slot-2 and with no issues for letting the exploited MC inserted on it? So i can keep my main memory card on slot-1 all the time. Or is it impossible?


You game me a good idea. I could technically patch the BIOS to disable accesses to memory cards where FreePSXBoot is connected, effectively making as if there was no card connected to the port.

Also regarding the slot 2, I honestly haven't tried launching tonyhax with the card on the second slot. Could you try it?


----------



## Elbart (Apr 20, 2021)

FPSXB'd Tonyhax-MC in Slot 2 would be awesome and could be used just like FMCB in slot 2 for PS2.

Normal savegames-MC in Slot 1, and hacked MC in Slot 2, which games hardly ever check or even support, afaik. No more swapping.


----------



## ButThouMust (Apr 20, 2021)

Hello, I want to report a bug with the Coolboarders 4 entry point on version 1.3.1. I'm following the format in some of the issues on Github:

tonyhax version: 1.3.1
Installation method: FreeDVDBoot + uLaunchElf
Entry point game: Coolboarders 4 (SCUS-94559)
Console version: SCPH-39001
Integrity check: none, exploit doesn't boot
BIOS version: v5.0 02/07/02
Target game: not relevant for this report, but Dragon Quest IV

Bug explanation: Coolboarders 4 says that the records and settings have been automatically loaded. However, when I select "single player" to load the exploit, the game instead proceeds as normal to the name entry menu. The screen doesn't flash any solid color, not even red.

Other tonyhax versions I tried:
1.2.3: works with Coolboarders 4, Tony Hawk 2 (SLUS-01066)
1.3.1: works with Tony Hawk 2
1.3: didn't use (I don't own a PS1)
("works" = I can boot DQ IV with the exploit) I made sure not to mix versions when copying files to the memory card.

Thanks for your work on this! I greatly appreciate the ability to play PS1 DQ IV on an actual console instead of on a PS1 emulator.


----------



## duwen (Apr 21, 2021)

ButThouMust said:


> Hello, I want to report a bug with the Coolboarders 4 entry point on version 1.3.1. I'm following the format in some of the issues on Github:
> 
> tonyhax version: 1.3.1
> Installation method: FreeDVDBoot + uLaunchElf
> ...



Did you update the Coolboarders save file as well as the Tonyhax one?
I've had no problem with Cool Boarders 4 on my 39003 console and TH1.3.1 ...only difference being I'm using PAL Coolboarders on my PAL PS2.


----------



## DarthMotzkus (Apr 21, 2021)

socram8888 said:


> You game me a good idea. I could technically patch the BIOS to disable accesses to memory cards where FreePSXBoot is connected, effectively making as if there was no card connected to the port.
> 
> Also regarding the slot 2, I honestly haven't tried launching tonyhax with the card on the second slot. Could you try it?



Hey. Let's report my tests. I'm on a NTSC/US SCPH-101 PsOne with 4.5v BIOS.
Well, i tested tonyhax exploit with brunswick 2 save exploit on slot-2, and the tonyhax save on my main memory card on slot-1. When Brunswick boot, the first screen is the auto load. It found my save on slot-2 memory card and auto-load it. After i load the game on menu and select Slot-2 the game still load the Tonyhax save wich is on slot-1. I figured it's reading the slot-1 exploit, because the tonyhax save is on my slot-2 MC either, and with no MC on slot-1 tonyhax gave me a red screen. I've been using in this way for weeks, since yesterday.
I tested what could happen if i left the MC with the FPSXB+Tonyhax on slot-2 and nothing on slot-1. It doesn't work. When i select the memory card on PS menu, the memory card image turns dark and the boot color screens doesn't appears, no matter how much time it takes, normally gets 15/20 seconds for tonyhax to load. Even with any MC on slot-1 and the exploited FPSXB+Tonyhax MC on slot-2 still stuck on the dark picture of the MC. No deal.
Another thing i noticed. If i don't remove the MC with FPSXB+Tonyhax on slot-1 or, even if i put it on slot-2 and insert my main MC on slot-1, tonyhax became very slow to read the disc after i close the lid and the reader took almost 1 minute to show the first screen of the game i've tested (Grandia show Sony Computer Entertainment splash screen).
It turns out ever i load the exploit via Memory card menu, right after tonyhax load on screen, i need to remove the exploit MC and insert my main MC, or tonyhax won't work correctly or work too slow.

Glad to help.


----------



## ButThouMust (Apr 21, 2021)

duwen said:


> Did you update the Coolboarders save file as well as the Tonyhax one?
> I've had no problem with Cool Boarders 4 on my 39003 console and TH1.3.1 ...only difference being I'm using PAL Coolboarders on my PAL PS2.


Yes, whenever I updated the entrypoint and loader files on my memory card, I would delete all existing tonyhax files on it before copying the new files over. I made sure not to mix versions together, such as a 1.2.3 entrypoint file with the 1.3.1 loader file.

Just to make sure I wasn't going crazy, I redownloaded the 1.3.1 release, deleted all the tonyhax files on my memory card, and copied the redownloaded files to my memory card. Same results as before with Coolboarders and Tony Hawk 2.


----------



## socram8888 (Apr 21, 2021)

@ButThouMust thanks for the report. Fixed with v1.3.2: https://github.com/socram8888/tonyhax/releases/tag/v1.3.2


----------



## Mike_D (Apr 30, 2021)

Just tried this out on my PSone (with integrated screen).
I tried Castlevania SotN (NTSC) first but all I got was a rolling picture.
Tried ISS Pro Evo 2 (EURO) and it played fine.

Is the problem due to using an NTSC iso or limits with the PS screen

Is the rolling picture "fixable" with an RGB scart.


----------



## duwen (Apr 30, 2021)

Mike_D said:


> Is the rolling picture "fixable" with an RGB scart.



I'd tentatively say yes, but it would depend on the quality of the scart cable and the tv it's attached to.
I've never had problems running NTSC titles on my PAL PS1's using the scart cable I have now, but I originally had a cheaper one that would only display NTSC games in black and white and sometimes (depending on the resolution of the game) roll the image.

Check out the info at RetroRGB for details of what may work best for your set up.


----------



## Mike_D (Apr 30, 2021)

Thanks duwen.
I do have a scart somewhere!!!!
I have a vague memory (many years ago) of having a scart cable that displayed a black & white image on some back-ups. But I definitely bought another (maybe a proper rgb scart) that fixed it.
Will have to trawl through the attic!


----------



## duwen (Apr 30, 2021)

Mike_D said:


> Thanks duwen.
> I do have a scart somewhere!!!!
> I have a vague memory (many years ago) of having a scart cable that displayed a black & white image on some back-ups. But I definitely bought another (maybe a proper rgb scart) that fixed it.
> Will have to trawl through the attic!


I don't know what signal the integrated screen uses, but it sounds like it may just hook into the composite line (although it's strange that a 'flat panel' screen from that period wouldn't accommodate NTSC & PAL signals) - if so, outputting via scart to a monitor/tv would almost certainly improve things.


----------



## Mike_D (Apr 30, 2021)

Scart cable found.
Screen removed.
Hooked up to TV
Castlevania = flicker free! 

Thanks for the help.


----------



## Mike_D (Apr 30, 2021)

Spent a few hours browsing the site (though technically, I'm "working" from home).
And I come across freePSXboot.
All that bother of buying THPS3 from ebay (twice, because the 1st one didn't show up) and
now it turns out I didn't even need it!


----------



## duwen (Apr 30, 2021)

Mike_D said:


> Spent a few hours browsing the site (though technically, I'm "working" from home).
> And I come across freePSXboot.
> All that bother of buying THPS3 from ebay (twice, because the 1st one didn't show up) and
> now it turns out I didn't even need it!


Sucks, but with freePSXboot you have to give up an entire memory card for it.

I'm running tonyhax on my PS2 (don't need it for my ps1 as that's modchipped), so freePSXboot isn't an option for me... but I know that I got my disk of Cool Boarders 4 (the entrypoint I use for tonyhax) for a lot less than a pre-owned official memory card or a brand new 3rd party one would cost.


----------



## Mike_D (Apr 30, 2021)

I had about 6 memory cards lying about so i was happy to use one for the convenience of not having to disc swap.
Both fantastic options though.


----------



## Lindaru (May 3, 2021)

Tested Version 1.3.3 FreePSXBoot and I couldn't remove it from my memory card any other way then using Crash 1's memory card management thing, it crashed on PS2 (on boot and MCAnnihilator), so you have to dedicate an spare memory card for it. ;w;

EDIT: I couldn't get backups / out of region games to work, so I prefer using THPS2 method of TonyHax


----------



## DarthMotzkus (May 3, 2021)

Hello @socram8888, i noticed you launched the 1.3.3 revision of the TonyHax+FreePSXBoot with that idea implemented about blocking the FreePSXBoot so the game could carry on without issues/crashing. 
Any news about loading the TonyHax+FreePSXBoot exploit via slot-2, with other MC inserted in slot-1 (the main MC with saves) as well? So there's no need to swap the MCs. When i tried, it's freezes after choosing MC menu.


----------



## socram8888 (May 4, 2021)

Lindaru said:


> Tested Version 1.3.3 FreePSXBoot and I couldn't remove it from my memory card any other way then using Crash 1's memory card management thing, it crashed on PS2 (on boot and MCAnnihilator), so you have to dedicate an spare memory card for it. ;w;
> 
> EDIT: I couldn't get backups / out of region games to work, so I prefer using THPS2 method of TonyHax


Mmmm I've had no problem using MCA to install new updates over the old one. Could you please try connecting the memory card after launching MCA?



DarthMotzkus said:


> Hello @socram8888, i noticed you launched the 1.3.3 revision of the TonyHax+FreePSXBoot with that idea implemented about blocking the FreePSXBoot so the game could carry on without issues/crashing.
> Any news about loading the TonyHax+FreePSXBoot exploit via slot-2, with other MC inserted in slot-1 (the main MC with saves) as well? So there's no need to swap the MCs. When i tried, it's freezes after choosing MC menu.


Yeah that patch is in preparation of booting from the second memory card, so you can leave the memory card permanently connected.

So far all I can get is the system to crash if launching via the second memory card, same as you.

If I can't get booting from the second memory card, I've found there's a flag on the BIOS that allows swapping the ports, so games thinking reading from the first port would be really really accessing the second port, and vice-versa. You could leave the exploit card on the first port and save on the second one.

That'll be the really last option I'd prefer to use since it's a pretty confusing thing to do for the end user, though.


----------



## DarthMotzkus (May 4, 2021)

socram8888 said:


> Mmmm I've had no problem using MCA to install new updates over the old one. Could you please try connecting the memory card after launching MCA?
> 
> 
> Yeah that patch is in preparation of booting from the second memory card, so you can leave the memory card permanently connected.
> ...



Amazing! I Look foward to it.


----------



## Elbart (May 4, 2021)

socram8888 said:


> If I can't get booting from the second memory card, I've found there's a flag on the BIOS that allows swapping the ports, so games thinking reading from the first port would be really really accessing the second port, and vice-versa. You could leave the exploit card on the first port and save on the second one.


Tonyhax - Psycho Mantis Edition


----------



## Lindaru (May 5, 2021)

socram8888 said:


> Mmmm I've had no problem using MCA to install new updates over the old one. Could you please try connecting the memory card after launching MCA?



Connecting PS1 memory card that has 1.3.3 (4.1 bios) to MCA after launching freezes my PS2.
The only way I can remove the file is using games that allow seeing your memory card's contents (Crash 1, Abe's Oddysey etc).

I could try to get another PS1 memory card because I only have one atm. D:


----------



## socram8888 (May 9, 2021)

Lindaru said:


> Connecting PS1 memory card that has 1.3.3 (4.1 bios) to MCA after launching freezes my PS2.
> The only way I can remove the file is using games that allow seeing your memory card's contents (Crash 1, Abe's Oddysey etc).
> 
> I could try to get another PS1 memory card because I only have one atm. D:


I've been thinking about this.

Out of curiosity, which model is your PS2? I am wondering if this bug also affects the PS2 under a certain revision, because my slim PS2 (I am not sure about the model at the moment) is totally cool with these hacked memory cards.

In fact I can open uLaunchElf with the memory card connected and browse them to get files with absurdly large file sizes, but no crash at all.


----------



## Lindaru (May 10, 2021)

socram8888 said:


> I've been thinking about this.
> 
> Out of curiosity, which model is your PS2? I am wondering if this bug also affects the PS2 under a certain revision, because my slim PS2 (I am not sure about the model at the moment) is totally cool with these hacked memory cards.
> 
> In fact I can open uLaunchElf with the memory card connected and browse them to get files with absurdly large file sizes, but no crash at all.



My PS2 is 90004 Slim


----------



## Mike_D (May 10, 2021)

Mike_D said:


> Just tried this out on my PSone (with integrated screen).
> I tried Castlevania SotN (NTSC) first but all I got was a rolling picture.
> Tried ISS Pro Evo 2 (EURO) and it played fine.



An update on my previous post...........
Since I switched from using TonyHax to freepsxboot, I can now actually play the NTSC version of Castlevania SotN on the PSOne screen by selecting NTSC--->PAL.


----------



## DarthMotzkus (May 11, 2021)

Hi @socram8888, today i was testing a backup of The Legend of Dragoon (U) (SCUS-94491) on my psone 4.5v BIOS with the FreePSXBoot+Tonyhax 1.3.3 (lastest) and it got stucked on antipiracy screen. My console isn't modchipped. Can you provide a new release with a patch for antipiracy screen for this game?
Thanks mate, btw, the latest release is a way faster than the previous i was using (1.3.1), took only 2 seconds to boot tonyhax after the MC Menu Screen, before it's almost 10 seconds then the colors, then tonyhax... congratulations for that, superb work!


----------



## duwen (May 19, 2021)

@socram8888
I discovered another game that won't boot on PS2 - probably related to the other system.cnf issues... legit disk of Tobal 2 (SCPS-45025) black screens after disk swap.
Is there any way of solving these system.cnf issues on PS2?
I already have multiple ways I can run pirated PS1 content, but only my modded PS1 is capable of running all region legit disks.
It's such a shame that tonyhax comes along and provides a way of finally running legit import PS1 disks on the PS2 hardware but a significant amount of games won't run. Possibly a PS2 fork of tonyhax that can patch the system.cnf? Obviously I don't know what's required in coding terms, but if it's possible it would be great.


----------



## DarthMotzkus (May 19, 2021)

socram8888 said:


> I've been thinking about this.
> 
> Out of curiosity, which model is your PS2? I am wondering if this bug also affects the PS2 under a certain revision, because my slim PS2 (I am not sure about the model at the moment) is totally cool with these hacked memory cards.
> 
> In fact I can open uLaunchElf with the memory card connected and browse them to get files with absurdly large file sizes, but no crash at all.


Hi @socram8888, i got this issue too, today when i tried to re-image the MC with the latest 1.3.5b to test The Legend of Dragoon anti-mod patch you sended me, and the hacked MC with 1.3.3 freezes my ps2 slim too. It can't boot the ps2 at all if i turn it on with the MC inserted, in any slot. It's odd because i've already installed previously FPSXBoot+TonyHax image on it, and used the same console to do so... but it was other version, and then sometime after i updated to the 1.3.3 a couple weeks ago with no problem. Apparently the 1.3.3 after installed on MC freezes the ps2.
My model is: SCPH-77003 (PAL), and it's the only console i had to start ulaunch.elf to hack the PSX MCs with the FPSXB+Tonyhax images.
Gonna try access the MC via Crash 1 like the buddy said in this page and try to delete all the contents. Gonna tell if anything changes.|

EDIT 1: I can't find any option to delete the "corrupted block" on Crash bandicoot 1 save manager, only load. How do you manage to delete it @Lindaru ?

EDIT 2: Any PSX game a try to save, after insert the hacked MC, it freezes the console. I cannot even overwrite with any save, or delete in the game MC Save Manager. If i insert it on PSX Memory Card Save manager, after the menu already opened, it doesn't show any save on it. But i can see the save on LOAD GAME screen of Crash 1, it's a bandage icon with "Corrupt block" name, but no option to delet it. I guess i've lost this PSX MC for good.

EDIT 3: If anyone knows a good memory card save manager inside a PSX title please inform me, so i can try delete the corrupted save and maybe the MC can stop freezing my ps2.

EDIT 4: I found on google the "Psx Hacker KIT", burned it and formatted the MC with the MC Manager on it. If anyone happens to corrupted MC because of those images, use it, it can boot via tonyhax too. The my MC stopped to freezes the ps2 or else.


----------



## socram8888 (May 21, 2021)

duwen said:


> @socram8888
> I discovered another game that won't boot on PS2 - probably related to the other system.cnf issues... legit disk of Tobal 2 (SCPS-45025) black screens after disk swap.
> Is there any way of solving these system.cnf issues on PS2?
> I already have multiple ways I can run pirated PS1 content, but only my modded PS1 is capable of running all region legit disks.
> It's such a shame that tonyhax comes along and provides a way of finally running legit import PS1 disks on the PS2 hardware but a significant amount of games won't run. Possibly a PS2 fork of tonyhax that can patch the system.cnf? Obviously I don't know what's required in coding terms, but if it's possible it would be great.


Can you please try with this beta version of tonyhax? https://github.com/socram8888/tonyhax/files/6519361/tonyhax-v1.3.5b.zip

I've made three different improvements that are directly related to compatibility on the PS2. Hopefully one of them fixes the issue you're experiencing.


----------



## duwen (May 21, 2021)

socram8888 said:


> Can you please try with this beta version of tonyhax? https://github.com/socram8888/tonyhax/files/6519361/tonyhax-v1.3.5b.zip
> 
> I've made three different improvements that are directly related to compatibility on the PS2. Hopefully one of them fixes the issue you're experiencing.


Thanks! I'll try it with all the titles I've had issues with over this weekend and let you know my results.


----------



## DarthMotzkus (May 21, 2021)

socram8888 said:


> Can you please try with this beta version of tonyhax? https://github.com/socram8888/tonyhax/files/6519361/tonyhax-v1.3.5b.zip
> 
> I've made three different improvements that are directly related to compatibility on the PS2. Hopefully one of them fixes the issue you're experiencing.


Hi again @socram8888, did you patched the anti-mod screen after the "disc swap screen" for tonyhax on Legend of Dragoon? It's another place the anti-mod screen shows up in this game. Can you provide me wich offset and hex line i need to edit to get rid of it after the swap disc screen too? I want to edit the .exe directly like i did with the modded Dragoon image. If you didn't patch it for tonyhax yet for the clean version of the game, you can trigger the screen booting the disc 2 and select to start a new game, the swap to disc 1 screen will shows up and after you change to disc 1, the anti-mod screen shows up after the disc 1 load.
For that i think each disc has it place for that because the swap disc screen will appears after finishing a disc, starting in disc 2.


----------



## socram8888 (May 21, 2021)

@DarthMotzkus I think that's also working. The antipiracy is in the main executable which I think stays resident even if you swap discs.


----------



## DarthMotzkus (May 21, 2021)

socram8888 said:


> @DarthMotzkus I think that's also working. The antipiracy is in the main executable which I think stays resident even if you swap discs.


I edited the .exe permanently in that adress you gave me, editing the .bin directly via hexeditor and saved, burned the image into disc, ok, it works, with fmv sound too. So the first anti-mod screen is fixed, but when the disc is swapped the anti-mod screen shows up. Apparently there's another adress with the anti-mod check. It's happening with the clean version too, using tonyhax thou.  Damn, i thought we're done with it . 
You can test by yourself, even without a save of a "change to disc X" step of the game. Just booting a clean version of dragoon disc 2 on tonyhax 1.3.5b, select new game, when it ask, swap to disc 1, and the anti-mod shows up. It will appear in other discs swap screen too, in normal progression.
I readed about it yesterday when i was searching about dragoon anti-mod screen. Playing dragoon backups get the screen in disc swap too if you don't have a mod-chip with stealth mode or something. So, there's another adress with anti-mod screen the game checks your copy and console, in disc swap screen.
Could you please look on it? Let me know, pls, if you find the other address with the anti-mod screen, so i can edit my .exe from the modded version too.
Thanks.


----------



## socram8888 (May 21, 2021)

Yeah this game is rigged with antipiracy everywhere. There's no way this can be patched from within tonyhax.


----------



## duwen (May 22, 2021)

socram8888 said:


> Can you please try with this beta version of tonyhax? https://github.com/socram8888/tonyhax/files/6519361/tonyhax-v1.3.5b.zip
> 
> I've made three different improvements that are directly related to compatibility on the PS2. Hopefully one of them fixes the issue you're experiencing.


Just finished checking all the games I previously had issues with and they now all work perfectly! 
To clarify; I'm using Cool Boarders 4 entrypoint on a PAL 39003 PS2, th1. 3.5b. The legit (not burned) disks that were previously not booting but now work great are NTSC-U Xenogears, and 3 NTSC-J titles, Bust-a-Move, Einhander, and Tobal 2.
I also tried a couple of burned disks that previously wouldn't boot and they both work fine now too; NTSC-U Colony Wars and the "True Directors Cut" patched Resident Evil (I saw that someone else had raised an issue on github about vanilla Resident Evil Directors Cut only booting via Game shark, so I guess this latest build fixes that one too). 

Great work! I'm beyond grateful for all your work on tonyhax @socram8888 !


----------



## DarthMotzkus (May 22, 2021)

socram8888 said:


> View attachment 263833
> Yeah this game is rigged with antipiracy everywhere. There's no way this can be patched from within tonyhax.


It's outside of .exe too? Or in other addresses inside the .exe?


----------



## socram8888 (May 24, 2021)

DarthMotzkus said:


> It's outside of .exe too? Or in other addresses inside the .exe?


Multiple addresses in a lot of files. Heck, that .XA file is an audio file that has the antipiracy hidden at the end!

Anyhow I am working on v1.4. Instead of booting from the second memory card slot (which I depend of FreePSXBoot to achieve) as I wanted to implement for this version, I am working on something new: automatic anti-anti-modchip patching!

Hopefully this code I am writing would be able to defuse literally every game out there with antimodchip.


----------



## NerdGamer35 (May 24, 2021)

Hi all.Firstly a big thank you for @socram8888 and all the people that help get this software working. For me it allows getting my old collection back with out breaking the bank. So far I managed to have all my backups working except 2. I’m on a PSone 102, TonyHax version 1.3.3. The offenders are Tekken 3 and RidgeRacer 4 both USA. The games run ok but I can’t get the controller to register any input on the games.I’ve tried 2 different ones and those games are the only ones that this happens. Has anyone got the same issue as me or is it just a flucke of the CD burning process, or something else? Thank you for the help. Cheers


----------



## duwen (May 24, 2021)

@socram8888 
#61 Einhänder (US) fails to pass first loading screen on PS2
pretty sure you can close this one - it definitely works for me now where it didn't previously.

#24 SYSTEM.CNF loading issue on PS2 consoles
I'd tentatively say this one is fixed now too. I believe that the last comments on there (_EDIT : Still not working, gets stuck a bit reading the system.cnf then says Reinitializing kernel swap cd now. Thanks tho!
EDIT 2 : Another game that didn't work for me was Parasite EVE i just tried it and it said Bios won't fit or w/e and then loaded lol_) are down to poor burns - Parasite Eve has worked for me on ALL previous releases of tonyhax, albeit with the same bios error.


----------



## socram8888 (May 24, 2021)

@duwen thanks for the reports! I've closed the first one. The second one is probably still a pending issue that might not be even fixable, as I think it might depend on the settings used by PS1DRV.

For everyone, I went to bed at like 3am but managed to finish a beta version of v1.4, which includes the automatic antipiracy patching. Can be downloaded at https://github.com/socram8888/tonyhax/files/6529197/tonyhax-v1.4b.zip

This one features even more BIOS patches, so if you find any game that behaves funny or the antipiracy is triggered let me know so I can look into it.


----------



## NerdGamer35 (May 24, 2021)

@socram8888
Thx for the updates and hard work. I can confirm that both games RR4 and Tekken 3, still don't recognize any controller input with build 1.4b.
I have reburned the games with the lowest speed possible, using a Verbatim cd-r, previous attempts where with a TDK cd-r.
Both games boot up fine and intro video runs smoothly. The only issue is the controller not working. 
Tested on a PSone 102, original mc, both original and 3rd party controllers tested. RE3 and Front Mission 3 games work fine with same setup. Curious that only those Namco games don´t work.
Entry point Crash 3.

PS - Tried Metal Gear Solid Integral NTSC version also the same issue with the controller.


----------



## socram8888 (May 25, 2021)

Just released v1.4! It's been just two days since the last release, but this one comes with very fancy and juicy improvements!

*Changelog*

Added automatic patching against anti-mochip. Fixes #37, #74 and #76, plus probably every game out there that hadn't been reported yet.
Added an option to launch tonyhax as a boot CD, so you can benefit from the automatic game patching if your console does not have a stealth modchip. Thanks @alex-free!
Mute all audio channels before launching a game, which fixes the launching game's loops from playing in launched games, fixing two games of #35
Reinitialize the entire console's RAM, so the game launches in a predictable state. Fixes the last game of #35.
Available at https://github.com/socram8888/tonyhax/releases/tag/v1.4.


----------



## KleinesSinchen (May 25, 2021)

socram8888 said:


> Just released v1.4! It's been just two days since the last release, but this one comes with very fancy and juicy improvements!
> 
> *Changelog*
> 
> ...


Tonyhax and FreePSXBoot make the most of any PlayStation 1.

Can't give you more than my usual *"Thank you!"* for the good work. Modchips would never have been needed if this existed back then. No reason to ever touch the original discs again.


----------



## DarthMotzkus (May 25, 2021)

socram8888 said:


> Just released v1.4! It's been just two days since the last release, but this one comes with very fancy and juicy improvements!
> 
> *Changelog*
> 
> ...



Amazing work man, congratulations! Did the next step will be the "slot 2" boot btw?


----------



## Lindaru (May 26, 2021)

@socram8888 "added an option to launch tonyhax as a boot CD"? this is only for the FreeMCBoot or? :o


----------



## duwen (May 26, 2021)

Lindaru said:


> @socram8888 "added an option to launch tonyhax as a boot CD"? this is only for the FreeMCBoot or? :o


It's for modchipped PS1's that need to utilise the AP patching.


----------



## Lindaru (May 26, 2021)

duwen said:


> It's for modchipped PS1's that need to utilise the AP patching.



aww :<


----------



## duwen (May 28, 2021)

@socram8888 
The latest official build (1.4) seems to take a lot longer to boot than the previous (1.4b) - it hangs on a yellow screen for a good few seconds... is this due to the anti-modchip patching?

Also, now I'm able to load up all my official import disks I've begun troubleshooting some of the burned titles others are having issues with...
Firstly, Megaman X4 (as it seems to be one mentioned several times within the system.cnf issues thread), but it works fine for me.
I've said before, but I'm using a PAL 39003 PS2 with Cool Boarders 4 entrypoint. From the evidence so far it seems that different entrypoints have different compatability, with the Brunswick games having the poorest and Cool Boarders 4 and the Tony Hawks games having the best.
I'll continue checking other games that have been flagged as problematic, but so far everything is working great on my set up.


----------



## socram8888 (May 28, 2021)

@duwen ... yellow screen? Do you mean the green one? If so that's indeed expected, as in order to fix a bugged game (Test Drive 6) I clean the entire console's RAM using the super slow on-ROM bcopy method, which takes its sweet time to finish.

In v1.4.1 it will still do it, but it'll be less noticeable as the clean RAM process will be done later in the boot process (right before loading the game's executable, when the display has been already initialized).


----------



## duwen (May 28, 2021)

socram8888 said:


> @duwen ... yellow screen? Do you mean the green one? If so that's indeed expected, as in order to fix a bugged game (Test Drive 6) I clean the entire console's RAM using the super slow on-ROM bcopy method, which takes its sweet time to finish.
> 
> In v1.4.1 it will still do it, but it'll be less noticeable as the clean RAM process will be done later in the boot process (right before loading the game's executable, when the display has been already initialized).


Yeah, probably green... after the blue (probably causes some sort of optical illusion with my eyes so I see yellow)


----------



## socram8888 (May 28, 2021)

Just finished with v1.4.1, available at https://github.com/socram8888/tonyhax/releases/tag/v1.4.1

*Changelog*

Improved entrypoint stability, which fixes random red screens in the bowling games (issues #89, #90)
Reduced BIOS initialization time, spending less time in the green screen of death.
Made CD initialization errors non-fatal.
Improved logging to remove duplicated messages.
IMO the most important change is the third one: inserting a damaged disc, or no disc at all, will no longer cause tonyhax to freeze. It will instead just be handled gracefully and will allow the user to enter another disc.


----------



## duwen (Jun 1, 2021)

Booting with 1.4.1 is a significant improvement over the last version. Just a flash of the green screen, after the blue, before getting to the TH info screen.
I've been testing some more of the problematic system.cnf titles on PS2 and so far every single one of them has worked fine for me.
I'm going to deduce that the issue is specific to either a certain entrypoint or PS2 model or combination of the two.
As mentioned previously, my PAL 39003 PS2 with Cool Boarders 4 entrypoint is loading everything I'm throwing at it using TH1.4.1.


----------



## Baraksha1 (Jun 8, 2021)

I tried looking this up but I couldn't find a solution, I recently burned Castlevania Symphony Of The Night and when I tried using TonyHax it returned a code error:

"disk error type d code 12 (x11)"

is it a problem with the disk I burned?


----------



## KleinesSinchen (Jun 8, 2021)

Baraksha1 said:


> I tried looking this up but I couldn't find a solution, I recently burned Castlevania Symphony Of The Night and when I tried using TonyHax it returned a code error:
> 
> "disk error type d code 12 (x11)"
> 
> is it a problem with the disk I burned?


*No problem here.*
Tonyhax 1.4.1 from the entrypoints "boot CD-R" and "Crash Bandicoot 3 Warped (PAL)" on PAL Consoles: SCPH-1002, SCPH-7502, SCPH-9002

Result: Symphony of the Night CD-R loads in any case from Tonyhax.

Process of elimination:
Make sure you have a good dump (emulators might be more forgiving than real hardware -- image working in emulator is not sufficient).
Try a different console and a different loading method: Modchip, FreePSXBoot (with Unirom), MechaPwn (on PlayStation 2, modification is your own risk, carefully read the README.md).
Try a different CD-R brand/burner/burning program.
*

Good luck and have fun!*


----------



## Baraksha1 (Jun 8, 2021)

KleinesSinchen said:


> *No problem here.*
> Tonyhax 1.4.1 from the entrypoints "boot CD-R" and "Crash Bandicoot 3 Warped (PAL)" on PAL Consoles: SCPH-1002, SCPH-7502, SCPH-9002
> 
> Result: Symphony of the Night CD-R loads in any case from Tonyhax.
> ...



well, I attempted to load TonyHax on my PS2 and then said my console is from Japan even though it's europeon and didn't proceed, so I can't really test it on that. I DID got my rom from Coolrom, so maybe that wasn't a bright idea. I thought maybe the problem was that the game was Multitracked so I combined the tracks with CDMage and it unfortunetly didn't work.

I highly doubt my DVD burned is not good, it has served me well through out multiple consoles and this is the kind of thing I feel like  people only suggest because they can't give a solution and is a very unlikely situation in general (no offence) mostly because every time someone says it I try other burners and get the same results.

as for the CD brand, I am using official Sony CD's so I don't think it gets more High Quality then this. the only thing I can think of is that the Rip I used is bad, it definatly works on emulator, but my modded PS2 can't read it(also yes my PS2 is modded, but I only tested official PS1 games with it not burned so idk what should happen) so I think you have a point there, the only problem is that now im not sure where I can look for good High Quality rips and I know as hell I am not going to ask for it here considering the guide lines.


----------



## duwen (Jun 8, 2021)

Baraksha1 said:


> I thought maybe the problem was that the game was Multitracked so I combined the tracks with CDMage and it unfortunetly didn't work.



Yeah... that dump is probably the issue. Track down the ReDump version, and use Imageburn to load the cue file - it won't matter if there's multiple tracks if the cue file is correct.


----------



## KleinesSinchen (Jun 8, 2021)

Baraksha1 said:


> well, I attempted to load TonyHax on my PS2 and then said my console is from Japan even though it's europeon and didn't proceed, so I can't really test it on that. I DID got my rom from Coolrom, so maybe that wasn't a bright idea. I thought maybe the problem was that the game was Multitracked so I combined the tracks with CDMage and it unfortunetly didn't work.


The Japanese region message comes on PS2 models newer than 3900x as nocash unlock isn't available on newer PS2 (and *all* Japanese PS1/2). The game has two tracks and you shouldn't combine them. That information is new. I agree with the above statement: Use ReDump verified version. Normally I would say: Simply buy the game on the used market and create a RAW clone copy. But hunting down Symphony of the Night nowadays is an insane task and sooooo expensive.



> I highly doubt my DVD burned is not good, it has served me well through out multiple consoles and this is the kind of thing I feel like  people only suggest because they can't give a solution and is a very unlikely situation in general (no offence) mostly because every time someone says it I try other burners and get the same results.
> 
> as for the CD brand, I am using official Sony CD's so I don't think it gets more High Quality then this. the only thing I can think of is that the Rip I used is bad, it definatly works on emulator, but my modded PS2 can't read it(also yes my PS2 is modded, but I only tested official PS1 games with it not burned so idk what should happen) so I think you have a point there, the only problem is that now im not sure where I can look for good High Quality rips and I know as hell I am not going to ask for it here considering the guide lines.


No that is not a longshot or something I pulled out of the void. I often suggest things like this because it is a valid method of pinpointing the issue: Find out what is *not* the issue. I do it all the time myself. And I can't know what you already did. I have noticed subtle readability differences on the same CD-R media with different burners. Many PS1 drives/lasers are on their last leg. Some only work correctly when the console stands almost vertically. Really, I'm just trying to help and write down everything what could theoretically be an issue.


----------



## Baraksha1 (Jun 8, 2021)

KleinesSinchen said:


> The Japanese region message comes on PS2 models newer than 3900x as nocash unlock isn't available on newer PS2 (and *all* Japanese PS1/2). The game has two tracks and you shouldn't combine them. That information is new. I agree with the above statement: Use ReDump verified version. Normally I would say: Simply buy the game on the used market and create a RAW clone copy. But hunting down Symphony of the Night nowadays is an insane task and sooooo expensive.
> 
> 
> No that is not a longshot or something I pulled out of the void. I often suggest things like this because it is a valid method of pinpointing the issue: Find out what is *not* the issue. I do it all the time myself. And I can't know what you already did. I have noticed subtle readability differences on the same CD-R media with different burners. Many PS1 drives/lasers are on their last leg. Some only work correctly when the console stands almost vertically. Really, I'm just trying to help and write down everything what could theoretically be an issue.



yeah, I apologize if that came out as rude. im just curious because I don't commonly see that actualy being the problem. I know you're just trying to help, I just don't want to waste more CDs unecesaraly as I am getting short. also yeah as much as I love that game I can not afford to get a copy of it.
btw I was not aware of this Redump website, I don't seem to be good at tracking down the dump I need tho....
btw just to be clear, TonyHax DOES contain anti Region lock right?

EDIT: I was able to find a ReDump version, it looks similar to the first one I burned, but i'll give this a shot. if this doesn't work, then im not sure what else I can do.


----------



## duwen (Jun 8, 2021)

The ReDump of it I have (think it came from the internet archive) looks like this;

```
Castlevania - Symphony of the Night (USA) (Track 1).bin 
2016-11-26 20:29 538655040
Castlevania - Symphony of the Night (USA) (Track 2).bin 
2016-11-26 20:29 44676240
Castlevania - Symphony of the Night (USA).cue 
2016-11-26 20:29 252
```
Worked fine for me burned with Imageburn


----------



## KleinesSinchen (Jun 8, 2021)

Baraksha1 said:


> yeah, I apologize if that came out as rude. im just curious because I don't commonly see that actualy being the problem. I know you're just trying to help, I just don't want to waste more CDs unecesaraly as I am getting short. also yeah as much as I love that game I can not afford to get a copy of it.
> btw I was not aware of this Redump website, I don't seem to be good at tracking down the dump I need tho....
> btw just to be clear, TonyHax DOES contain anti Region lock right?


Nah, all good. Didn't come across rude.
PlayStation does like Sony blanks. CD-R quality does matter. No doubt about this. It is less important on PS1 than… let's say DVD-R on GameCube – those drives are picky beyond believe – but really. Not every PS1 likes every CD-R.
Supposedly the laser can be tuned to accept CD-RW to avoid the waste issues with coasters – but then it might not be able to read originals and CD-R and this procedure is risky (increased power on the aging lasers). I would rather buy a pack of CD-R than risk that.

The idea with the different burner is: The writer could be defective (and my PlayStations don't like my laptop burner). If you say the writer is good, then it is good.
The idea with the burning software: PS1 titles are Mode2 tracks – this may sometimes cause trouble with some software (I had some trouble with this but it was very, very long ago). Normally I just copy my discs with Alcohol 120% → not a single problem. With cue/bin files imgburn should be a safe bet.

Tonyhax loads region free. Seems it was a primary reason why socram8888 developed this.
https://orca.pet/tonyhax/


			
				orca.pet/tonyhax/ said:
			
		

> Also, as an owner of a SCPH-102 console, these are a pain in the ass when it comes to chipping - in addition to the generic SCEx wobble check performed by the CD controller that is easily patchable, the boot menu on these also checks for the region string, which involve installing even more wires and a full sized Arduino Pro Mini or AtMega328 chip to patch the CPU BIOS to play out of region games. Not cool.


----------



## Baraksha1 (Jun 8, 2021)

duwen said:


> The ReDump of it I have (think it came from the internet archive) looks like this;
> 
> ```
> Castlevania - Symphony of the Night (USA) (Track 1).bin
> ...


I just burned it and it didn't work, I got mine from the Internet Archive aswell, tho I got the Europeon version just to be safe. the file dates are identical to the ones you posted still. I don't know what to do at this point, but I guess it's perhaps worth mentioning that I DO use ImgBurn and I burn the game on x1 speed. I am kind of curious tho because I DID saw a video that mentions that it might not be the best idea but im not sure.


KleinesSinchen said:


> Nah, all good. Didn't come across rude.
> PlayStation does like Sony blanks and the idea with the different burner is: The writer could be defective (and my PlayStations don't like my laptop burner). If you say the writer is good, then it is good. The idea with the burning software: PS1 titles are Mode2 tracks – this may sometimes cause trouble with some software. Normally I just copy my discs with Alcohol 120% → not a single problem. With cue/bin files imgburn should be a safe bet.
> 
> Tonyhax loads region free. Seems it was a primary reason why socram8888 developed this.
> https://orca.pet/tonyhax/


yeah, I recall seeing this on the website, just wanted to make absolute sure is all.

EDIT: I did some extra stuff for the heck of it. I was able to find a really old copy of Oddworld Abe's Oddysee I burned a long time ago, not in the best condition, but when I tested it with TonyHax it was detected and was booted, but it only loaded a blank screen and didn't load anything past that. so I guess this shows it DOES work with other games? I also decided to see what happens if I put a normal ps1 game and it did load it fine. so I guess that at the end of the day even if it won't fully work I can probably still use this to get passed region lock. (I would still love this to work tho)

EDIT 2: Ok, so I now decided to burn another game, Klonoa Door To Phantomile. it had the exact same problem. after considering the fact the other old disks I have were recognized fine I think that maybe, JUST maybe, what if the problem is suprisengly with the Sony CD's? I can't test this out atm since they all I have, but what if Sony CD's as Ironic as it may be just don't work on Sony's own system?

EDIT 3: I decided to put the Klonoa disk in my PS2 and it Eventualy actualy worked! im saying eventualy because it failed to read the first time , second time it loaded for a while but it actualy was able yo detect it. now I feel more convinced this has something to do with my CDs or how I burn them. if the PS2 BARELY boot it, then the PS1 is sure to have problems.


----------



## socram8888 (Jun 9, 2021)

Baraksha1 said:


> I tried looking this up but I couldn't find a solution, I recently burned Castlevania Symphony Of The Night and when I tried using TonyHax it returned a code error:
> 
> "disk error type d code 12 (x11)"
> 
> is it a problem with the disk I burned?


For the record, type D stands for "disc", and it means a read error from the physical disc (as opposed to type B or "boot" which would be that the data could be read but made no sense). Code 12 means an error occured while reading the table of contents (the very first action performed when inserting a CD), and finally x11 means it retried for 11 times.


----------



## Baraksha1 (Jun 9, 2021)

socram8888 said:


> For the record, type D stands for "disc", and it means a read error from the physical disc (as opposed to type B or "boot" which would be that the data could be read but made no sense). Code 12 means an error occured while reading the table of contents (the very first action performed when inserting a CD), and finally x11 means it retried for 11 times.


Thanks for the reply. honestly? I was thinking about this and making comparisons, im not sure how insane this sounds but, I theorize that maybe the Sony CD's inner area seem about a mm thicker, maybe the lazer just can not reach the TOC properly? Btw I forgot to ask, on very rare acations the program would write "code 22" rather then "code 12", not sure what type of error it is. Do you happen to have a code error list because I personaly couldnt find it

EDIT: I decided to go buy new CD-Rs, its the only brand anyone sells in my country this days called "Silver Line" , it is not to commonly talked about in English websites but I saw an old forum thread saying they recomand them. either way, I attempted to burn with them and had the same results. I even decided to eat my own words and attempted burning on a different laptop. still met the same results.


----------



## socram8888 (Jun 9, 2021)

You might wanna consider adjusting the trim pot on the CD laser:


----------



## Baraksha1 (Jun 9, 2021)

socram8888 said:


> You might wanna consider adjusting the trim pot on the CD laser:



thanks for the sugestion, I did what he said including the Resistance number, unfortunetly, the results are still the same. I observed the disk with the lid on, always spins slowly for a bit before completely stoping. it probebly can't find the header like you said.


----------



## Leon11 (Jun 10, 2021)

I already have modchipped PS1 but i'm planning to buy an untouched PS1 only to use Tonyhax. I still prefer the Game Boot method because i still can save on the Memory Card and it's easier to update the exploit, and i don't need to be careful about the bios of the PS1, it works on every supported model, i just need to swap the Memory Card between consoles. Of course FreePSXboot is faster and doesn't need an original game (i think this is the main deal breaker for most of us). I would really want that Tonyhax search for exploit in Slot 2 too, but of course i don't know if it is already been answered and if it is possible (i'm talking about the original game boot method). Thanks for this awesome exploit!


----------



## KleinesSinchen (Jun 10, 2021)

Leon11 said:


> View attachment 266462
> I already have modchipped PS1 but i'm planning to buy an untouched PS1 only to use Tonyhax. I still prefer the Game Boot method because i still can save on the Memory Card and it's easier to update the exploit, and i don't need to be careful about the bios of the PS1, it works on every supported model, i just need to swap the Memory Card between consoles. Of course FreePSXboot is faster and doesn't need an original game (i think this is the main deal breaker for most of us). I would really want that Tonyhax search for exploit in Slot 2 too, but of course i don't know if it is already been answered and if it is possible (i'm talking about the original game boot method). Thanks for this awesome exploit!


How would needing an original game be a deal breaker? There are many games with an exploit. The Crash Bandicoot games sold pretty well.

The Slot 2 thing: I guess this is game depended. Most games only look at Slot 1, which means having an exploit in Slot 2 won't do anything. Is this so important for the game entry points? Most games take one or two blocks on Memory Card and Tonyhax itself two blocks. Enough space for some more games on the same MC.
Slot 2 would also be interesting for the FreePSXBoot method but I don't know if the nature of the exploit even allows this (the technical description requires more concentration than I'm currently able).


----------



## qkwyx (Jun 13, 2021)

@socram8888 Good day to you. Is it possible to make a tonyhax.exe file to a tonyhax.rom file so that I can use it to flash using X-Flash utility and flash it to a Cheat Cart (I have Gameshark v2). If not possible, its okay no worries. Thanks for your hardwork on Tonyhax.


----------



## socram8888 (Jun 13, 2021)

qkwyx said:


> @socram8888 Good day to you. Is it possible to make a tonyhax.exe file to a tonyhax.rom file so that I can use it to flash using X-Flash utility and flash it to a Cheat Cart (I have Gameshark v2). If not possible, its okay no worries. Thanks for your hardwork on Tonyhax.


It's possible but I can't do it myself as I don't have any hardware that supports those devices to test it.


----------



## qkwyx (Jun 13, 2021)

socram8888 said:


> It's possible but I can't do it myself as I don't have any hardware that supports those devices to test it.


No worries just asking and thanks for the reply.


----------



## DarthMotzkus (Jun 21, 2021)

Hi @socram8888, how are you?
I opened an issue on the tonyhax git page, about "Mizzurna Falls". With the recent launch of translation of the game, i tried to play it using tonyhax but it get stuck on a black screen after the first FMV in New Game. Could you please look into it?

Thanks!

https://github.com/socram8888/tonyhax/issues/95


----------



## socram8888 (Jul 6, 2021)

Hello everyone. I need some betatesters: https://github.com/socram8888/tonyhax/files/6760603/tonyhax-v1.4.2b.zip

Specially those owning a PS2, as I've made some changes those consoles might not like.

If everything's working fine I'll make a new release.


----------



## duwen (Jul 12, 2021)

DarthMotzkus said:


> Hi @socram8888, how are you?
> I opened an issue on the tonyhax git page, about "Mizzurna Falls". With the recent launch of translation of the game, i tried to play it using tonyhax but it get stuck on a black screen after the first FMV in New Game. Could you please look into it?
> 
> Thanks!
> ...



I also tried this one on my PS2. Same thing. Black screen after opening 'credits' fmv.
I used a 'pre-patched' version of the game I downloaded from somewhere - when I get a chance I'll try with a version I patch myself (made a difference with the Resident Evil True Directors Cut patch).


----------



## socram8888 (Jul 12, 2021)

duwen said:


> I also tried this one on my PS2. Same thing. Black screen after opening 'credits' fmv.
> I used a 'pre-patched' version of the game I downloaded from somewhere - when I get a chance I'll try with a version I patch myself (made a difference with the Resident Evil True Directors Cut patch).


That game will just not work on a PS2, because of a dirty hack they used when translating the game. From issues 95 where I fixed this:


> Please try this version: tonyhax-v1.4.2b.zip (built from 95a3ed9)
> 
> This crash was caused by an illegal opcode at 0x8000B104. This was odd and puzzled me because this is within the area of RAM reserved for the BIOS' heap, so the game had no business calling here. In fact, the original, Japanese version doesn't do this.
> 
> ...


And issue 99 where I rolled back the previous change:


> Okay thanks for the report. This issue has been apparently introduced while attempting to fix issue #95 (pinging @DarthMotzkus which was the reporter of the issue).
> 
> That English translation uses a terrible hack - it essentially expects the sectors read from the CD to be at a predefined address, and they assumed (and I believed that) it was fixed through all PS1 and PS2 consoles.
> 
> ...


----------



## SMVB64 (Oct 11, 2021)

Hey guys, quick question - I have a NSTC PSone
Does it matter which bios version I use? 4.4 or 4.5

Edit - oops I posted this in the news section - apologies for the bump


----------



## DarthMotzkus (Oct 11, 2021)

SMVB64 said:


> Hey guys, quick question - I have a NSTC PSone
> Does it matter which bios version I use? 4.4 or 4.5
> 
> Edit - oops I posted this in the news section - apologies for the bump


It matters, you need to figure wich version is you PSOne Bios, searching your model on google.


----------



## KleinesSinchen (Oct 11, 2021)

DarthMotzkus said:


> It matters, you need to figure wich version is you PSOne Bios, searching your model on google.


It matters only in theory. There is a distinction between 4.4/4.5 for FreePSXBoot images for the case that it is needed at some point. In practice all SCPH-101 and SCPH-102 images for 4.4/4.5 BIOS have the same checksum. Four times the same image for SLOT-1 and four times a different one for SLOT-2.


----------



## SMVB64 (Oct 11, 2021)

KleinesSinchen said:


> It matters only in theory. There is a distinction between 4.4/4.5 for FreePSXBoot images for the case that it is needed at some point. In practice all SCPH-101 and SCPH-102 images for 4.4/4.5 BIOS have the same checksum. Four times the same image for SLOT-1 and four times a different one for SLOT-2.



Thanks, man - I took a gamble and ended up installing the wrong biso lol - I have 4.4 psone not 4.5. Your right - it did boot up but I'm getting Disc Error type D Code 12 - Gonna see if I can install the correct bios hopefully

Update: Man I hate burning games - burnt 5 disks on different 3 different DVD burners and PC's and still Disc Error type D Code 12 -  ISO are Redump as well


----------



## CyberTails (Oct 13, 2021)

Has anyone tested the NTSC-U version of Sports Superbike 2 to launch the Payload? I have said version. But atm I have no way to get Tonyhax into my PS1 Memory Card


----------



## Leon11 (Oct 21, 2021)

For Mizzurna Falls translated issue that freeze after the new game you can load Tonyhax, then load the Unirom Boot CD and then boot the game from there, it works! I have Tonyhax 1.4.3 both FreepSXBoot and Game boot but it freezes on that point. Castlevania Symphony of the Night can format a FreePSXBoot easily on the change name menu.


----------



## Leon11 (Oct 28, 2021)

Maybe i noticed something strange. Latest version of Tonyhax (1.4.3) in combination with FreePSXBoot on a PSOne SCPH-102B with a Dualshock 2 inserted the console freezes when clicking the memory card icon, all fine with an original Dualshock for PS1. With Unirom in combination with FreePSXBoot work fine with a Dualshock 2 too. I didn't test other console models or the Tonyhax with the Disc boot but this is the issue in my case.


----------



## DarthMotzkus (Oct 28, 2021)

Leon11 said:


> Maybe i noticed something strange. Latest version of Tonyhax (1.4.3) in combination with FreePSXBoot on a PSOne SCPH-102B with a Dualshock 2 inserted the console freezes when clicking the memory card icon, all fine with an original Dualshock for PS1. With Unirom in combination with FreePSXBoot work fine with a Dualshock 2 too. I didn't test other console models or the Tonyhax with the Disc boot but this is the issue in my case.


You should report it on the issues section, via GitHub of the project.


----------



## BilehBawb (Oct 31, 2021)

Getting Disk Error D Code 22, what does this mean?


----------



## alexfree (Aug 4, 2022)

qkwyx said:


> @socram8888 Good day to you. Is it possible to make a tonyhax.exe file to a tonyhax.rom file so that I can use it to flash using X-Flash utility and flash it to a Cheat Cart (I have Gameshark v2). If not possible, its okay no worries. Thanks for your hardwork on Tonyhax.


Hey Tonyhax International supports this! You can flash the cheat cart with the NXFlash CD in the tonyhax international release.

@socram8888 I would love to hear your thoughts on my fork of Tonyhax. https://alex-free.github.io/tonyhax-international We have 8 Japanese games supported for save game exploits, GameShark/flashing cheat cart via CD images, and Japanese support for all Japanese PS1 consoles and early Japanese PS2 consoles


----------

